nenadzaric/skills-android-diffuse-apk-diff repository overview

⁠diffuse-apk-diff

Offline static Android fixture tool. This is a new integration validated on a self-owned synthetic fixture, not a claim about arbitrary app compatibility.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-diffuse-apk-diff@sha256:59260f2bf48802d3754f7782c8f9035672aa88c3676240695343e0bc48f290b8

Image index: sha256:f9e65e6d6f0b8f15362dd062b264067157b54ddbbcae288f2e6b6875a4a3caeb.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains diffuse-apk-diff/build-source/ (the Python adapter, Dockerfile, locked requirements where applicable, owned fixtures and native test harnesses) and diffuse-apk-diff/notices/ (primary texts and original installed/embedded dependency notices with exact hashes). It is the source for the custom entrypoint; native upstream alone does not contain this adapter. Git/recipe image relocation and subsequent delivery metadata do not change executable image bytes. Supplemental source/notice indexes are accompanying documentation, not claimed present in the already-built image.

oras pull docker.io/nenadzaric/skills-android-diffuse-apk-diff@sha256:14a7c9b68a4180fcbb007029a29acf319f3e64ecb742f9c713fa565600627b30
sha256sum diffuse-apk-diff-source-notices.tar.gz

Expected bundle SHA256: 7d543477d25e17e2023e5b1f14320fe20e6e81b3ba2860521f87e72c829e34f2. Extract this archive to read the source and notices/SOURCE-AND-NOTICES.json.

Pinned native upstream: https://github.com/JakeWharton/diffuse/tree/d1d4939038ca521ee650e1ddb1a7c8e396e5d2b7⁠

Pinned native source archive: https://codeload.github.com/JakeWharton/diffuse/tar.gz/d1d4939038ca521ee650e1ddb1a7c8e396e5d2b7⁠

Native upstream license: Apache-2.0. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new open-source license grant. Dependencies retain their own licenses/notices. This inventory is not an exhaustive SBOM or independently reproducible binary build.

⁠Included native sources

The artifact includes the pinned primary source archive plus applicable recursive source submodule archives, with path/commit/hash mappings in notices/SOURCE-AND-NOTICES.json. APKiD includes YARA Python/DEX sources and its real compiled rule file hash index. MobSFScan includes its source, libsast3.1.8 and Semgrep1.172.0 with recorded recursive submodule sources. No commercial APKiD license is used.

⁠Reproduce native fixture checks

After pulling the public image above and extracting the source bundle, assign a LOCAL alias matching the original build test harness. This does not push or require private registry access.

docker tag docker.io/nenadzaric/skills-android-diffuse-apk-diff@sha256:59260f2bf48802d3754f7782c8f9035672aa88c3676240695343e0bc48f290b8 ghcr.io/nenadzaric/skills-android-diffuse-apk-diff:0.3.0
cd diffuse-apk-diff/build-source
python3 test_native.py

⁠Java runtime source

The installed OpenJDK source package is openjdk-17 version 17.0.20.1+1-1~deb12u1. Its official Debian descriptor and all three SHA256-verified source payloads accompany this bundle under notices/openjdk-corresponding-source/. Runtime license is GPL-2.0 with Classpath exception, with component-specific notices preserved.

Official descriptor: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.dsc⁠

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1.orig-googletest.tar.xz⁠ (SHA256 94695f01012f939e8eeb51f839dd11323a57a6bb70dee8a34c7a7a1cddf00905).

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1.orig.tar.xz⁠ (SHA256 098e267645e5f5282a105097404945e877af6eae5b429bfbe914eb17157e8a90).

Source payload: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.debian.tar.xz⁠ (SHA256 ef24b88b89854544c8f339afbec051c322f7268dcaec7a563f4201b0ceba7625).