Bitbucket Server

Overview

Connect Bitbucket Server to FOSSA so users can browse and import their internal repositories. The setup has three parts: creating an OAuth1 Application Link so users can authenticate, adding a fossabot service account so FOSSA can fetch code, and configuring webhooks so FOSSA rescans on every push.

Setting up the Application Link

The Application Link lets users log in to Bitbucket Server and view their projects through FOSSA.

1. 1

   Open Application Links

   In Bitbucket Server, go to Settings → Application Links.

   Expand

2. 2

   Create a link to FOSSA

   Click Create link and enter FOSSA's internal IP address as the application URL.

   Expand

   Fill in fossa for all options when prompted.

   Expand

3. 3

   Generate an RSA keypair

   On the machine where FOSSA On-Prem is running, generate a 2048-bit RSA keypair. You will use the public key in Bitbucket and the private key in FOSSA's configuration.

   ShellCopy

   openssl genrsa -out privkey.pem 2048openssl rsa -pubout -in privkey.pem -out pubkey.pem

   Keep both files. You will need them in the next two steps.

4. 4

   Configure Incoming Authentication

   In the Application Links list, find the link you just created and click Edit → Incoming Authentication.

   Expand

   Fill in the following fields and click Save (leave all others blank):

   Field	Value
   Consumer Key	fossa
   Consumer Name	fossa
   Public Key	(paste the contents of pubkey.pem generated in the previous step)

   Warning

   The Public Key field must contain the RSA public key you generated in the previous step, not a copied example. Using someone else's public key will mean FOSSA cannot authenticate.

   Expand

Users can now connect their Bitbucket Server accounts to FOSSA.

Adding the fossabot service account

FOSSA requires a fossabot account on your Bitbucket Server instance with global read access to fetch code for analysis.

1. 1

   Create the fossabot user

   In Bitbucket Server, go to Settings → Accounts → Users and click Create User.

   Expand

   Expand

   Use the username and password from FOSSA's config.env (the defaults are shown below, change them if your deployment uses custom values):

   ShellCopy

   bitbucket_server__credentials__basic__username=fossabotbitbucket_server__credentials__basic__password=fossa123

2. 2

   Grant global read access

   fossabot must be able to clone any repository in your Bitbucket Server instance. The simplest way is to grant admin privileges at Settings → Accounts → Global Permissions.

   Expand

   If you need a custom role instead of full admin, ensure the account still has global read access by verifying it can clone repos across different projects.

Users on FOSSA can now browse and import their Bitbucket Server repositories via Bulk Import.

Configuring automatic updates

After importing a project, configure webhooks in both FOSSA and Bitbucket Server so that new commits trigger a rescan automatically.

1. 1

   Enable webhook updates in FOSSA

   Open the imported project in FOSSA and go to Settings → Update Hooks. Select Webhook as the update method and click Save Changes. Copy the Webhook Update URL shown on the page.

2. 2

   Create a webhook in Bitbucket Server

   Bitbucket Server and Data Center have webhooks built in. In the project's repository settings, open Webhooks and click Create webhook. See Atlassian's Manage webhooks guide for details. (Older instances without native webhooks can use the legacy Post-Receive Webhooks add-on instead.)

3. 3

   Point the webhook at FOSSA

   Paste the Webhook Update URL from step 1 as the webhook URL, enable the webhook for repository push events, and save.

On-Prem Helm configuration

If you are deploying FOSSA On-Prem via Helm, configure Bitbucket Server in your input-values.yaml. The privateKey must match the private key you generated during the Application Link setup.

bitbucketEnterprise:  url: http://bitbucket.your-company.com  cloneWithSSH: false  # set to true to clone over SSH; also configure fetchers.git   ## OAuth1 credentials (from Application Link setup)  clientId: fossa  privateKey: |-    -----BEGIN RSA PRIVATE KEY-----    # paste the contents of privkey.pem here    -----END RSA PRIVATE KEY-----   ## Basic auth credentials (must match fossabot account)  username: fossabot  password: fossa123

If you have any problems, contact support at support@fossa.com.