`wheel tags` is creating invalid ZIP64 wheels for files >4GB

[konsti-openai]

uv has recently started to perform stronger validations on zip files to avoid parser differential attacks. This surfaced a bug in wheel tags, where the wheel rewriting for ZIP64 files produces and invalid ZIP64 header. This generally only happens for files >4GB, but can be reproduced with smaller files by patching zipfile.ZIP64_LIMIT to a lower value.

Upstream issues:

• [nightly][rocm 7.2] PyTorch Nightly RoCM 7.2 binary download issue pytorch/pytorch#189748
• uv pip install fails with error 'zip64 extended information field was too long' astral-sh/uv#19440

MRE:

#!/usr/bin/env python3
# /// script
# requires-python = ">=3.9"
# dependencies = ["wheel==0.47.0"]
# ///

import os
import subprocess
import sys
from pathlib import Path

root = Path.cwd()
unpacked = root / "demo-1.0.0"
dist_info = unpacked / "demo-1.0.0.dist-info"
(unpacked / "demo").mkdir(parents=True, exist_ok=True)
dist_info.mkdir(exist_ok=True)

(unpacked / "demo" / "padding1").write_bytes(os.urandom(400))
(unpacked / "demo" / "padding2").write_bytes(os.urandom(400))
(unpacked / "demo" / "__init__.py").write_bytes(b"")
(dist_info / "WHEEL").write_text(
    "Wheel-Version: 1.0\nRoot-Is-Purelib: true\nTag: py3-none-any\n"
)
(dist_info / "METADATA").write_text(
    "Metadata-Version: 2.1\nName: demo\nVersion: 1.0.0\n"
)
(dist_info / "RECORD").write_text("")

(root / "sitecustomize.py").write_text("import zipfile\nzipfile.ZIP64_LIMIT = 512\n")
environment = os.environ.copy()
environment["PYTHONPATH"] = str(root) + os.pathsep + environment.get("PYTHONPATH", "")

subprocess.run(
    [sys.executable, "-m", "wheel", "pack", str(unpacked), "-d", str(root)],
    env=environment,
    check=True,
)
original = root / "demo-1.0.0-py3-none-any.whl"
subprocess.run(
    [
        sys.executable,
        "-m",
        "wheel",
        "tags",
        "--platform-tag",
        "manylinux_2_28_x86_64",
        "--remove",
        str(original),
    ],
    env=environment,
    check=True,
)

wheel = root / "demo-1.0.0-py3-none-manylinux_2_28_x86_64.whl"
raise SystemExit(
    subprocess.run(
        [
            "uv",
            "pip",
            "install",
            "--python",
            sys.executable,
            "--target",
            str(root / "target"),
            "--no-cache",
            "--no-deps",
            "--no-config",
            str(wheel),
        ]
    ).returncode
)

Prove of concept fix: main...konsti-openai:wheel:codex/fix-wheel-zip64-retag