nenadzaric/skills-android-bundletool-dump-manifest repository overview

⁠bundletool-dump-manifest

Dump the base-module protobuf manifest from a local AAB as native XML; fixed base module, no APK generation.

Pinned bundletool1.18.3 commit586a43a450712a1067f3d92cf7574dee68226302. Linux amd64 tested. Fixed dump manifest --module base. This extracts AAB protobuf manifest XML; it does not validate the whole bundle, decode an APK binary manifest, generate/sign/install APKs or execute app code. No device/provider/runtime network request.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-bundletool-dump-manifest@sha256:f41e7a5dc6e4f707f5aa3e09b373b219fc1ea4a6c647a9c041aa6acda905a5b8

Image index: sha256:a70ccb35b2e7ba5f04f7c5fafa172b0af089a53decba59ce41cd06b224d231c6. Reuses accepted native JAR SHA256a099cfa1543f55593bc2ed16a70a7c67fe54b1747bb7301f37fdfd6d91028e29 and unchanged inherited JRE/base-layer prefix; new adapter independently tested.

⁠Actual adapter source and original notices

The immutable companion artifact contains bundletool-dump-manifest/build-source/ with actual adapter, Dockerfile/lock, owned AAB fixtures/source provenance, native tests/verifier and safe platform graph. Native upstream alone does not contain this entrypoint. Pinned native project source archive: notices/primary-source/, with exact DumpCommand.java byte binding. Original132installed image notices: notices/installed-image/; exact18embedded JAR license/notice/Maven metadata files: notices/embedded-java-notices/. Inherited exact OpenJDK source/patches/descriptor: notices/openjdk-corresponding-source/. Native/runtime/source reuse hashes retained under notices/.

oras pull docker.io/nenadzaric/skills-android-bundletool-dump-manifest@sha256:d72a549583f827ce6143989ba925793a32093959accd909f0ca09355b3ada3c2
sha256sum bundletool-dump-manifest-source-notices.tar.gz

Expected bundle SHA256: e81ad8b2d5e464ee426da79525e9f14a66847b9004f213704fd70b29837bc381. Read bundletool-dump-manifest/SOURCE-DELIVERY.txt and bundletool-dump-manifest/notices/SOURCE-AND-NOTICES.json. Later recipe/catalog delivery/status metadata may change without runtime changes; bundled source is the recorded snapshot.

Pinned native source: https://github.com/google/bundletool/tree/586a43a450712a1067f3d92cf7574dee68226302⁠

⁠Verification and limits

Nine final-image cases passed: owned baseAAB, Hive output.txt filename, empty output, missing base manifest, corrupt protobuf, malformed ZIP, missing file, oversized file and nonempty output preservation. Positive paths return0; native errors/preflight errors become adapter2 without replacing successful output. Missing base manifest and malformed ZIP are adapter preflight; corrupt protobuf exercises real native failure. Actual bounded private fixture/tool/verifier workflow passed3nodes/max1machine. Downloaded AAB/native XML/verifier hashes, parsed package org.trickest.fixture/versionCode1/minSdk21/targetSdk28/application and unchanged completion image checked. No app method/device execution.

Input20MiB/5000ZIPentries/64MiB declared expansion. Raw unsafe/duplicate names, symlink/encrypted entries rejected; base/manifest/AndroidManifest.xml required. These declared metadata checks are not exhaustive ZIP alias validation or peak containment. Native90s/JVM256MiB heap/4MiB post-run stdout/stderr/XML caps are not total-process or peak disk limits. Input bytes staged unchanged as input.aab; output must be well-formed XML with manifest root. This postcondition does not establish complete bundle validity. No XPath/module/network/signing option.

⁠Reproduce owned checks

cd bundletool-dump-manifest/build-source
IMAGE=docker.io/nenadzaric/skills-android-bundletool-dump-manifest@sha256:f41e7a5dc6e4f707f5aa3e09b373b219fc1ea4a6c647a9c041aa6acda905a5b8 python3 test_native.py

Network-none containers over fixed owned inert AAB fixtures; original self-owned Android source/generator retained only for provenance, not invoked by checks. No SDKbuild/signing/device needed.

⁠License scope

Apache-2.0 native core and original shaded dependency/runtime component terms retained. Existing workflows Proprietary adapter policy is separate; no new grant/relicense. Exact native binary/JRE inherited proof reused; actual new adapter/native command image proof is separate. Full pinned native project source and exact inherited OpenJDK corresponding source supplied; original embedded and installed notices retained. No exhaustive shaded dependency source mirror, image SBOM or bitreproducible build claim.