[JarryShaw]

Please follow the guide below

• You will be asked some questions, please read them carefully and answer honestly

• Put an x into all the boxes [ ] relevant to your pull request (like that [x])

• Use Preview tab to see how your pull request will actually look like

• Searched for similar pull requests

• Followed the coding style (make pylint, make mypy, make isort)

• make test passes, and a test case covers the change. Narrow runs only, listed below.

• Added a changelog entry under docs/source/changelog/ and regenerated CHANGELOG.md, if the change is user-visible: N/A — centralised in docs(changelog): shared 1.5.0 changelog — long-lived, merges last (#610, #616, #617, #618, #620) #657

What is the purpose of your pull request?

Tick the commit type your subject line carries.

• fix — corrects a defect
• feat — adds a feature
• perf — changes performance, not behaviour
• refactor — changes neither behaviour nor performance
• test — tests only
• docs — documentation only
• ci — workflows or build tooling
• release — bumps the version or rolls up a distribution
• chore — anything else

---

Description

Closes #1814. The conda package's vendored dependencies (pcapkit/_extern) reached the wheel as .py files only, so the package was broken. In an emulated build, chardet could not detect anything (models/idf.bin missing), lxml.etree and pyshark failed to import, emoji had no JSON, scapy misreported its version, and certifi.where() pointed at a missing file.

• Ship everything: package-data now includes every file under pcapkit._extern except bytecode. MANIFEST.in cannot do this without warning in non-conda builds (measured). Clean sdist and wheel builds are unchanged apart from the files this PR adds or removes, with no new warnings. The ** glob needs setuptools 62.3: measured, 61.0 and 62.2 read it as *. The build floor in pyproject.toml and meta.yaml is raised to match.
• Vendored list, per your note that it was stale: it is now dependencies plus the all extra and their requirements, for the supported CPython tier.
  • Dropped: the capture engines (dpkt, scapy, pyshark), which fall back at run time, and the pcapkit-vendor crawlers' requests and bs4.
  • Added: cryptography and pycrate (ESP and NGAP), plus cffi and pycparser.
• Automation: util/conda_vendor.py derives the list from pyproject.toml, replacing util/conda-dist.py. --check flags a stale list, and --smoke checks a built package. Conda Update rewrites the list, and each conda-dist leg smoke-tests its package before upload. This is deliberately not a blocking PR check: an upstream release would otherwise turn unrelated PRs red.

Vendored set: option A, by your ruling on #1814: exactly all. The emulated .tar.bz2 is about 16 MB without bytecode, or about 39 MB if conda-build compiles .pyc (not checked). pycrate's ASN.1 data is about 154 MB unpacked without bytecode.

Not verified: no real conda build or Actions run was possible here. The macOS conda convert step ships arm64 binaries for osx-64, which already affected lxml and now affects cffi and cryptography too. That is tracked in #1822.

tests/project: 959 passed, 1 skipped. The new test_conda_vendor_1814.py fails 5 tests on main.

[JarryShaw]

Verdict: GOOD TO GO at ea5a8bb47. A Sonnet cross-review and re-check (author: Opus) checked the following:

• Packaging: on a real vendored install, every non-bytecode file reaches the wheel and nested .pyc stays out. A normal build's wheel is unchanged.
• Vendored list: it resolves on every conda target (3.11–3.15, Linux and arm64 macOS), and the script reproduces it byte-identically. --check flags main's old list.
• Lazy-read fixture: with the RECORD check disabled, the test now fails.
• setuptools floor: confirmed independently. 61.0 and 62.2 read ** as *, while 62.3 and 68.0 ship every file. 62.3 still builds on the KTLO 3.7 legs.
• Test runs: tests/project gives 959 passed and 1 skipped. Nothing ran on Actions or with a real conda build, which is stated in the body.