# NexusIQ scan for Android

**URL:** <https://community.sonatype.com/t/nexusiq-scan-for-android/1089>\
**Category:** Sonatype Lifecycle & Firewall\
**Tags:** nexus-iq\
**Created:** [January 21, 2019, 3:27pm UTC](https://community.sonatype.com/t/nexusiq-scan-for-android/1089 "2019-01-21T15:27:26Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![vinaykumarbhandari](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vinaykumarbhandari](https://community.sonatype.com/u/vinaykumarbhandari)\
**Post date:** [January 21, 2019, 3:27pm UTC](https://community.sonatype.com/t/nexusiq-scan-for-android/1089/1 "2019-01-21T15:27:26Z")

</div>

Hi,

We’re using Nexus Platform Plugin in Jenkins to carry out **Android scan vulnerabilities.**  
I’m looking for how NexusIq will be scanning Android application?  
I tried to apply the parameter **scanPattern** as [\*.apk] file, but it is not get scanning.

e.g We’re executing following pipeline script in Jenkins

**nexusPolicyEvaluation** iqApplication: ‘ApplicationID’, iqStage: ‘build’, iqScanPatterns: [scanPattern: ‘\*\*/\*.apk’]

Any thoughts?

---

<div class="post-metadata">

**Author:** ![nickcook](https://yyz1.discourse-cdn.com/flex047/user_avatar/community.sonatype.com/nickcook/32/399_2.png) [@nickcook](https://community.sonatype.com/u/nickcook)\
**Post date:** [January 24, 2019, 12:10am UTC](https://community.sonatype.com/t/nexusiq-scan-for-android/1089/2 "2019-01-24T00:10:13Z")

</div>

Hi,

Check out this post from @fcremer for information about scanning Android with IQ server.

> [@How to scan Android for Vulnerabilities?](http://community.sonatype.com/t/how-to-scan-android-for-vulnerabilities/71):
>
> Nexus IQ Server does not support scanning an .apk file directly due to the minification performed via the dalvik byte code process. For this reason, scanning prior to the assembling of the .apk is required. Check out this article for more information on [How Your Android Code Compiles to Deliver .APK Package File](https://codeburst.io/how-your-android-code-compiles-to-deliver-apk-package-file-9f180129c9bf). As an example, in Gradle you could add to your build.gradle a small of amount of additional code that essentially would perform 2 main actions during the build: Execute the copyCom…

---

<div class="post-metadata">

**Author:** ![vinaykumarbhandari](https://avatars.discourse-cdn.com/v4/letter/v/c89c15/32.png) [@vinaykumarbhandari](https://community.sonatype.com/u/vinaykumarbhandari)\
**Post date:** [February 6, 2019, 1:50pm UTC](https://community.sonatype.com/t/nexusiq-scan-for-android/1089/3 "2019-02-06T13:50:56Z")

</div>

Thanks for the workaround. It works.👍  
We are able to scan the Android **vulnerabilities**

Any thoughts, if it available with Nexus Platform Plugin itself?

---

<div class="post-metadata">

**Author:** ![anoop.nair](https://avatars.discourse-cdn.com/v4/letter/a/a3d4f5/32.png) [@anoop.nair](https://community.sonatype.com/u/anoop.nair)\
**Post date:** [November 10, 2022, 4:59pm UTC](https://community.sonatype.com/t/nexusiq-scan-for-android/1089/4 "2022-11-10T16:59:17Z")

</div>

Recently I had the requirement to perform IQ scan on an android package and the above instructions do not work with the latest version of Android. This is confirmed by the Sonatype support team as well. I’ll walk you through the steps that worked for me:

**Environment**

- Dependency and build tool: Gradle
- Build pipeline: Gitlab CI
- Android SDK version: 29

**Design**

1. Generate an SBOM from the apk file
2. Upload SBOM to Sonatype lifecycle to get reporting into the platform
3. Validate violation response to use as a build action

**Steps**

1. Add the following to build.gradle.

> cyclonedx 1.7.x did not work for me.

```auto
plugins {
    id 'org.cyclonedx.bom' version '1.6.1'
}

cyclonedxBom {
    skipConfigs += [
            "debugCompileClasspath",
            "debugAndroidTestCompileClasspath",
            "debugUnitTestCompileClasspath",
            "releaseUnitTestCompileClasspath",
            "debugUnitTestRuntimeClasspath",
            "releaseUnitTestRuntimeClasspath"
    ]
    destination = file("app/build/reports")
}

```

1. Add the following to gitlab-ci.yml file to generate a SBOM file

```auto
iq-sbom:
  stage: build
  # Packages installation before running script
  before_script:
    - chmod +x ./gradlew
  script:
    - ./gradlew cyclonedxBom
  artifacts:
    paths:
      - app/build/reports/bom.xml

```

1. In gitlab-ci.yml,
  - Upload SBOM using Sonatype Rest API to the Sonatype platform
  - Wait for few seconds
  - Validate response
  - Fail build if there is a policy violation
  - Replace IQ\_URL and APP\_ID

```auto
iq-scan:
  stage: security-scan
  variables:
    APPLICATION_INTERNAL_ID: 'APP_ID'
    IQ_URL: 'https://IQ_URL/api/v2/scan/applications/$APPLICATION_INTERNAL_ID/sources/cyclone'
    SCAN_CURL_COMMAND: "curl -k -X POST -H 'Content-Type: application/xml' -u ${iq_user}:${iq_pass} -d @app/build/reports/bom.xml $IQ_URL"
  script:
    - |
     apt-get update && apt-get install jq -y
     STATUS_URL=$(eval "$SCAN_CURL_COMMAND" | grep statusUrl | cut -d ":" -f2 | cut -d "}" -f1 | cut -d '"' -f2)
     sleep 30
     CHECK_STATUS_OUTPUT=$(curl -k -X GET -H 'Content-Type: application/json' -u ${iq_user}:${iq_pass} "https://IQ_URL/$STATUS_URL")
     SCAN_RESULT=$(echo $CHECK_STATUS_OUTPUT | jq -r '.policyAction')
     REPORT_URI=$(echo $CHECK_STATUS_OUTPUT | jq -r '.reportHtmlUrl')
     echo "Report: https://IQ_URL/$REPORT_URI"

     if ["$SCAN_RESULT" = "Failure"]; then
      echo "Scan result: $SCAN_RESULT"
      exit 1
     fi

```