From 7705a460318c1aa342c93d61ae8964dc68fb7141 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Tue, 18 Aug 2026 17:17:40 -0400 Subject: [PATCH 1/2] sdist format: qualify pax compatibility Signed-off-by: William Woodruff --- source/specifications/source-distribution-format.rst | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/source/specifications/source-distribution-format.rst b/source/specifications/source-distribution-format.rst index b877e87d5..b9b9d9b40 100644 --- a/source/specifications/source-distribution-format.rst +++ b/source/specifications/source-distribution-format.rst @@ -74,10 +74,19 @@ at their respective paths relative to the root directory of the sdist No other content of a sdist is required or defined. Build systems can store whatever information they need in the sdist to build the project. -The tarball must use the modern POSIX.1-2001 pax tar format, which specifies +The tarball MUST use the modern POSIX.1-2001 pax tar format, which specifies UTF-8 based file names. In particular, source distribution files must be readable using the standard library tarfile module with the open flag 'r:gz'. +Source distributions MUST NOT use non-pax features, even if those features are +structurally compatible with the pax standard. Installers and other consumers MAY +reject source distributions that are not strictly pax-conforming. + +Examples of non-pax features include GNU-style or legacy ("V7")-style tar members +and sparse member encodings (e.g. ``GNU.sparse`` extensions or ``S`` typeflag members). + +The use of pax-style vendor extensions (such as ``SCHILY.xattr`` or ``LIBARCHIVE.xattr``) +is NOT RECOMMENDED for interoperability reasons. .. _sdist-archive-features: From 89cf209dfd18d833b077906a0f40a15342c60d60 Mon Sep 17 00:00:00 2001 From: William Woodruff Date: Wed, 19 Aug 2026 12:35:11 -0400 Subject: [PATCH 2/2] Strengthen Signed-off-by: William Woodruff --- source/specifications/source-distribution-format.rst | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/source/specifications/source-distribution-format.rst b/source/specifications/source-distribution-format.rst index b9b9d9b40..c1d74b4d2 100644 --- a/source/specifications/source-distribution-format.rst +++ b/source/specifications/source-distribution-format.rst @@ -75,11 +75,11 @@ No other content of a sdist is required or defined. Build systems can store whatever information they need in the sdist to build the project. The tarball MUST use the modern POSIX.1-2001 pax tar format, which specifies -UTF-8 based file names. In particular, source distribution files must be readable +UTF-8 based file names. In particular, source distribution files MUST be readable using the standard library tarfile module with the open flag 'r:gz'. Source distributions MUST NOT use non-pax features, even if those features are -structurally compatible with the pax standard. Installers and other consumers MAY +structurally compatible with the pax standard. Installers and other consumers SHOULD reject source distributions that are not strictly pax-conforming. Examples of non-pax features include GNU-style or legacy ("V7")-style tar members