nenadzaric/skills-android-bundletool-validate repository overview

⁠bundletool-validate

Offline static Android fixture tool. This is a new integration validated on a self-owned synthetic fixture, not a claim about arbitrary app compatibility.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-bundletool-validate@sha256:1848f2c9b540fc666b7f47c658f80ef36e12dedd744f681b095b0f9ef4438662

Image index: sha256:08cfcc5eaa0409683fbae6cb0d73961fd59faab3d4f8439225da4086ed1bb7d0.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains bundletool-validate/build-source/ (the Python adapter, Dockerfile, locked requirements where applicable, owned fixtures and native test harnesses) and bundletool-validate/notices/ (primary texts and original installed/embedded dependency notices with exact hashes). It is the source for the custom entrypoint; native upstream alone does not contain this adapter. Git/recipe image relocation and subsequent delivery metadata do not change executable image bytes. Supplemental source/notice indexes are accompanying documentation, not claimed present in the already-built image.

oras pull docker.io/nenadzaric/skills-android-bundletool-validate@sha256:3acacc711ceb8e4b4bbabf3b871e64e4eeebeab51459204ea8fff0de3d73ed2f
sha256sum bundletool-validate-source-notices.tar.gz

Expected bundle SHA256: 5e9eb046bfaa84c7448b3eda1ba32c8117a8ce73b015383910f29a8672e95c24. Extract this archive to read the source and notices/SOURCE-AND-NOTICES.json.

Pinned native upstream: https://github.com/google/bundletool/tree/586a43a450712a1067f3d92cf7574dee68226302⁠

Pinned native source archive: https://github.com/google/bundletool/archive/586a43a450712a1067f3d92cf7574dee68226302.tar.gz⁠

Native upstream license: Apache-2.0. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new open-source license grant. Dependencies retain their own licenses/notices. This inventory is not an exhaustive SBOM or independently reproducible binary build.

⁠Reproduce native fixture checks

After pulling the public image above and extracting the source bundle, assign a LOCAL alias matching the original build test harness. This does not push or require private registry access.

docker tag docker.io/nenadzaric/skills-android-bundletool-validate@sha256:1848f2c9b540fc666b7f47c658f80ef36e12dedd744f681b095b0f9ef4438662 ghcr.io/nenadzaric/skills-android-bundletool-validate:1.18.3
cd bundletool-validate/build-source
python3 test_native.py

⁠Java runtime source

The installed OpenJDK source package is openjdk-17 version 17.0.20.1+1-1~deb12u1. Its official Debian descriptor and all three SHA256-verified source payloads accompany this bundle under notices/openjdk-corresponding-source/. Runtime license is GPL-2.0 with Classpath exception, with component-specific notices preserved.

Official descriptor: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.dsc⁠

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1.orig-googletest.tar.xz⁠ (SHA256 94695f01012f939e8eeb51f839dd11323a57a6bb70dee8a34c7a7a1cddf00905).

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1.orig.tar.xz⁠ (SHA256 098e267645e5f5282a105097404945e877af6eae5b429bfbe914eb17157e8a90).

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.debian.tar.xz⁠ (SHA256 ef24b88b89854544c8f339afbec051c322f7268dcaec7a563f4201b0ceba7625).