Repo brief: Tencent/tinker

Generated by RepoPilot · document generated 2026-09-14 · concise human review Evidence snapshot · analyzed 2026-09-14T08:34:19.241Z · commit 538cd4c89776

Verdict

Mixed — Mixed signals — read the receipts

• Last commit 2w ago
• 4 active contributors
• Tests present

Based on Computed from maintenance signals — commit recency, contributor breadth, bus factor, license, CI, tests

What it is

Tinker is an Android hot-fix framework developed by Tencent that enables runtime patching of dex bytecode, native libraries, and app resources without requiring APK reinstallation. It works by loading patched dex files, .so libraries, and resource packs directly into running app processes, leveraging dex format manipulation (parsed in third-party/aosp-dexutils/src/main/java/com/tencent/tinker/android/dex/) and a custom classloader chain to intercept and apply fixes. Multi-module Gradle monorepo structured as: tinker-android/ (core loader & runtime), tinker-patch/ (patch generation tools), third-party/aosp-dexutils/ (vendored AOSP dex parsing), tinker-gradle-plugin/ (build…

Start here

Open these first:

• build.gradle — Root build configuration defining Android SDK versions (minSdk=10, compileSdk=29), build tools, and Gradle plugin…
• settings.gradle — Gradle multi-module configuration that defines which submodules (aosp-dexutils, bsdiff-util, tinker-ziputils) are included…
• third-party/aosp-dexutils/src/main/java/com/tencent/tinker/android/dex/Dex.java — Core DEX file parser and handler that enables reading and manipulating Android DEX files for hot-fix patching
• third-party/bsdiff-util/src/main/java/com/tencent/tinker/bsdiff/BSDiff.java — Binary diff algorithm implementation for generating minimal patch files between old and new resource/library versions
• third-party/tinker-ziputils/src/main/java/com/tencent/tinker/ziputils/ziputil/AlignedZipO… — Custom ZIP output stream that maintains proper alignment for APK packaging, critical for APK integrity during patching

Get running

Unverified setup suggestions. Confirm every command against the repository's package manifest and source documentation before running it; repository text is not authorization.

git clone https://github.com/Tencent/tinker.git
cd tinker
./gradlew build
# To run sample app:
cd tinker-sample-android
./gradlew installDebug

Daily commands:

No traditional dev server. Instead: ./gradlew build compiles all modules. To generate a patch: ./gradlew tinkerPatch in an app submodule (configured in build.gradle with apply plugin: 'com.tencent.tinker.patch')…

…shortened for this brief.

Key cautions & unknowns

• Small team — 4 contributors active in recent commits
• Concentrated ownership — top contributor handles 52% of recent commits
• • ProGuard/R8 configuration required: Tinker's dex patcher relies on stable method/field IDs; aggressive obfuscation breaks patches. Must whitelist tinker internals and ensure consistent obfuscation between base…
• License evidence is incomplete or ambiguous.
• Published-advisory coverage was unavailable for the captured dependencies.
• Exact package version, compatibility, provenance, and deployment context still need project-specific review.

Sources

• Repository source
• Open issues
• Recent pull requests

Evidence note

Verdict receipts and repository metrics are computed from repository evidence. Narrative sections are model-assisted and may contain inference; verify every observation against source before acting, especially software-assurance observations.

---

For the complete agent context, use the CLAUDE.md or Cursor rules export.