In the future, it's fine to bundle several small clean-ups (like the de-deduplication) in one PR.

@StanFromIreland @gpshead Is there still any major concern about this PR?

FYI, this error was introduced because I forgot to remove the trailing space when copying the code snippet from the zip bomb check:

            if (zinfo._end_offset is not None and
                zef_file.tell() + zinfo.compress_size > zinfo._end_offset):
                if zinfo._end_offset == zinfo.header_offset:
                    import warnings
                    warnings.warn(
                        f"Overlapped entries: {zinfo.orig_filename!r} "
                        f"(possible zip bomb)",
                        skip_file_prefixes=(os.path.dirname(__file__),))
                else:
                    raise BadZipFile(
                        f"Overlapped entries: {zinfo.orig_filename!r} "
                        f"(possible zip bomb)")

I removed the "(possible zip bomb)" because it's irrelevant and may be improper here. The overlapping check here is against all ZipInfos in the ZipFile PLUS all ZipInfos passed by the removed argument for ZipFile.repack. It may happen on a normal ZIP archive when ZipInfos passed by removed are improper.

For example, when calling repack([m1]) and then repack([m2]) for a ZipFile with (m1, m2, m3) and has (m1, m2) removed, because m3 has been repositioned to a smaller offset in the prior repack and therefore overlaps with m2, which still records the original offset and size.

For another example, when calling repack([m1]) for a ZipFile with m1, m2, m3 and m1 is not removed.

We do can consider providing a more comprehensive hint, such as the offset or used size of the offensive member, but it may need much more considerations and I think we can do the clean first and left it to future enhancement.

This PR is stale because it has been open for 90 days with no activity.

Thanks @danny0838 for the PR, and @gpshead for merging it 🌮🎉.. I'm working now to backport this PR to: 3.14, 3.15.
🐍🍒⛏🤖

Sorry, @danny0838 and @gpshead, I could not cleanly backport this to 3.15 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker aab474a35b7d47aa3404db0fd5cb2c0314090941 3.15

Sorry, @danny0838 and @gpshead, I could not cleanly backport this to 3.14 due to a conflict.

Please backport manually with cherry_picker, see the devguide for more information.

cherry_picker aab474a35b7d47aa3404db0fd5cb2c0314090941 3.14