Pack200: enforce strict attribute layout parsing

pom.xml

@@ -50,6 +50,11 @@ Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
     <commons.distSvnStagingUrl>scm:svn:https://dist.apache.org/repos/dist/dev/commons/${commons.componentid}</commons.distSvnStagingUrl>
     <commons.manifestlocation>${project.build.outputDirectory}/META-INF</commons.manifestlocation>
     <commons.manifestfile>${commons.manifestlocation}/MANIFEST.MF</commons.manifestfile>
+    <!-- Don't export internal packages in OSGi manifest -->
+    <commons.osgi.export>
+      !org.apache.commons.*.internal.*,
+      org.apache.commons.*;version=${project.version};-noimport:=true
+    </commons.osgi.export>
     <commons.osgi.import>
       org.tukaani.xz;resolution:=optional,
       org.brotli.dec;resolution:=optional,
@@ -540,14 +545,42 @@ Brotli, Zstandard and ar, cpio, jar, tar, zip, dump, 7z, arj.
       </build>
     </profile>
     <profile>
-      <id>java9+</id>
+      <!-- Same id as the `commons-parent` profile it extends -->
+      <id>java-9-up</id>
       <activation>
         <jdk>[9,)</jdk>
       </activation>
       <properties>
         <maven.compiler.release>8</maven.compiler.release>
         <animal.sniffer.skip>true</animal.sniffer.skip>
       </properties>
+      <!--
+        Excludes internal packages from the list of exported packages.
+      -->
+      <build>
+        <plugins>
+          <plugin>
+            <groupId>org.moditect</groupId>
+            <artifactId>moditect-maven-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>add-module-infos</id>
+                <configuration>
+                  <module>
+                    <moduleInfo>
+                      <exports>
+                        !org.apache.commons.compress.harmony.internal.*;
+                        !org.apache.commons.compress.harmony.archive.internal.*;
+                        *;
+                      </exports>
+                    </moduleInfo>
+                  </module>
+                </configuration>
+              </execution>
+            </executions>
+          </plugin>
+        </plugins>
+      </build>
     </profile>
     <profile>
       <id>java17</id>

src/changes/changes.xml

@@ -86,6 +86,7 @@ The <action> type attribute can be add,update,fix,remove.
       <action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">Add strict header validation in ARJ input stream and `selfExtracting` option.</action>
       <!-- FIX unpack200 -->
       <action type="fix" dev="ggregory" due-to="Gary Gregory, Stanislav Fort">org.apache.commons.compress.harmony.unpack200 now throws Pack200Exception, IllegalArgumentException, and IllegalStateException instead of other runtime exceptions and Error.</action>
+      <action type="fix" dev="pkarwasz" due-to="Piotr P. Karwasz">Enforce strict attribute layout parsing in Pack200.</action>
       <!-- FIX pack200 -->      
       <action type="fix" dev="ggregory" due-to="Gary Gregory, Igor Morgenstern">org.apache.commons.compress.harmony.pack200 now throws Pack200Exception, IllegalArgumentException, IllegalStateException, instead of other runtime exceptions and Error.</action>
       <action type="fix" dev="ppkarwasz" due-to="Raeps">Extract duplicate code in org.apache.commons.compress.harmony.pack200.IntList.</action>

src/main/java/org/apache/commons/compress/harmony/archive/internal/nls/package-info.java

@@ -16,8 +16,10 @@
  * specific language governing permissions and limitations
  * under the License.
  */
-
 /**
- * Internal package.
+ * Internal implementation details.
+ *
+ * <p>This package is not exported and must not be used by external code.
+ * Its contents may change or be removed at any time without notice.</p>
  */
 package org.apache.commons.compress.harmony.archive.internal.nls;