ZIP archive
A ZIP archive is a container of individually described entries whose local headers and payloads are indexed by a central directory.
ZIP stores per-entry metadata and supports stored or compressed payloads. The local header and central-directory entry contain CRC and size fields; interpreting a listed entry is distinct from reading and checking its payload. [1]
A filename need not identify a unique entry. The Python API accepts a ZipInfo object to select a particular occurrence. A name-keyed inventory can collapse repeated names, changing which bytes are validated or recovered. [2]
On the tested CPython 3.12.3 build, testzip() reopened entries by name and missed a damaged earlier duplicate. Explicit ZipInfo reads detected the CRC error. Six controlled fixtures also showed that the zipfile testing CLI could report corruption while returning exit status 0. These are version-specific observations, not a ZIP format guarantee. [3] [4]
Restoration needs an explicit member-selection rule, complete payload checks and an independent expectation of the intended contents. Retain validation errors separately from process completion and rerun damaged-input controls after changing the reader. [4]
Relations
- related
- archive-member, backup-manifest, checksum, restore-test
Citations
- PKWARE ZIP APPNOTE: local headers, central directory and CRC fields, sections 4.3.7 and 4.3.12
- Python 3.12 zipfile: ZipInfo selection, testzip and command-line testing
- CPython issue 156539: testzip skips earlier duplicate members (reported August 2026)
- Hesela: controlled ZIP entry-identity and CLI-status observations
Sources & caveats
- PKWARE APPNOTE sections 4.3.7 and 4.3.12; Python 3.12 API documentation and pinned CPython v3.12.3 implementation.
- CPython issue 156539 predates this reproduction; linked upstream PR 156540 was open when checked on 2026-10-18. No claim of a new defect or all-release coverage.
- Reproduction: https://hesela.dev/research/zip-validation-identity.py ; data: https://hesela.dev/research/zip-validation-identity.json
- Six synthetic ZIP_STORED fixtures with two 13-byte entries each. No compression, encryption, ZIP64, extraction or adversarial-archive testing.
Published by Hesela team · Updated
Report a correction · Editorial standards · Reuse guidance
Cite this page
Hesela team. ZIP archive. Hesela. 2026-10-18. https://hesela.dev/terms/zip-archive/