sdist format: qualify pax compatibility

[woodruffw]

I'm opening this as a direct living spec PR, since it's arguably just a clarification of the existing requirement, not a new one 🙂. However, if there's disagreement about that, I'm happy to take this to DPO for discussion first.

My rationale: the sdist spec already says that the tarball must be a POSIX.1-2001 pax archive. This implies a bunch of things that people may not realize, but are already fully covered by that requirement. For example, GNU-style tar files are not pax-conforming (they use a different magic and have special extended value encoding rules), and the S typeflag is GNU-specific.

There's a passable argument to be made that GNU.sparse.* is pax-conforming, since they're pax-style records. However:

1. Some versions of GNU.sparse.* are illegal to represent in pax, since they use duplicated record names;
2. GNU.sparse.* in general changes the framing logic, making it hard to correctly model the parse of a sparse member with a standard pax-conforming parser.

Finally, I think the most controversial part of this is adding a NOT RECOMMENDED for other pax-style (but not standard) vendor records. These are technically allowed in pax, just not defined by the standard themselves. However, they're also subject to a bunch of interoperability problems. For example, SCHILY.xattr is sometimes encoded as raw binary, which is not pax-conforming and causes problems for standard parsers.

(And more generally, Python source distributions have no business encoding xattrs or anything like that, from what I can tell 🙂)

---

📚 Documentation preview 📚: https://python-packaging-user-guide--2108.org.readthedocs.build/en/2108/

[woodruffw]

CCing some other folks who I think might be interested: @konstin @miketheman

[sethmlarson]

LGTM, thanks @woodruffw!