nenadzaric/skills-intel-tshark-json repository overview

⁠tshark-json

Decode a bounded prefix of a saved PCAP/PCAPNG into native TShark packet JSON, without live capture.

Native Debian TShark4.0.17-0+deb12u3, fixed tshark -n -r input -c count -T json in isolated config. Input --input FILE, optional --packet-count1..10000(default1000), positional output path (no -o). Input100MiB, subprocess60s and adapter resource/output limits. No live capture/name resolution; dumpcap removed and user Lua startup restricted by build recipe. Prefix decoding is not an assertion that the whole capture was processed. Saved actual fixture has one synthetic UDP packet192.0.2.10:54321 to198.51.100.20:45678; no Android/DNS/HTTP interpretation is claimed.

⁠Immutable image

docker pull --platform linux/amd64 docker.io/nenadzaric/skills-intel-tshark-json@sha256:b34ed8912d2961cee883cec8aa3f75fa21bab3981469b2fb11d031f00a6b4a62

Tested image index: sha256:6dc158d9005f30324e4c19fb3a763c4247fb98f6635a28ea6b9ecd69ce7eecd5. All runtime config/layers unchanged from the existing private image and saved successful fixture/tool/verifier workflow.

⁠Actual adapter source and original notices

The immutable source artifact includes tshark-json/build-source/ with actual adapter/Dockerfile/fixtures/tests and catalog snapshot, original installed docs/common-license texts, exact Debian corresponding source/patches/descriptors and saved native/verifier output bytes. Exact Wireshark4.0.17 upstream source and Debian deb12u3 patch archive/descriptor, and applicable installed Debian source versions supplied. Current Debian tracker lists this bookworm package with open rows; many descriptions name only newer4.4/4.6 ranges, so exact4.0 applicability is unresolved. This distribution is NOT a security clearance or a claim that listed CVEs are confirmed exploitable here. Read build-source/notices/SECURITY-PROVENANCE.json. Saved UDP fixture is functional evidence, not vulnerability coverage. No silent version upgrade.

oras pull docker.io/nenadzaric/skills-intel-tshark-json@sha256:fcfc88c182781dccc33e24cfec39327530d72aa261cd7c1d627ddf0cf4c23766
sha256sum tshark-json-source-notices.tar.gz

Expected bundle SHA256: ff50644309bc6bc07ad297f94b05b26e7ba1f075bb8fa0928f6d53a6e3df2dca. Read tshark-json/SOURCE-DELIVERY.txt, tshark-json/notices/SOURCE-AND-NOTICES.json and tshark-json/notices/COMPONENT-SOURCE-INDEX.json. Bundled build-source is the frozen pre-public-reference snapshot; later README/YAML/catalog metadata changes do not change runtime bytes.

⁠Verification and limits

Existing private workflow 39eaccde-e7af-447e-b6a8-d46ee051f98b run b4b6624d-abdc-499d-aafc-893305b7f877 passed fixture/tool/verifier with max1machine. Exact native and verifier bytes were re-downloaded/rehashed without a new run. Runtime adapter bytes extracted from stopped containers match source; no image rebuild, registration, provider call or new execution is claimed. Existing resource caps are adapter limits, not comprehensive peak containment or a security sandbox guarantee.

⁠License scope

GPL-2.0-or-later native Wireshark and original per-component/runtime terms are retained. Existing workflows first-party Proprietary adapter policy is separate; no new grant/relicense. Original installed notices and corresponding-source delivery accompany the immutable image. Archive payload SHA256 checks against primary HTTPS descriptors/installed SBOMs are verified; original Debian signatures are preserved but not independently validated against maintainer keys. No exhaustive binary-composition/SBOM or bit-reproducible build claim. Public image/source distribution is distinct from public Trickest tool/page acceptance.