Created originally on Bitbucket by Hervé Beraud (hervé beraud)
Was already merged in Bitbucket before import, marked as merged by the import user
Convert shutil._call_external_zip to use subprocess rather than distutlils.spawn
When shutil.make_archive falls back to te external zip problem, it use subprocess to invoke it rather than distutils.spawn.
This closes a possible shell injection vector. distutils.spawn isn't very good at quoting command lines.
Original pull-request on CPython: https://github.com/python/cpython/pull/8985
Original-Author: Benjamin Peterson email@example.com