nenadzaric/skills-android-apkid-identify repository overview

⁠apkid-identify

Offline static Android fixture tool. This is a new integration validated on a self-owned synthetic fixture, not a claim about arbitrary app compatibility.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-apkid-identify@sha256:353ba656891afebc464d6f49f0a413bd1f0a4afe8cb84498b296501221db216a

Image index: sha256:210b9fe61a328d79ec58706d76f201622b5095a45e410036999d95e14371f3bf.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains apkid-identify/build-source/ (the Python adapter, Dockerfile, locked requirements where applicable, owned fixtures and native test harnesses) and apkid-identify/notices/ (primary texts and original installed/embedded dependency notices with exact hashes). It is the source for the custom entrypoint; native upstream alone does not contain this adapter. Git/recipe image relocation and subsequent delivery metadata do not change executable image bytes. Supplemental source/notice indexes are accompanying documentation, not claimed present in the already-built image.

oras pull docker.io/nenadzaric/skills-android-apkid-identify@sha256:78f7c0387332be41a16f5d10858b7f2aa993c7b4799da8e5d0b9f8e87a656d74
sha256sum apkid-identify-source-notices.tar.gz

Expected bundle SHA256: 496c5a6848345c2f7c440670dcb2a95b7ef0908b5aa5a6415915856c0520404f. Extract this archive to read the source and notices/SOURCE-AND-NOTICES.json.

Pinned native upstream: https://github.com/rednaga/APKiD/tree/3db7bb9c57166b63e8855940b75966e62a6cf1ed⁠

Pinned native source archive: https://codeload.github.com/rednaga/APKiD/tar.gz/3db7bb9c57166b63e8855940b75966e62a6cf1ed⁠

Native upstream license: GPL-3.0. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new open-source license grant. Dependencies retain their own licenses/notices. This inventory is not an exhaustive SBOM or independently reproducible binary build.

⁠Included native sources

The artifact includes the pinned primary source archive plus applicable recursive source submodule archives, with path/commit/hash mappings in notices/SOURCE-AND-NOTICES.json. APKiD includes YARA Python/DEX sources and its real compiled rule file hash index. MobSFScan includes its source, libsast3.1.8 and Semgrep1.172.0 with recorded recursive submodule sources. No commercial APKiD license is used.

⁠Reproduce native fixture checks

After pulling the public image above and extracting the source bundle, assign a LOCAL alias matching the original build test harness. This does not push or require private registry access.

docker tag docker.io/nenadzaric/skills-android-apkid-identify@sha256:353ba656891afebc464d6f49f0a413bd1f0a4afe8cb84498b296501221db216a ghcr.io/nenadzaric/skills-android-apkid-identify:3.1.0-source-rules1
cd apkid-identify/build-source
python3 test_native.py