python / python/cpython

zipinfo: strict_timestamps=False fails in combination with SOURCE_DATE_EPOCH

Open
#152,445 0 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

stdlib type-bug
Dominant language
Python
Stars
77.2k
Forks
35.9k
PR merge metrics
PR metrics pending

Description

Bug report

Bug description:

I have a python program which (among other things) adds a text file to a ZIP with the following code:

zf = zipfile.ZipFile(filename, "a")
zf.writestr("test.txt", "Hello World")
zf.close()

In Python 3.13 and below this worked fine. In Python 3.14 I received a bug report from a NixOS user. For some reason, some tool in their environment had set SOURCE_DATE_EPOCH to a low value between 0 (1970) and 315529200 (1980).

Since Python 3.14, when adding a file to a ZIP, Python honors that variable (so this bug seems to be directly caused by #124435 ). This caused it to fail to add the text file to the ZIP because it tried to use that date for the file's modification date which ZIP doesn't support:

  File "/uv/python/cpython-3.14.4-linux-x86_64-gnu/lib/python3.14/zipfile/__init__.py", line 561, in FileHeader
    header = struct.pack(structFileHeader, stringFileHeader,
                         self.extract_version, self.reserved, flag_bits,
                         self.compress_type, dostime, dosdate, CRC,
                         compress_size, file_size,
                         len(filename), len(extra))
struct.error: 'H' format requires 0 <= number <= 65535

Then I thought, okay, maybe that's a bug in my script, and I added strict_timestamps=False. According to the documentation, that should make it so that dates before 1980 are set to 1980, and dates after 2107 are set to 2107.

Perfect - or so I thought.

Apparently, that only works if I add an file whose actual file system timestamp is before 1980 (as the timestamp is manipulated in the from_file function). When I add a file to the ZIP using writestr, and the timestamp comes from SOURCE_DATE_EPOCH, and it refers to a date before 1980, the timestamp doesn't get updated to 1980 and it just fails to add the given file.

Same issue also appears, by the way, if the actual system time is set to some date in the 1970s. It doesn't set the time to 1980, it just tries to add the file with the current time of 1970 and then fails.

That looks like a bug to me - if I set strict_timestamps=False, I have set SOURCE_DATE_EPOCH (or my system time) to a time before 1980 and I then add a file to the ZIP using writestr, I'd expect it to set the timestamp to 1980, not just throw an exception.

CPython versions tested on:

3.14 and 3.15

Operating systems tested on:

Linux

Linked PRs
  • gh-152452

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start in zipfile/init.py around FileHeader and trace the writestr timestamp path, comparing it with the from_file handling of strict_timestamps. The change is done when strict_timestamps=False clamps pre-1980 timestamps from SOURCE_DATE_EPOCH or the system clock to 1980 instead of raising the shown struct.error; check gh-152452 because the issue links a pull request.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.