[JarryShaw]

Please follow the guide below

• Searched for similar pull requests
• Followed the coding style (make pylint, make mypy, make isort)
• make test passes, and a test case covers the change
• Added a changelog entry — N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

• fix — corrects a defect

---

Description of your pull request and other information

Closes #2020. On Ubuntu 26.04 timeout is uutils 0.10.0, whose --kill-after SIGKILLs at once and only its child. Run unit tests (experimental.yml) now runs gnutimeout (GNU 9.7) where it exists, timeout otherwise.

• In docker run ubuntu:26.04, the old step fails test_a_timeout_exits_124, test_the_timeout_ends_the_run_in_progress_and_starts_no_other (137 != 124) and test_a_tests_step_killed_after_the_timeout_records_137_and_its_time (elapsed 5). The new step passes all three. With uutils, a grandchild that ignores SIGINT outlives the kill; with GNU it does not.
• New tests/project/test_gnu_timeout_2020.py fails any workflow run: script that passes an option to a bare timeout. Against main's step it gives 4 failed; with this change, 6 pass.
• Plain timeout 60 apt-get … in unit-tests.yml stays as it is: both builds exit 124 and end the child's children there. Those are CI: tshark can't read captures on Ubuntu 26.04 runners (AppArmor profile) #2019's steps.
• Narrow host run (ci(python): the GraalPy experimental leg loses its runner 18–25 minutes into its tests on every recent run #1740/ci(experimental): skip or stop superseded runs instead of cancelling them, so commits are not marked red #1938/test: sort the remaining GraalPy-only failures into defects and gates #1963/CI: uutils timeout on Ubuntu 26.04 runners breaks --kill-after grace (main red) #2020 modules): 87 passed. shellcheck is clean on the step.

[JarryShaw]

GOOD TO GO at 85ba99c20.

A Sonnet cross-review confirmed:

• Coverage: no other timeout with options exists in .github/ or util/, and the new test scans every workflow run: script.
• Fallback: under bash -euo pipefail, command -v gnutimeout || command -v timeout resolves to /usr/bin/timeout on 24.04 and to /usr/bin/gnutimeout on 26.04, and exits 0 on both.
• Behaviour (in ubuntu:26.04): uutils gives 137 after 1 s, and gnutimeout gives 124. A plain sudo timeout 60 apt-get behaves the same under both.
• Tests: with main's step, the new test fails 4. On the head, the four modules give 87 passed. fix(ci): let tshark read the checkout past Ubuntu 26.04's AppArmor profile (#2019) #2021 adds no timeout.

One residual risk: the runner-images 26.04 readme does not list gnutimeout. If the runner image lacks it, the step falls back to uutils and the 137 failure returns. This PR's own Project tests job, once it lands on 26.04, will show which.

[JarryShaw]

Verified on a real Ubuntu 26.04 runner: this head's Project tests job ran on ubuntu-26.04 and passed, so gnutimeout is on the runner image and the three timeout tests pass there. That closes the residual risk.

The two red checks, Engines (PyShark) and parity 3.11, are #2019's AppArmor denial; their logs show "permission to read the file" on 26.04. That one is fixed by #2021. Each PR fixes the other's red check, so merging both turns main green on 26.04.

[github-actions]

Coverage: 91.55% (unit tier, Python 3.15, 061752cf1, Unit Tests run success)

Package	Statements	Missed	Branches	Partial	Cover
pcapkit (top level)	104	4	20	2	95.16%
pcapkit/const	19597	881	2618	867	92.11%
pcapkit/corekit	2567	71	816	37	96.57%
pcapkit/dumpkit	282	3	102	3	98.44%
pcapkit/foundation	2930	23	1022	25	98.79%
pcapkit/interface	138	4	52	3	96.32%
pcapkit/protocols	17436	219	4582	185	98.15%
pcapkit/toolkit	872	36	298	10	95.21%
pcapkit/utilities	523	2	158	4	99.12%
pcapkit/vendor	4431	1995	1018	167	51.73%

Per-file detail: the coverage-html artifact of this run.

[JarryShaw]

On PRs the "Plain unittest ordering" job is skipped, since it runs only on main. So I ran its project leg myself, the same way CI does (python util/run_unittest_leg.py project), on main d419d8c39 with #2021 and #2022 both merged in. Result: Ran 1675 tests ... OK (skipped=71). Both PRs' new modules ran and passed: test_tshark_apparmor_2019 and test_gnu_timeout_2020.

This host has GNU timeout. The uutils behaviour on 26.04 is covered instead by #2022's own Project tests job, which passed on a real ubuntu-26.04 runner.

[JarryShaw]

This PR is now stacked on #2021, at head 72f84e5de = #2021's ebe8a06cd + this fix. On their own, each PR fails on the other's Ubuntu 26.04 bug: #2021 on the uutils timeout tests, and this one on the tshark AppArmor denial. With both in one tree, CI here can go fully green on a 26.04 runner. Merge #2021 first; this PR's diff then reduces to its own commit. On the stacked tree, the timeout/AppArmor pins plus test_unit_tests_queue give 135 passed. The review label is back to review: pending until CI and a re-review land on the new head.

[JarryShaw]

GOOD TO GO at 72f84e5de. The verdict carries over from the two reviewed heads:

• git patch-id --stable of 72f84e5de matches 85ba99c20 (76efafa10…), so this fix's patch is unchanged.
• The commit under it is fix(ci): let tshark read the checkout past Ubuntu 26.04's AppArmor profile (#2019) #2021's reviewed ebe8a06cd, unchanged.

The stacked tree passes the shared pins (135 passed). CI on this head is the check of both fixes together.