Dev/test setup: sample capture generators, portable Makefile

[JarryShaw]

Draft, accumulating — further commits will land on this branch as each subtask finishes.

Why

A fresh clone cannot run the whole test suite. The runtime, regression and integration suites read eleven captures out of sample/, and .gitignore keeps them out of the repository, so those 28 tests fail locally and CI has to --ignore them. This branch reconstructs the fixtures from source instead, so pytest with no ignore flags passes on any machine.

What changed

util/make_samples.py (plus util/samples_pcap.py, util/samples_pcapng.py) — regenerates every fixture; also wired as make samples.

• .pcap fixtures (arp, ipv4, ipv6, tcp, stream, http) are built with scapy from the traffic each test pins. Checksums are computed by scapy from the finished packets, sequence/acknowledgement continuity holds across all 114 connections, and regeneration is byte-identical.
• .pcapng fixtures are either downloaded from Wireshark's test/captures with the source URL and SHA-256 pinned in the script (dhcp_big_endian.pcapng, many_interfaces.pcapng), or synthesised block by block (dhcp_little_endian.pcapng, test.pcapng, profile.pcapng). A digest mismatch is a hard error; losing the network degrades to a synthesised stand-in and says so. Nothing downloaded is redistributed — sample/ stays gitignored.

Makefile — could not run outside a Homebrew macOS box: SHELL was hardcoded to /opt/homebrew/bin/bash, so every target died with Command not found on Linux. bash now comes from PATH and the libxml2/libxslt prefixes from brew --prefix, leaving macOS behaviour unchanged. Added samples, test (the CI-equivalent selection), test-all and coverage; fixed isort (referenced an untracked temp/sort.py) and vermin (wrote into a missing temp/, and hard-required VS Code).

README.rst — a Testing section covering the three commands and why CI runs the narrower selection.

Test result

pytest -q → 334 passed, 70 subtests passed (was 28 failed, 309 passed). make test (CI selection) → 284 passed.

Defects found on the way, not fixed here

Building the pcapng fixtures surfaced parser bugs, all documented in util/samples_pcapng.py and left for their own change:

• pcapkit/protocols/schema/misc/pcapng.py:1591 — Custom Block padding is (4 - pkt['data'] % 4) % 4 on bytes; every custom block raises TypeError.
• Same file :1335 — ISB options sized length - 20, but the fixed prefix is 24 bytes. Fires on Wireshark's own many_interfaces.pcapng.
• :1102 / :1177 — NRB IPv6 records sized as if the address were 4 bytes, and NRB options over-run when ns_* options are present.
• :1657/:1659 — obsolete Packet Block declares interface_id/drop_count as 32-bit; the spec makes both 16-bit, and the options arithmetic assumes the 16-bit layout, so neither parses.
• pcapkit/corekit/fields/ipaddress.py — if_IPv6addr parses the prefix-length octet as an ASCII decimal string; /64 raises, /56 silently decodes as /8.
• pcapkit/foundation/engines/pcapng.py:218 — rejects a Simple Packet Block in any section with more than one interface. Per spec §4.4 that is legal; the check should be for zero interfaces.
• pcapkit/protocols/internet/ipv6.py:342 — the extension-header loop breaks before advancing past the last header, so a fragmented datagram hands the fragment header to the next layer as if it were the UDP header. tests/protocols/internet/test_ipv6_extension_runtime.py currently pins this behaviour.