nenadzaric/skills-android-dex2jar-convert repository overview

⁠dex2jar-convert

Native JVM class JAR; reject missing/partial/exception output, not Java source.

Validated on self-owned inert fixtures, locally and through a bounded private fixture/tool/verifier workflow; no arbitrary app compatibility or execution claim.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-dex2jar-convert@sha256:78407a26e622d9c7cd5c98cc2c72972992e16bead1808a83e6a50856611cefd4

Image index: sha256:65c8e5d9f220db2b81fc489e6862cc877387ff33f2a417f49389a3058b15b2bb.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains dex2jar-convert/build-source/ (actual Python adapter, Dockerfile, owned fixture sources/native tests and verifier) and dex2jar-convert/notices/ (original installed/embedded notices, primary native sources, exact-version Maven source archives/POMs and copyright headers). The native upstream alone does not contain this custom entrypoint. Recipe/catalog registry references and subsequent delivery/status metadata do not alter executable image bytes; the bundle preserves its recorded source snapshot. Supplemental source/notices accompany the image and are not claimed present in the already-built runtime.

oras pull docker.io/nenadzaric/skills-android-dex2jar-convert@sha256:fd73d9fdcd72eb228304600f8655f110ae3d3fa7be527968a8cab7b0239007ee
sha256sum dex2jar-convert-source-notices.tar.gz

Expected bundle SHA256: 9d509e0d9fd408b274f6f16df0e97ce090db9845c78c5746dddcd3ec3d3b0ebb. Extract it and read dex2jar-convert/SOURCE-DELIVERY.txt and dex2jar-convert/notices/SOURCE-AND-NOTICES.json for exact source/hash mappings and qualifications.

Pinned native upstream: https://github.com/pxb1988/dex2jar/tree/b5bda4fb4935ae8b3869b422454ae3b3896c7bc1⁠

Primary native source archive: https://codeload.github.com/pxb1988/dex2jar/tar.gz/b5bda4fb4935ae8b3869b422454ae3b3896c7bc1⁠

Native license: Apache-2.0. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new license grant. Dependencies retain their own individual licenses/notices; this inventory is not an exhaustive SBOM or reproducible binary build claim.

⁠Conversion and component source

The adapter rejects absent native artifacts, native exception/partial-output diagnostics and malformed DEX headers/checksums; it does not claim all Android bytecode versions work. The bundled Glassfish JSON 1.0.4 primaryMaven JAR matches the shipped hash; its full pinned JSON-P source, exact-version sourceJAR and original CDDL/GPL v2 with Classpath exception legal text accompany this artifact unchanged. Other native dependency JAR hashes and notices are retained.

⁠Java runtime source

OpenJDK source package openjdk-17 version 17.0.20.1+1-1~deb12u1: official Debian descriptor and three SHA256-verified source payloads are retained under notices/openjdk-corresponding-source/. GPL-2.0 with Classpath exception and component-specific original notices are preserved.

Official descriptor: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.dsc⁠

⁠Reproduce owned native checks

After pulling the immutable public image and extracting the source archive:

cd dex2jar-convert/build-source
IMAGE=docker.io/nenadzaric/skills-android-dex2jar-convert@sha256:78407a26e622d9c7cd5c98cc2c72972992e16bead1808a83e6a50856611cefd4 python3 test_native.py

Results use a new temporary directory; APK/DEX/class artifacts are inspected statically and never installed or executed. Native output timestamps/source-file paths may vary; semantic reference and each run’s raw hashes are distinct. python3 verify_native.py ARTIFACT checks the native positive artifact without executing app code.