nenadzaric/skills-android-smali-assemble repository overview

⁠smali-assemble

Native assembled classes.dex, no app execution.

Validated on self-owned inert fixtures, locally and through a bounded private fixture/tool/verifier workflow; no arbitrary app compatibility or execution claim.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-smali-assemble@sha256:55b10d0817a7797461e524215e4ea2901a364ecbf63d790f59d26df145c0935a

Image index: sha256:1863f6a1d389813982278cffdf2f22b735955ab32d79da50f5137157bbe69e4b.

⁠Actual adapter source and notices

The accompanying immutable OCI artifact contains smali-assemble/build-source/ (actual Python adapter, Dockerfile, owned fixture sources/native tests and verifier) and smali-assemble/notices/ (original installed/embedded notices, primary native sources, exact-version Maven source archives/POMs and copyright headers). The native upstream alone does not contain this custom entrypoint. Recipe/catalog registry references and subsequent delivery/status metadata do not alter executable image bytes; the bundle preserves its recorded source snapshot. Supplemental source/notices accompany the image and are not claimed present in the already-built runtime.

oras pull docker.io/nenadzaric/skills-android-smali-assemble@sha256:f5587bb17fc7f20507038ee4e79e1b694ae4415ede8abd5d866a941b2074651c
sha256sum smali-assemble-source-notices.tar.gz

Expected bundle SHA256: 729035b5c99feff1f8b1b1cba3e225ce313241497d2f7f49123ea21029bda58a. Extract it and read smali-assemble/SOURCE-DELIVERY.txt and smali-assemble/notices/SOURCE-AND-NOTICES.json for exact source/hash mappings and qualifications.

Pinned native upstream: https://github.com/google/smali/tree/878d37fe960945e1b2eec430f1649d43910a4fd0⁠

Primary native source archive: https://codeload.github.com/google/smali/tar.gz/878d37fe960945e1b2eec430f1649d43910a4fd0⁠

Native license: BSD-3-Clause plus Apache-2.0 components. First-party adapter/packaging follows the existing workflows Proprietary policy; this delivery makes no new license grant. Dependencies retain their own individual licenses/notices; this inventory is not an exhaustive SBOM or reproducible binary build claim.

⁠Source-built Google CLI

The pinned maintained Google 3.0.7 source build reports 3.0.7-dev; these are not official Maven/release binaries. The unchanged pinned ANTLR grammar is relocated into Gradle’s default source path. Observed/public build recipes, compiled JAR hashes, resolved runtime artifact hashes and original source/notice payloads are retained. No bit-reproducible JAR claim.

⁠Java runtime source

OpenJDK source package openjdk-17 version 17.0.20.1+1-1~deb12u1: official Debian descriptor and three SHA256-verified source payloads are retained under notices/openjdk-corresponding-source/. GPL-2.0 with Classpath exception and component-specific original notices are preserved.

Official descriptor: https://security.debian.org/debian-security/pool/updates/main/o/openjdk-17/openjdk-17_17.0.20.1+1-1~deb12u1.dsc⁠

⁠Reproduce owned native checks

After pulling the immutable public image and extracting the source archive:

cd smali-assemble/build-source
IMAGE=docker.io/nenadzaric/skills-android-smali-assemble@sha256:55b10d0817a7797461e524215e4ea2901a364ecbf63d790f59d26df145c0935a python3 test_native.py

Results use a new temporary directory; APK/DEX/class artifacts are inspected statically and never installed or executed. Native output timestamps/source-file paths may vary; semantic reference and each run’s raw hashes are distinct. python3 verify_native.py ARTIFACT checks the native positive artifact without executing app code.