Introducing Agents.·Read
OverviewAgentsWorkflowsExecutionDeveloper ToolsSecurityLibrary
Updated Oct 19, 2026

Utilities

Validate an Android App Bundle offline

bundletool-validate is an offline Android App Bundle validation adapter.

Agent
Check an assembled bundleRetain validation diagnosticsSeparate validation from installation

overview

What bundletool-validate does

Check a local AAB with bundletool before a separate packaging step. This job returns the native validation summary; it does not generate APK sets, sign an app or contact Google Play.

A file containing native bundletool validation text beginning with App Bundle information. This is native text, not an adapter-defined JSON report. Native validation failure fails the job.

The current adapter checks ZIP file size up to 20 MiB, entry count up to 2000 and a declared expanded total up to 64 MiB. It rejects repeated raw paths, absolute paths, parent traversal and symlink entries. Normalized path aliases and inconsistent archive metadata remain under targeted review. Native execution has a 90-second timeout; output-size checks occur after the native process finishes and do not establish peak memory or temporary-disk containment.

Packaged upstream version: 1.18.3. The native CLI is Apache-2.0; the custom first-party adapter has separate proprietary licensing. The source/notices download includes the adapter, recipe, applicable dependency locks, pinned upstream references and installed notices.

source github.com/google/bundletool/tree/586a43a450712a1067f3d92cf7574dee68226302

use cases

Where bundletool-validate fits

Check an assembled bundle

Validate an owned AAB before moving it into a separate release process.

Retain validation diagnostics

Keep the native text summary with the package being reviewed.

Separate validation from installation

Check the archive without connecting a device, selecting a signing key or uploading to a store.

reference

bundletool-validate inputs and flags

1 inputs
NameTypeFlagDescription
bundleFILE--bundleLocal AAB ZIP file: at most 20 MiB, 2000 entries and 64 MiB declared expanded. Must contain base/manifest/AndroidManifest.xml and BundleConfig.pb.

Showing key inputs. bundletool-validate exposes 1 inputs in total.

example

Run bundletool-validate

bundletool-validate · command
python3 /app/run.py --bundle ./owned-demo.aab ./output
sample output
App Bundle information
------------
Feature modules:
	Feature module: base
		File: dex/classes.dex

guidance

Choosing bundletool-validate

Choose this operation for AAB structural validation. Apktool and JADX inspect APK contents; they do not replace bundle validation. A passing result does not guarantee store acceptance or device compatibility.

faq

bundletool-validate questions

Local AAB ZIP file: at most 20 MiB, 2000 entries and 64 MiB expanded. Must contain base/manifest/AndroidManifest.xml and BundleConfig.pb.

A file containing native bundletool validation text beginning with App Bundle information. This is native text, not an adapter-defined JSON report. Native validation failure fails the job. The registered platform definition also exposes a FOLDER output; this adapter’s advertised result is the FILE. The accepted platform smoke downloaded the native FILE artifact as output.txt within the converted artifact folder.

The current adapter checks ZIP file size up to 20 MiB, entry count up to 2000 and a declared expanded total up to 64 MiB. It rejects repeated raw paths, absolute paths, parent traversal and symlink entries. Normalized path aliases and inconsistent archive metadata remain under targeted review. Native execution has a 90-second timeout; output-size checks occur after the native process finishes and do not establish peak memory or temporary-disk containment.

Choose this operation for AAB structural validation. Apktool and JADX inspect APK contents; they do not replace bundle validation. A passing result does not guarantee store acceptance or device compatibility.

Yes. The public Library entry uses the same ID as the accepted private fixture-tool-verifier run. Public image and source/notices downloads are verified. The sample comes from the owned platform fixture; it does not establish compatibility with every application.

The public image repository provides immutable image and ORAS download commands, an exact source/notices bundle checksum and pinned upstream source directions. The bundle retains the custom adapter, Dockerfile, applicable locks, installed notices and embedded Java notices where applicable. Java bundles also include the exact official Debian OpenJDK source descriptor and payloads. First-party adapter licensing is separate from upstream licensing. Follow the published local-tag alias instructions to reproduce the native fixture without a GHCR account. Image, source and license notice downloads.

related

More Utilities tools

  1. browser-fetch

    Headless Chromium render: requested URL, final URL, status, and title next to the page.

  2. cewl

    Spider a URL and return a wordlist for password crackers.

  3. csvkit

    SQL on one CSV. The table name is the file stem.

  4. dnsgen

    Wordlist and mined-word subdomain permutation.

  5. duckdb

    In-process SQL on CSV, JSON, and Parquet. No server.

  6. edge-tts

    Microsoft Edge neural speech from text or a script file. No API key.

Run bundletool-validate yourself

Complete native validation text downloaded from an actual private fixture-tool-verifier workflow. All three nodes succeeded and the downloaded native artifact matched the verifier and local native fixture hash. Separate local malformed-input tests produced native failure and adapter exit 2; invalid ZIP input was rejected before native parsing. The public Library entry retains the same tested tool ID.

Open bundletool-validate in the libraryBuild a workflow with it

Facts on this page come from the live Trickest tool library.