nenadzaric/skills-android-mobsfscan-source repository overview

⁠mobsfscan-source

Offline static Android fixture tool. This is a new integration validated on a self-owned synthetic fixture, not a claim about arbitrary app compatibility.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-mobsfscan-source@sha256:5ddc8cd9f5ae52196efed847007bece312aff2fcb8bd5ff2c7d8c33708e65fab

Image index: sha256:9b076b9f55f9d8f937521a306e3e774394fa13102c1f08b189eb1ce4b6ec8fcc.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains mobsfscan-source/build-source/ (the Python adapter, Dockerfile, locked requirements where applicable, owned fixtures and native test harnesses) and mobsfscan-source/notices/ (primary texts and original installed/embedded dependency notices with exact hashes). It is the source for the custom entrypoint; native upstream alone does not contain this adapter. Git/recipe image relocation and subsequent delivery metadata do not change executable image bytes. Supplemental source/notice indexes are accompanying documentation, not claimed present in the already-built image.

oras pull docker.io/nenadzaric/skills-android-mobsfscan-source@sha256:52aa7f925be76b920fe6db4ec965e1862e3827c780c4fad2a944a368a1060392
sha256sum mobsfscan-source-source-notices.tar.gz

Expected bundle SHA256: 7d3081a8effb395dceec111dc5f0710c9660799aae79b757cb44392f7367d70f. Extract this archive to read the source and notices/SOURCE-AND-NOTICES.json.

Pinned native upstream: https://github.com/MobSF/mobsfscan/tree/4645ea70bc093268502fe9f6df93e41bb482254a⁠

Pinned native source archive: https://codeload.github.com/MobSF/mobsfscan/tar.gz/4645ea70bc093268502fe9f6df93e41bb482254a⁠

Native upstream license: LGPL-3.0. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new open-source license grant. Dependencies retain their own licenses/notices. This inventory is not an exhaustive SBOM or independently reproducible binary build.

⁠Included native sources

The artifact includes the pinned primary source archive plus applicable recursive source submodule archives, with path/commit/hash mappings in notices/SOURCE-AND-NOTICES.json. APKiD includes YARA Python/DEX sources and its real compiled rule file hash index. MobSFScan includes its source, libsast3.1.8 and Semgrep1.172.0 with recorded recursive submodule sources. No commercial APKiD license is used.

⁠Reproduce native fixture checks

After pulling the public image above and extracting the source bundle, assign a LOCAL alias matching the original build test harness. This does not push or require private registry access.

docker tag docker.io/nenadzaric/skills-android-mobsfscan-source@sha256:5ddc8cd9f5ae52196efed847007bece312aff2fcb8bd5ff2c7d8c33708e65fab ghcr.io/nenadzaric/skills-android-mobsfscan-source:1.0.1-xmlfix1
cd mobsfscan-source/build-source
python3 test_native.py