Settings -> Secrets -> Actions -> New Repository SecretĪnd then put NS_TOKEN in as the name and the paste in the copied token from above. User Profile (upper right) -> Tokens -> Add token name -> Generate -> Copy tokenįrom there, you’ll add the token as a secret in the forked K-9 repo: NowSecure JWT Tokenįirst, you’ll log in to NowSecure Platform and then (step-by-step documented in “ Creating an API Bearer Token in Platform”): Once you have access to NowSecure (see free trial link above), you’ll need to generate an API JWT token and then determine your app’s group id. Now we’ll create a new GitHub action that will build the debug version of the app and run the NowSecure: Mobile SBOM GitHub Action to generate an SBOM via binary analysis and submit it to the repo’s Dependency Graph via the beta Dependency Submission API. rw-r-r- 1 hiro staff 385B Nov 7 08:31 output-metadata.jsonĢ. rw-r-r- 1 hiro staff 13M Nov 7 08:31 k9mail-debug.apk Which should build the app and store it at: ls -lh app/k9mail/build/outputs/apk/debug/ So, let’s fork the k-9 repo into your own account and then swap out ahoog42 for your GitHub username: While you could perform all changed needed directly in the GitHub UI, I prefer to work locally and then push changes. You can find it on both F-Droid as well as the Play Store.

K-9 Mail is a popular open source Android email app that’s been around since at least 2008 ( initial commits) and in active development. Code setupįor this demo, we’ll change from a React Native Android app in previous tutorials to a more traditional Java + Kotlin app. We can then leverage the above techniques to automatically generate an Android SBOM each time you update your mobile app. This article will walk you though setting up your environment, building a React Native Android app, generating a list of dependencies with gradle and and finally how to generate a CycloneDX SBOM with binary analysis leveraging NowSecure Platform. To brush up on the previous techniques, check out my blog+video on how to generate an Android SBOM in CycloneDX format.

If you’re not a NowSecure customer, first sign up for 10 free SBOMs so you can follow along in the tutorial.

If you’d like to generate an Android SBOM every time you build your app, you can combine previous techniques discussed on this blog to achieve this with GitHub Actions + NowSecure.

Github actions kotlin