The files macOS tar adds, and then hides
ESA's sandbox found a ._ entry beside every file in the package. The macOS tar that wrote them is the same one that leaves them out of the listing.
ESA’s note on the software environment test had one non-blocker. The package
held ._ files, one beside each real file: macOS tar’s way of storing
extended attributes, here a provenance attribute macOS had attached to each
one. They did not affect the run. The package had been listed before it
was sent, with macOS tar, which hides what macOS tar adds.
The build now sets COPYFILE_DISABLE=1 and passes --no-mac-metadata to
bsdtar. Then it lists the archive with Python’s tarfile, which has no
opinion about macOS, and fails on any ._ entry, on a file list other than
the five, and on an owner other than exp:exp. The package ESA had tested was
left as it was. The five files were byte for byte the ones it ran.
The check reads the archive with a tool from somewhere else, because the one that made the problem could not see it.