1When ``shutil.make_archive`` falls back to the external ``zip`` problem, it
2uses :mod:`subprocess` to invoke it rather than :mod:`distutils.spawn`. This
3closes a possible shell injection vector.
4