Skip to main content

How to scan Android Projects with Lifecycle IQ Server

Updated

.

Overview

Our ideal scan target is a post-build, production-like artifact. When we perform an evaluation, we traverse the contents of the artifact searching for known extensions eg *.jar. Once we come across a known extension, we fingerprint that file and examine the contents of the file i.e. *.class. It is the collection of this information that then allows us to identify the component/library in use and the ability to provide any metadata we have on that component.

However, in the case of Android, it must be treated differently. We do not support scanning a *.apk directly due to the minification performed via the Dalvik byte code process. For this reason, scanning before the assembling of the .apk is required.

Check out this article for more information on How Your Android Code Compiles to Deliver .APK Package File.

See below for options on scanning Android applications, which can be referenced when interacting with development teams.

 

Solutions

Option 1:

To scan your Android packages, the easiest integration is at build time. If you are building with Maven, you can simply use the Sonatype Maven plugin, which is downloaded when invoked. A sample command of the required arguments below would be sufficient:

mvn com.sonatype.clm:clm-maven-plugin:evaluate -Dclm.applicationId=test -Dclm.serverUrl=http://localhost:8070

In this example, we are executing the Sonatype maven plugin and running the evaluate goal, which will scan the dependencies and build artifacts of your project. The additional parameters -Dclm.applicationId and -Dclm.serverUrl are also required, which provide the IQ Server URL and Application ID. These can be provided by your IQ Server administration team.

 

Option 2:

If you are not building with Maven, but are using a build tool that handles Maven commands (Eg Gradle) the best alternative is to execute the Maven copy dependencies command:

mvn dependency:copy-dependencies

This will copy the dependencies of your project to a separate directory. This directory can then be scanned via the CLI or compressed into a zip file and scanned via the UI.

 

Option 3:

If you are not using maven or not using a build tool that handles maven commands, the next option is to manually or automatically (depending on the build tool) copy the dependencies of your project to a separate folder and follow the directions above for scanning it via the CLI or UI.

We have a sample build.gradle that defines a build task that calls out to the CLI to do a scan during the gradle build - see attached.


Option 4:

Generate an SBOM and scan with the CLI. Please download the demo Sonatype-Support-Android-Scanning-TEST.tar.gz, this project is an example Android Gradle project, there are two examples covered, Option 2 above and Option 4. For example:

# Option 2
[test@Sonatype-Support-Android-Scanning-TEST]$ ./gradlew copyDependencies --refresh-dependencies --rerun-tasks -Dorg.gradle.caching=false

This will create the following:

[test@Sonatype-Support-Android-Scanning-TEST]$ ls app/build/dependencies/ -al
total 18380
drwxr-xr-x. 2 sbrown sbrown    4096 Jul 16 17:49 .
drwxr-xr-x. 4 sbrown sbrown    4096 Jul 16 17:54 ..
-rw-r--r--. 1 sbrown sbrown 1655985 Jul 16 17:49 appcompat-1.6.1-runtime.jar
-rw-r--r--. 1 sbrown sbrown 2855321 Jul 16 17:49 core-1.12.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown   11657 Jul 16 17:49 core-common-2.2.0.jar
-rw-r--r--. 1 sbrown sbrown   10511 Jul 16 17:49 core-runtime-2.2.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown   22543 Jul 16 17:49 cursoradapter-1.0.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown   67868 Jul 16 17:49 customview-1.0.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown   24579 Jul 16 17:49 documentfile-1.0.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown   61244 Jul 16 17:49 drawerlayout-1.0.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown  133317 Jul 16 17:49 exifinterface-1.3.7-runtime.jar
-rw-r--r--. 1 sbrown sbrown  624966 Jul 16 17:49 fragment-1.3.6-runtime.jar
-rw-r--r--. 1 sbrown sbrown   10432 Jul 16 17:49 interpolator-1.0.0-runtime.jar
-rw-r--r--. 1 sbrown sbrown  237372 Jul 16 17:49 jetified-activity-1.6.0-runtime.jar
...and some more

If we scan this folder with IQ CLI we will see lots of component unknowns and a handful of direct and transitive dependencies:

[test@Sonatype-Support-Android-Scanning-TEST]$ ~/nexus-iq-cli-2.8.5-01-linux-x86_64/bin/java -jar ~/nexus-iq-cli-2.11.0-01.jar -i testscan -s http://192.168.0.172:8070 -a admin:admin123 -t build app/build/dependencies

[INFO] *********************************************************************************************
[INFO] Policy Action: None
[INFO] Stage: build
[INFO] Number of components affected: 0 critical, 0 severe, 56 moderate
[INFO] Number of open policy violations: 0 critical, 0 severe, 56 moderate
[INFO] Number of legacy violations: 0
[INFO] Number of components: 77
[INFO] The detailed report can be viewed online at http://192.168.0.172:8070/ui/links/application/testscan/report/afe0a62093f24d94b2ff42165fda63f0
[INFO] The application priorities can be viewed online at http://192.168.0.172:8070/ui/links/developer/integrations/testscan/afe0a62093f24d94b2ff42165fda63f0/cli
[INFO] *********************************************************************************************

For a better result we can generate an SBOM, as follows:

# Option 4
[test@Sonatype-Support-Android-Scanning-TEST]$ ./gradlew cyclonedxBom

It may be necessary to add the following to app/build.gradle.kts:
 

vi app/build.gradle.kts

tasks.named("cyclonedxBom") {
    // Dynamic property configuration
    setProperty("includeConfigs", listOf("releaseRuntimeClasspath"))
}

 
It is then possible to scan the bom.json file using the CLI:
 

[test@Sonatype-Support-Android-Scanning-TEST]$ ~/nexus-iq-cli-2.8.5-01-linux-x86_64/bin/java -jar ~/nexus-iq-cli-2.11.0-01.jar -i testscan -s http://192.168.0.172:8070 -a admin:admin123 -t build app/build/reports/bom.json

[INFO] *********************************************************************************************
[INFO] Policy Action: None
[INFO] Stage: build
[INFO] Number of components affected: 0 critical, 7 severe, 0 moderate
[INFO] Number of open policy violations: 0 critical, 14 severe, 0 moderate
[INFO] Number of legacy violations: 0
[INFO] Number of components: 77
[INFO] The detailed report can be viewed online at http://192.168.0.172:8070/ui/links/application/testscan/report/09f34937d3904edaa4b158d91307e06e
[INFO] The application priorities can be viewed online at http://192.168.0.172:8070/ui/links/developer/integrations/testscan/09f34937d3904edaa4b158d91307e06e/cli
[INFO] *********************************************************************************************

 

Additional References:

 

Related articles