Dec 2021 Update

Security Advisory on Log4j

Digital Rose has reviewed and confirmed that the eSign infrastructure is not vulnerable to the Log4J security issue (CVE-2021-44228). The implicated log4J library is not included in any client side or server side components.

For more information on Atlassian Cloud’s overall impact of this issue, see: https://community.atlassian.com/t5/Trust-Security-articles/Atlassian-s-Response-to-Log4j-CVE-2021-44228/ba-p/1886598

Nov 2021 Update

#1 Signature Start Workflow and Page Owners

This update adds additional controls to the eSign process by identifying a new role for Signature Page Owners. Signature management functions such as invite and administration are restricted to the identified owners of each page. Owners are set at the beginning of the process when Signatures are Started.

• The user who Starts eSign for this page is by default an owner; they can optionally add additional users.

• 

  Owners can Invite and Administer signatures for the page. Space administrators can act as Owners.

• Designated owners are displayed in the footer of the Signature panel, and are included in the Signature invite email.

#2 Signatures by Invite Only

eSign now supports restricting pages to only be signed by Invitees. This option can be selected on the Open Signatures dialog (Start).

• Only users who are invited to sign the page will be able to sign.

• Re-signing will be allowed for previously invited users.

#3 Signature Pin Reset Usability and Security Improvements

Simpler and faster Signature Pin resets now occur directly via email as users will receive a new Pin that can be used immediately to sign.

• Pin minimum length has been extended to 6 digits and Pins will expire after 180 days.

• Users may (still) update the Pin to a preferred value via eSign User Settings.

• Signature Reset can be requested in the Execute Signatures or eSign User Settings page.

#4 eSign Macro Grouping

The eSign Macro can now filter by Meanings to allow separate signing blocks on one Confluence page. For example, Approvers and Invitees can show in one block, and Read & Understood signatures can show in a separate eSign Macro on the same page.

#5 Content Version 

At the time of signing, the Confluence content version is captured and displayed for each signature and displayed for page export and the PDF Archive.

• The Content Version signed is also visible in the PDF Signature Archive and in pages with the eSign Macro exported to Word/PDF.

• Note that Confluence does not change content version numbers when attachments are modified. Continue to use the eSign Signature Verification report to confirm neither page content nor attachments were modified since signing.

#6 Additional Items

Invite Dialog Usability

To assist with larger team invites, the Invite Dialog now shows a running counter of how many users are selected for the invite. Note a maximum of 50 users may be invited at a time.

eSign Update Notification

To ensure that users are aware of significant eSign changes in this update, a What Is New help message will display in the Signature Panel the first time a user accesses it.

Click the NEW changes label in the footer to access this info at a later time.

Sep 2021 Update

#1 PDF Signature Archives

eSign now supports automated generation of a PDF Signature Archive as a point in time snapshot of the Finalized Signature content. These archives include Confluence page information, as well as all Attachments, Comments, and Signatures. All Signatures are re-verified as well.

The Archive PDFs are added as attachments to the Confluence page when Signatures are finalized. Users can view/download these archives on demand as needed for reference, offline copy, audits, etc.

See PDF Signature Archives for examples and additional information.

#2 View and Download All Attachments

eSign has now made it easier to access Confluence Attachments by adding links to the Signature dialog. This allows users to quickly view attachments, as well as provide a one-click Download All option to download all page attachments (including the new Signature Archive) as a single .zip file.

Aug 2021 Update

#1 Signature Flexibility

eSign now supports users signing multiple times on the same page with distinct meanings. Repeated signatures with the same meanings will continue to automatically void the previous signature. (Voided signatures can be viewed from the more (…) menu in the eSign Content dialog.)

#2 Pending Signature Label

To make it easier to find and manage pages with Pending Signatures (Users have been invited but have not Signed yet), eSign will now add an esign-pending label to any page with 1 or more pending signatures. This label can be used as a search term within confluence and the (built-in) content report macro. For additional information on searching labels in Confluence Cloud, see the following resources:

• https://support.atlassian.com/confluence-cloud/docs/use-labels-to-organize-your-content/

• https://support.atlassian.com/confluence-cloud/docs/insert-the-content-report-table-macro/

Jun 2021 Update

#1 User Experience Improvements

• Byline Signature summary will now show invite completion as a ratio X/Y.

  

• eSign Invite replies are now automatically addressed to the Invitor (previously replies would be sent to the eSign support desk).

• eSign Invite email format has been refreshed.

#2 Technical Updates

• Cache duration of certain static assets has been extended.

• Update Atlassian connect library for improved security.

May 2021 Update

#1 Read Confirmation workflows

• eSign now supports tracking of Read Confirmations for reference material, corporate policies, etc. Read Confirmations are fully-compliant electronic signatures.

• The Meaning for each Signature can now be selected from a configurable picklist. Default values are “Approval”, and “Read & Understood”. Administrators can modify this list in App Settings.

• A new Read Confirmation blueprint has been added to help get started.

  

#2 eSign Macro - Compact View

• The eSign macro displayed in-page can now be configured between Traditional signature view and a new Compact view. This new view option can be used with any type of Signatures, on any confluence content.

  

#3 User Experience Changes

• Finalize signatures now includes an inline confirmation check.

• Signature status/meanings columns condensed to display Signature meanings within a status lozenge.

• The Signature dialog is now dynamically rendered client side for improved responsiveness.

• Signature Certificate renamed to Signature Verification Report and opens in a new tab.

• Signature dialog toolbar simplified for Finalized pages.

#4 Security

• eSign can now work with content that is only visible/editable to a subset of users through Confluence page restrictions. This change requires the “Act As User” privilege to be available to the App.

• For improved security, the personal Signing Pins are now locked out after a number of invalid attempts. At this point Pins will need to be reset via e-mail.

Apr 2021 Update

#1 Security and Maintenance

April update of eSign for Confluence included internal maintenance and security improvements. No functional changes.

Mar 2021 Update

#1 eSign is now faster with Global CDN

eSign for Confluence static resources are now distributed through the AWS Cloudfront Content Delivery Network (CDN). This will improve Signature display performance and reduce latency for eSign users as the CDN will cache shared resources globally.

#2 Opt-in Content Locking

With this update the AutoLock feature is displayed on the Execute Signature dialog so users can see if the content (page and attachments) will be locked upon signing. Content AutoLock can be enabled/disabled from the eSign App Configure page.

If AutoLock is not enabled, users may still optionally check this box to lock this content with their signature. Space Administrators have access to additional Lock/Unlock functions in the more (…) menu if necessary to manually adjust locked content.

#3 Other Changes

• A "New Recent Updates" flag will display in the footer of the eSign Content dialog when a recent eSign update is detected.  Users may click the flag to access the latest update documentation.

• Instructions improved on the Document Approval and Training Blueprints.
  TIP: Quickly find eSign blueprints by searching for “Signature” in the Confluence Create page.

• Signee Title is now displayed on the Verification Report

Feb 2021 First Release

#1 Electronic Signature Engine

• Extending the core Electronic Signature engine from Jira to Confluence content.

• Apply Electronic Signatures to any confluence content

• Signature verification to certify that the signed confluence content and attachments have not changed

• Invite other users to sign and manage the signature process

#2 Confluence Specific Extensions

• Allow and persist personal signing Pins within Confluence environment.

• Supports optional autoLock of content and attachments to prevent editing once signing has commenced.

• Add eSign Status tracking to show Open and Finalized signature pages

#3 Confluence Macros Blueprints

• Includes inline macro to display and allow Signing from within pages.

• Includes sample and extensible confluence eSign blueprints for Document Approval and Training Attendance forms.