[JarryShaw]

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• ci — workflows or build tooling

---

Description of your pull request and other information

#1967 step 2, item 4: the apt script, in Python per the ruling on #1967. Stacked on #2031, so review only the top commit. It is independent of #2032.

• util/apt_packages.py {plan,seed,install,collect} replaces the inline shell in the apt steps of engine-tests and pypcap-parity, and the KTLO twin picks it up through its alias. Every id, if:, continue-on-error, timeout-minutes, cache key and path is unchanged and pinned.
• The AppArmor step from fix(ci): let tshark read the checkout past Ubuntu 26.04's AppArmor profile (#2019) #2021 stays inline. actions/cache restore and save stay as they are.
• Timeouts still go through sudo timeout 60|180 apt-get … with no timeout option. Only a root timeout can kill apt's children, which the runner user cannot do. test_gnu_timeout_2020 now scans util/*.py as well.
• Plan and install both read APT_PACKAGES, so the cache key and the install cannot drift apart. The steps run on /usr/bin/python3, not the leg's interpreter.

The shape pin fails on #2031's unit-tests.yml (13 failed) and passes here. Parity tests run the old shell and the script against stand-in apt-get, sudo and timeout, and compare output, commands and files. The 58 test files that read unit-tests.yml or the docs give 1164 passed.

One pin was tightened: test_ktlo_legs_stay_green_1672's command scan now also sees annotations printed through say(.

[JarryShaw]

GOOD TO GO at e5019f3fa (Sonnet cross-review). plan, seed, install and collect match the removed shell flag for flag, including the retry, the mirror fallback, the pre-seed and the cache key's sha256 prefix. Four timeout-option mutations each fail the widened #2020 guard. Two caveats, neither blocking:

• Python sorts Inst lines by byte. The old sort used the locale, so the cache key differs only if the runner is not C.UTF-8.
• A failed KTLO checkout now fails the install step too, and only as a warning.

[JarryShaw]

Rebased onto #2031's new head as 5a7d0ffec. patch-id is identical to e5019f3fa, so the verdict holds. Still stacked on #2031.

[github-actions]

Coverage: 91.54% (unit tier, Python 3.15, 2924d3453, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	529	7	160	5	98.26%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

Ordering check on 5a7d0ffec, which contains #2031: python util/run_unittest_leg.py project on this tree gave Ran 1755 tests in 571s, OK (skipped=71), exit 0. KTLO failing test ids: 0 across every KTLO leg. Ready to merge after #2031.

[JarryShaw]

Rebased onto main cd4075e10 as 2924d3453. The tree is byte-identical to 5a7d0ffec and patch-id matches, so the verdict holds. No longer stacked.

[JarryShaw]

resolve conflicts

[JarryShaw]

Rebase only, no new changes: 2924d3453 → 51cfe7b21. This rebase has the workflows.rst table conflict with #2032 resolved by keeping both rows, and the paragraph keeping both edits. The code patch-id is identical (outside docs/), and the diffstat matches. The doc-reading tests on the rebased tree: 350 passed.

CI on the previous head 2924d3453: 58 checks green, 0 failing; the KTLO legs fail 0 tests. The GOOD TO GO verdict carries over. You can bypass checks and merge.

[JarryShaw]

Rebase only, no new code changes: 51cfe7b21 → e5a1fb9a7, moved onto main after #2033 merged.

The rebase conflicted in workflows.rst's scripts table, where #2033 added its own row. I kept both rows. The code patch-id is identical (outside docs/), and the diffstat matches. The doc-reading tests on the rebased tree: 313 passed.

CI on the previous head 51cfe7b21 was superseded with 52 checks green, 0 failing and 4 still running. The head before that, 2924d3453, carried the same code and was fully green, with 0 failing KTLO tests. The GOOD TO GO verdict carries over. You can bypass checks and merge.