[tools] Replace APK utilities with skill file apps by simonrozsival · Pull Request #12108 · dotnet/android

simonrozsival · 2026-07-14T20:28:47Z

Summary

replace the standalone assembly-store reader and decompressor executable projects with .NET file-based apps owned by repository skills
expand read-assembly-store to invoke its bundled app directly
add an extract-android-assemblies skill for customer APK/AAB investigation and decompilation preparation
remove the obsolete legacy reader project, launch wrappers, and solution entries while retaining the shared compatibility parser
build both file apps in CI

Stack

This PR is stacked on #12104, which provides the shared v1/v2/v3 and LZ4/Zstd compatibility layer. Review this PR as the single commit on top of that branch. It can be retargeted to main after #12104 merges.

File apps

dotnet run --file .github/skills/read-assembly-store/scripts/read-assembly-store.cs -- <input>

dotnet run --file .github/skills/extract-android-assemblies/scripts/extract-android-assemblies.cs -- --output <directory> <input>

The extractor handles:

APK, AAB, raw store, manifest, store base-name, and DLL inputs
legacy and current assembly stores
raw, ELF payload, and _assembly_store wrappers
historical and current individually packaged assemblies
LZ4 and Zstd compression
multiple ABIs and satellite assemblies

Customer inputs remain local. Extraction rejects path traversal, output-name collisions, and overwrites.

Validation

both skills pass skill-creator validation and package successfully
both file apps build and run through their CI commands
shared parser builds for .NET 10 and .NET 11
10 assembly-store compatibility tests pass
byte-for-byte extraction exercised for:
- current store APKs
- standalone stores
- ELF-wrapped individual assemblies
- current and historical satellite names
- modern loose individual assemblies

Copilot

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

Copilot

Pull request overview

Copilot reviewed 18 out of 18 changed files in this pull request and generated 2 comments.

jonathanpeppers · 2026-07-14T21:09:18Z

/review

github-actions · 2026-07-14T21:10:05Z

✅ Android PR Reviewer completed successfully!

github-actions

Code Review — ⚠️ Needs minor changes

Reviewed the top commit ([tools] Replace APK utilities with skill file apps) on top of the stacked base #12104. The refactor cleanly consolidates the standalone reader/decompressor executables into two skill-owned dotnet run --file apps plus a shared AssemblyStorePayload helper, and wires both apps into Windows CI via --help smoke runs. The path-traversal guard (GetSafeOutputFile), overwrite refusal, and unique-output checks are good defensive touches.

Findings

⚠️ 2 error-handling issues (inline): InvalidDataException from the path-traversal guard is not in Main’s catch list in the extractor, and ParseArchList throws an uncaught InvalidOperationException on bad --arch input in the reader. Both surface as stack traces instead of clean messages.
💡 1 cleanup: empty unused ShowHelp () in the reader.

None are blockers, but the two error-handling items are worth addressing so malformed input/malicious archives fail gracefully.

Notes

CI status is currently pending (checks not yet reported) — verify the two new file-app build steps go green before merge.
Reviewed as the single commit atop #12104 per the PR description; retarget to main once #12104 lands.

Automated review; verify suggestions against full context.

Generated by Android PR Reviewer for #12108 · 106.2 AIC · ⌖ 18.8 AIC · ⊞ 6.8K
_{Comment /review to run again}

jonathanpeppers

Otherwise this looks good. 👍

Move assembly-store inspection and managed assembly extraction into skill-owned .NET file-based apps. Remove the redundant executable projects and launch wrappers while keeping the shared compatibility parser and exercising both apps in CI. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 55493571-86e2-4326-850e-ea55883aa5d8

Report invalid architecture filters and path traversal errors without stack traces, remove dead reader code, and correct the extractor usage text. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 55493571-86e2-4326-850e-ea55883aa5d8

Relocate the shared parser and compatibility tests under the read-assembly-store skill, update all source and project consumers, and remove the obsolete assembly-store-reader-mk2 directory. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c81166b-f589-4e13-87d3-942acf3c9df2

jonathanpeppers · 2026-07-22T15:40:43Z

/review

github-actions · 2026-07-22T15:41:26Z

✅ Android PR Reviewer completed successfully!

github-actions

🤖 Android PR Review — ⚠️ Minor suggestions (no blocking issues)

Reviewed as the single commit stacked on #12104: replacing the tools/assembly-store-reader* / decompress-assemblies executables with two dotnet run --file skill apps and moving the shared AssemblyStore parser + tests under .github/skills/read-assembly-store/.

Verdict

No bugs or correctness issues found. This is a clean, well-executed refactor. Two 💡 non-blocking suggestions posted inline.

Positive callouts

Path-traversal defense is solid. GetSafeOutputFile normalizes with Path.GetFullPath + Path.GetRelativePath and rejects rooted / ..-escaping paths, and writes use FileMode.CreateNew to refuse overwrites — good defense-in-depth for untrusted customer packages. HaveUniqueOutputs also prevents output-name collisions up front.
Improved arch parsing. TryParseArchList now validates against the supported set and returns a graceful error instead of the old ParseArchList throwing an uncaught InvalidOperationException.
New AssemblyStorePayload.TryExtractELFPayload validates stream capabilities, guards offset/size > Int64.MaxValue, pools its copy buffer via ArrayPool, and restores stream position on the not-ELF path.
Relative #:project paths verified correct for both file apps, and CI now smoke-builds both via dotnet run --file ... -- --help.

CI

Status is currently pending / no checks reported for 197d0cb. Not mergeable until the dotnet-android pipeline reports green — please confirm the two new "Build ... file app" steps and AssemblyStore.Tests pass.

Notes

This PR is stacked on #12104 and should be retargeted to main after that merges, per the description.

Prioritized: bugs > safety > performance > tests > duplication > consistency > docs. Suggestions are optional.

Generated by Android PR Reviewer for #12108 · 148.4 AIC · ⌖ 18.8 AIC · ⊞ 6.8K
_{Comment /review to run again}

* ci: repoint watch-upstream to relocated AssemblyStore reader dotnet/android#12108 (commit f1aecf9) deleted tools/assembly-store-reader-mk2/ and moved the AssemblyStore parser we vendor in src/Sentry.Android.AssemblyReader/ to .github/skills/read-assembly-store/src/AssemblyStore/. Our watch matrix still tracked the old path, which will never receive another commit, so we would silently stop being alerted to upstream changes. Point the watcher at the new location. #skip-changelog Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> * Tweak comments --------- Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Copilot AI review requested due to automatic review settings July 14, 2026 20:28

simonrozsival requested a review from jonathanpeppers as a code owner July 14, 2026 20:28

Copilot AI reviewed Jul 14, 2026

jonathanpeppers requested a review from Copilot July 14, 2026 20:33

Copilot started reviewing on behalf of jonathanpeppers July 14, 2026 20:34

View session

Copilot AI reviewed Jul 14, 2026

View reviewed changes

Comment thread .github/skills/read-assembly-store/scripts/read-assembly-store.cs Outdated

Comment thread .github/skills/extract-android-assemblies/scripts/extract-android-assemblies.cs Outdated

github-actions Bot reviewed Jul 14, 2026

View reviewed changes

Comment thread .github/skills/extract-android-assemblies/scripts/extract-android-assemblies.cs

Comment thread .github/skills/read-assembly-store/scripts/read-assembly-store.cs Outdated

Comment thread .github/skills/read-assembly-store/scripts/read-assembly-store.cs Outdated

jonathanpeppers reviewed Jul 15, 2026

View reviewed changes

Comment thread .github/skills/read-assembly-store/src/AssemblyStore/AssemblyStorePayload.cs

Base automatically changed from dev/simonrozsival/update-assembly-store-tools to main July 20, 2026 19:51

simonrozsival and others added 3 commits July 20, 2026 15:57

jonathanpeppers force-pushed the dev/simonrozsival/android-tool-file-apps branch from 75188b8 to 197d0cb Compare July 20, 2026 20:59

github-actions Bot reviewed Jul 22, 2026

View reviewed changes

Comment thread .github/skills/read-assembly-store/scripts/read-assembly-store.cs

Comment thread .github/skills/extract-android-assemblies/scripts/extract-android-assemblies.cs

jonathanpeppers added the ready-to-review This PR is ready to review/merge, I think any CI failures are just flaky (ignorable). label Jul 22, 2026

jonathanpeppers approved these changes Jul 22, 2026

View reviewed changes

jonathanpeppers enabled auto-merge (squash) July 22, 2026 18:49

rolfbjarne approved these changes Jul 23, 2026

View reviewed changes

jonathanpeppers merged commit f1aecf9 into main Jul 23, 2026
45 checks passed

jonathanpeppers deleted the dev/simonrozsival/android-tool-file-apps branch July 23, 2026 10:48

This was referenced Jul 28, 2026

ci: repoint watch-upstream to relocated AssemblyStore reader getsentry/sentry-dotnet#5453

Merged

Port upstream AssemblyStore reader changes: v4/CoreCLR format, _assembly_store symbol, index-entry sizing (next major) getsentry/sentry-dotnet#5454

Closed

github-actions Bot locked and limited conversation to collaborators Aug 23, 2026

Conversation

simonrozsival commented Jul 14, 2026

Summary

Stack

File apps

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Uh oh!

Uh oh!

Uh oh!

jonathanpeppers commented Jul 14, 2026

Uh oh!

github-actions Bot commented Jul 14, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

Code Review — ⚠️ Needs minor changes

Findings

Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

jonathanpeppers left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

jonathanpeppers commented Jul 22, 2026

Uh oh!

github-actions Bot commented Jul 22, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

github-actions Bot left a comment

Choose a reason for hiding this comment

🤖 Android PR Review — ⚠️ Minor suggestions (no blocking issues)

Verdict

Positive callouts

CI

Notes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Jul 14, 2026 •

edited

Loading

github-actions Bot commented Jul 22, 2026 •

edited

Loading