Function zip_file 

pub fn zip_file(data_dir: &Path, package: &PackageInfo) -> Option<PathBuf>

Where a listed package’s zip lives; None unless every key is valid, so a hand-edited manifest cannot name a path outside the data root.