pyzipper

Warnings

• gotcha Passwords must be provided as byte strings (e.g., `b'yourpassword'`), not regular Python strings. Failing to do so will result in errors during encryption or decryption operations.
  Fix: Ensure `zf.setpassword()` is called with a bytes object: `zf.setpassword(b'your_password')`.
• breaking Pyzipper was forked from Python 3.7's `zipfile` module and therefore lacks support for `pathlib`-compatible wrappers and other new features introduced in Python 3.8 and later versions of the standard `zipfile` module.
  Fix: Avoid using `pathlib.Path` objects directly with `pyzipper` where `zipfile` in Python 3.8+ would support them. Convert `pathlib.Path` objects to strings if necessary before passing them to `pyzipper` methods.
• gotcha File metadata, such as filenames, are not encrypted by pyzipper. Only the file contents are protected by AES encryption. This means an attacker could still see the names of the files within the archive.
  Fix: If filename confidentiality is required, consider an additional layer of encryption or obfuscation for filenames before archiving, or use a different archiving solution that encrypts metadata.
• deprecated The AES-2 encryption used by pyzipper, while better than ZipCrypto, has known flaws and may not be suitable for all high-security use cases. Information leakage can occur, especially if the ZIP file can be intercepted and modified.
  Fix: For applications requiring the highest level of security, evaluate alternatives to the ZIP format or implement additional security measures outside of `pyzipper` to protect sensitive data.
• gotcha The project's last release was in July 2022, which might indicate infrequent maintenance. Users should be aware that active development, bug fixes, or security patches might not be regularly provided.
  Fix: Monitor the GitHub repository for updates and consider contributing or forking the project if specific maintenance needs arise. Factor in the maintenance status when planning for long-term usage in critical applications.

Install

• pip install pyzipper Install pyzipper

Imports

• AESZipFile

  import pyzipper
  with pyzipper.AESZipFile(...) as zf:

  pyzipper provides `AESZipFile` as its primary class, which replaces the standard `zipfile.ZipFile` for AES encryption features. Directly using `zipfile.ZipFile` will not provide AES encryption.

Quickstart

This quickstart demonstrates how to create a new ZIP archive, add a file with AES encryption and LZMA compression, set a password, and then read the content back, using `pyzipper.AESZipFile`.

import pyzipper
import os

secret_password = b'your_secret_password'
zip_filename = 'secure_archive.zip'
content_to_write = "This is a secret message that needs to be protected."

# Create an AES encrypted zip file
with pyzipper.AESZipFile(zip_filename, 'w', compression=pyzipper.ZIP_LZMA, encryption=pyzipper.WZ_AES) as zf:
    zf.setpassword(secret_password)
    zf.writestr('secret.txt', content_to_write)
    print(f"'{zip_filename}' created with 'secret.txt' encrypted.")

# Read content from the AES encrypted zip file
with pyzipper.AESZipFile(zip_filename, 'r') as zf:
    zf.setpassword(secret_password)
    try:
        read_content = zf.read('secret.txt').decode('utf-8')
        print(f"Content read from 'secret.txt': {read_content}")
    except RuntimeError as e:
        print(f"Error reading file (incorrect password or corruption): {e}")

# Clean up the created zip file
if os.path.exists(zip_filename):
    os.remove(zip_filename)
    print(f"Cleaned up '{zip_filename}'.")