nenadzaric/skills-android-apksigner-verify repository overview

⁠apksigner-verify

Verify a supplied APK signature and report native certificate fingerprints without signing keys or devices.

Source-built AOSP apksigner at android-16.0.0_r1 commit61f88cbe6f81b4536d1ef124daf3caa4ad014afd; native CLI version0.9, not an SDK37 binary equivalence. Linux amd64 tested. Signature integrity and certificate fingerprints do not establish publisher trust, malware safety, installability or device/runtime compatibility. No signing port/key/password, device, app execution or runtime network calls.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-apksigner-verify@sha256:ca037e4830e4eda65f1a7a9b79a65d9f256bb9a2fa597fa034f5076844d84cc8

Image index: sha256:175b7cbaab0ad94bb3ce9249a5c82d42646898ef53d65262ee25a33a243b5695.

⁠Actual adapter source and original notices

The immutable companion artifact contains apksigner-verify/build-source/ with the actual custom adapter, Dockerfile, source locks/build code, captured complete native source archives, owned APK fixtures, tests/verifier and safe platform graph. Native upstream alone does not contain the entrypoint. notices/pinned-upstream-root/ and recorded Git/member proof bind all141 captured source members and131 compiled sources to the pinned tree. notices/dependency-source/ supplies original Conscrypt Java/fullJNI source and exact binary-manifest-declared BoringSSL source. notices/installed-image/ supplies136 original installed notices; notices/openjdk-corresponding-source/ supplies exact OpenJDK sources/Debian patches/descriptor.

oras pull docker.io/nenadzaric/skills-android-apksigner-verify@sha256:ba3aff20a54f296da10b04e50b44a67261f4593319178186be569c4a631dc115
sha256sum apksigner-verify-source-notices.tar.gz

Expected bundle SHA256: 684cb8076fcbc168819517621cf713d359173452ccde72867247ae74f7113129. Read apksigner-verify/SOURCE-DELIVERY.txt and apksigner-verify/notices/SOURCE-AND-NOTICES.json. Later recipe/catalog delivery metadata may change without runtime changes; bundled build-source is the recorded snapshot.

Pinned native source: https://android.googlesource.com/platform/tools/apksig/+/61f88cbe6f81b4536d1ef124daf3caa4ad014afd⁠

⁠Verification and limits

Nine final image cases passed: owned signed APK, Hive output.txt filename, unsigned APK, repacked APK, retained-signature-block one-bit central-directory tamper, malformed ZIP, missing input, oversized input and existing-output preservation. Retained-block tamper produces native CHUNKED_SHA256 digest mismatch and adapter2. Actual bounded fixture/tool/verifier workflow passed3nodes/max1machine; downloaded fixture/native report/verifier hashes and completion registry checked. Native report verifies v2/v3 and exact owned public certificate95c33ae35527669d4130b7ccad26d029a5658678665cc37ba97a3705c2ec5a29. Generated signing key is excluded; consumers can reproduce verification using shipped signed fixtures.

Input20MiB/5000ZIPentries/64MiB declared expansion; missing manifest, duplicates/raw unsafe member paths/symlinks/encrypted entries rejected. Declared ZIP metadata checks are not exhaustive alias validation or peak containment. Native90s/JVM256MiB heap/4MiB post-run logs/report are not total-process memory or peak disk limits. Validated input bytes are staged as input.apk. Native failures become adapter2; native0 must report Verifies. Existing nonempty output preserved.

⁠Reproduce owned checks

cd apksigner-verify/build-source
IMAGE=docker.io/nenadzaric/skills-android-apksigner-verify@sha256:ca037e4830e4eda65f1a7a9b79a65d9f256bb9a2fa597fa034f5076844d84cc8 python3 test_native.py

Containers run network-none on owned inert APK fixtures. No private signing key is needed or delivered.

⁠License scope

Apache-2.0 AOSP core and original Conscrypt/BoringSSL/runtime component terms retained. Existing workflows Proprietary adapter policy is separate; no new grant/relicense. Complete captured source archives are SHA256-guarded and independently Git-member verified; archive encoding variance was resolved by freezing accepted archives without weakening guards or patching native Java. Source build has standard upstream Android.bp KMS exclusions. Conscrypt BoringSSL source identity follows the exact native binary manifest. No bit-reproducible build, exhaustive composition or SBOM claim. Original installed notices and OpenJDK corresponding source supplied.