nenadzaric/skills-android-zipalign-check repository overview

⁠zipalign-check

Check supplied APK ZIP entry alignment: stored entries4bytes and .so-named entries16KiB, without rewriting.

Unmodified AOSP zipalign core at android-16.0.0_r1 commit874fa586c48ae230ebfcff0df1b9c1b004fa8f7c, source-built with pinned Debian Android34.0.5 libraries and Clang. Not an official SDK37 binary/equivalence claim. Linux amd64 tested. Check-only native -c -P16 -v4; ZIP offsets do not prove ELF segment alignment, signature integrity, installability or device/runtime compatibility. No signing keys, APK rewriting, devices, entry execution or runtime network calls.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-android-zipalign-check@sha256:a5e7060a7dc88068943ca7b8fbc0cdd6d8677c167feef593174b29acea64b096

Image index: sha256:c6d9fafb19cce7bc02a6fd2e6328514498bf185c2caec3118189af9a83f6a86a.

⁠Actual adapter source and original notices

The immutable companion artifact contains zipalign-check/build-source/ with the actual adapter, Dockerfile, source lock, owned inert ZIP fixtures, tests/verifier and safe platform graph. Native upstream alone does not contain the entrypoint. Native core7files and exact pinned Git blob bindings: build-source/vendor/aosp/. Original Debian dependency source archives/patches/descriptors: notices/debian-corresponding-source/, covering Androidplatformtools/zopfli/zlib/7zip/glibc at actual installed source versions. Original96installed image notices: notices/installed-image/. Actual16runtimefilehashes and installed package/sourceversion maps retained under notices/.

oras pull docker.io/nenadzaric/skills-android-zipalign-check@sha256:b6f7a5575b0d0510c0a7ba58383485a64f19d2a3f2c36ce8679c90a13e70448f
sha256sum zipalign-check-source-notices.tar.gz

Expected bundle SHA256: 7ae5cb8a603db4491cb8bdda582f280029d81764325001a35f9835f8ea90574d. Read zipalign-check/SOURCE-DELIVERY.txt and zipalign-check/notices/SOURCE-AND-NOTICES.json. Later source/catalog delivery metadata may change without runtime changes; recorded bundled build-source is preserved.

Pinned native source: https://android.googlesource.com/platform/build/+/874fa586c48ae230ebfcff0df1b9c1b004fa8f7c/tools/zipalign/⁠

⁠Verification and limits

Nine final-image local cases passed: aligned16KiB fixture, Hive output.txt input, empty output, only4byte aligned .so, unaligned .so, malformed ZIP, missing input, oversized input and existing-output preservation. The three positive paths return0; negative paths adapter2 with no successful artifact overwrite. Actual bounded private fixture/tool/verifier workflow passed3nodes/max1machine. Downloaded fixture/report/verifier hashes and unchanged completion registry bound; report confirms AndroidManifest.xml offset56 and libowned.so offset16384. Native report task-local path varies: each actual reportSHA is recorded, not claimed cross-hostrawidentity.

Owned fixtures are APK-like ZIPs with inert NON-ELF .so-named data and a text manifest. They prove native ZIP alignment behavior only, not valid Android apps or ELF/runtime compatibility. Wrapper20MiB/5000entries/64MiB declared expansion; duplicates/raw unsafe names/symlinks/encrypted entries rejected, manifest member required. Declared ZIP metadata checking is not exhaustive alias validation or peak containment. Native60s deadline/4MiB post-run logs/report cap are not total-process or peak disk limits. Native nonzero includes bounded diagnostics and returns adapter2. Successful report must end Verification successful. Existing nonempty output preserved.

⁠Reproduce owned checks

cd zipalign-check/build-source
IMAGE=docker.io/nenadzaric/skills-android-zipalign-check@sha256:a5e7060a7dc88068943ca7b8fbc0cdd6d8677c167feef593174b29acea64b096 python3 test_native.py

Network-none containers over owned inert ZIP fixtures; no private keys or app code executed.

⁠License scope

Apache-2.0 native core and original Debian Android/zopfli/zlib/7zip/runtime component terms retained. Existing workflows Proprietary adapter policy remains separate; no new grant/relicense. Original installed notices and exact five component source/patch/descriptor groups supplied, payloadSHA256 verified against descriptors. Core source unchanged. First Bookworm library probe had a normal API mismatch; newer pinned Debian headers/Clang compiled without native patches. No SDKbinary download/license acceptance, bitreproducible build or exhaustive image SBOM claim.