1 When ``shutil.make_archive`` falls back to the external ``zip`` problem, it 2 uses :mod:`subprocess` to invoke it rather than :mod:`distutils.spawn`. This 3 closes a possible shell injection vector. 4