[ThomasWaldmann]

Follow-up to #10499 (and the 1.4 backport #10500), from a review of that code. One commit per issue:

1. pax_time_to_ns: crash and slowness on huge exponents. Decimal("1e3000000").scaleb(9) raises decimal.Overflow, an ArithmeticError but not an OverflowError, so it was not caught and import-tar crashed. In-range huge exponents like 1e999999 made int() build a million-digit integer before safe_ns() clamped it (~15 s per header). Now the Decimal is clamped to [0, MAX_S] before the conversion (same result as safe_ns), NaN/Infinity are rejected and all decimal exceptions are caught.
2. export-tar PAX crashed on an xattr name that is not valid UTF-8. A pax header keyword must be UTF-8 (tarfile encodes it strictly; only values get hdrcharset=BINARY), Linux xattr names are arbitrary bytes. Such an xattr is now skipped with a warning; silently with --tar-format=BORG, where BORG.item.meta has it anyway.
3. Malformed ACL entries from a tar crashed borg extract on Linux. tar_acl_to_borg() passed e.g. user:foo through unchanged, and acl_use_local_uid_gid() then indexed fields[3] → IndexError, not an OSError, so no per-file warning but a traceback. tar_acl_to_borg() now raises ValueError for an unknown tag or a wrong field count and import-tar ignores such a header with a warning (TarfileObjectProcessors got a warning callback for that).
4. Pre-existing: a pax mtime of 1e999 or nan crashed import-tar. tarfile parses it with float() unchecked, int(inf) / int(nan) raised in create_helper(). Falls back to 0 now (a valid pax mtime still overrides it).
5. Unknown user/group names in ACLs. GNU tar writes named entries without a numeric id; if the name is unknown locally, the name is stored in place of the id (like borg create does) and every later extract of that file fails, also with --numeric-ids. import-tar now warns once per unknown name.
6. Docs: the --tar-format table did not say what PAX/GNU still lose (BSD flags, NFSv4/extended ACLs, birthtime, content digests).
7. Test: test_roundtrip_pax_timestamps never produced an atime header (no --atime); now checks all three.

Tests for 1–5 added (a crafted-tar test for each crash). Run on macOS and in a Linux container (where the ACL and non-UTF-8 xattr tests actually execute).

Not done here: acl_use_local_uid_gid() in platform/linux.pyx itself still indexes fields[3] unguarded, and the BORG-format import path trusts BORG.item.meta blindly (assert on the version, no make_path_safe, tracebacks on bad base64/msgpack) — separate PRs.

🤖 Generated with Claude Code

[codecov]

Codecov Report

❌ Patch coverage is 91.83673% with 4 lines in your changes missing coverage. Please review.
✅ Project coverage is 89.36%. Comparing base (184cae0) to head (813e38d).
⚠️ Report is 8 commits behind head on master.
✅ All tests successful. No failed tests found.

Files with missing lines	Patch %	Lines
src/borg/archive.py	88.23%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@           Coverage Diff            @@
##           master   #10589    +/-   ##
========================================
  Coverage   89.35%   89.36%            
========================================
  Files         104      105     +1     
  Lines       20091    20368   +277     
  Branches     3154     3198    +44     
========================================
+ Hits        17953    18202   +249     
- Misses       1481     1507    +26     
- Partials      657      659     +2     

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.