Add testbed for Android Package Kit OSV-Scalibr Extractor plugin#211
Open
0xXA wants to merge 1 commit into
Open
Add testbed for Android Package Kit OSV-Scalibr Extractor plugin#2110xXA wants to merge 1 commit into
0xXA wants to merge 1 commit into
Conversation
Related Issue: google/osv-scalibr#1968 Related PR: google/osv-scalibr#2158
0xXA
added a commit
to 0xXA/osv-scalibr
that referenced
this pull request
May 28, 2026
Closes: google#1968 Testbed: google/security-testbeds#211
0xXA
added a commit
to 0xXA/osv-scalibr
that referenced
this pull request
Jul 22, 2026
Closes: google#1968 Testbed: google/security-testbeds#211
0xXA
added a commit
to 0xXA/osv-scalibr
that referenced
this pull request
Jul 22, 2026
This PR adds an Android Package Kit (APK) extractor that identifies third-party Android dependencies embedded inside APK files by analyzing the application's `AndroidManifest.xml`. The extractor parses the binary `AndroidManifest.xml` included in APK files using `androidbinary`. Since Android manifests are stored in a binary XML format, the extractor first decodes the binary XML and resolves resource references using `resources.arsc` when available. The parser extracts the following information: * Application package name * `<attribution>` tags that identify bundled libraries * Metadata entries associated with the application and its components The extractor collects metadata from: * Application-level `<meta-data>` entries * Activities * Activity aliases * Services * Content providers This allows the extractor to resolve dependency versions that are declared through Android metadata. Android libraries commonly expose dependency information through `<attribution>` tags. The extractor processes these tags and converts them into Maven package coordinates. For each attribution entry: 1. The extractor resolves the dependency version by searching metadata entries associated with the attribution tag. 2. Version values are normalized to improve compatibility with vulnerability databases. * Human-readable versions (for example, `26.12.33`) are preserved. * Long numeric build versions are converted into a readable format where possible (for example, `261233000` → `26.12.33`). 3. The Maven Group ID and Artifact ID are derived from the attribution tag and application package name. 4. Known Android ecosystem mappings are applied for dependencies whose artifact names do not directly match Maven artifact IDs. Examples of handled mappings include: * Google Play Services (`com.google.android.gms`) * Firebase (`com.google.firebase`) * AndroidX (`androidx`) * Android Support libraries (`com.android.support`) * Kotlin libraries (`org.jetbrains.kotlin`) After extracting dependency information, the extractor creates `extractor.Package` objects using Maven PURLs. Each generated package contains: * Dependency name (original attribution tag) * Version * Maven package type * APK file location * Metadata containing: * Maven Group ID * Maven Artifact ID Closes: google#1968 Testbed: google/security-testbeds#211
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Related Issue: google/osv-scalibr#1968
Related PR: google/osv-scalibr#2158