From c9ee9db6dbf37dffc68d47392af2c7f06ab9de4a Mon Sep 17 00:00:00 2001
From: Fedora Release Engineering <releng@fedoraproject.org>
Date: Fri, 25 Jul 2025 17:48:24 +0000
Subject: [PATCH 1/5] Rebuilt for
 https://fedoraproject.org/wiki/Fedora_43_Mass_Rebuild


From d548fd6052d4956cc6b968f1eb0f9ef5ef32577b Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Tue, 16 Dec 2025 12:37:39 +0000
Subject: [PATCH 2/5] Allow bzip2 0.6

---
 rust-zip.spec              |  5 ++++-
 rust2rpm.toml              |  5 +++++
 zip-fix-metadata-auto.diff |  2 +-
 zip-fix-metadata.diff      | 11 ++++++++++-
 4 files changed, 20 insertions(+), 3 deletions(-)

diff --git a/rust-zip.spec b/rust-zip.spec
index e62e4ff..7ec653b 100644
--- a/rust-zip.spec
+++ b/rust-zip.spec
@@ -1,4 +1,4 @@
-# Generated by rust2rpm 27
+# Generated by rust2rpm 28
 %bcond check 1
 %global debug_package %{nil}
 
@@ -30,6 +30,9 @@ Patch:          zip-fix-metadata-auto.diff
 #   feature is counter to upstream guidance,”
 #   https://github.com/zip-rs/zip2/issues/336.
 # * patch out the nt-time features; rust-nt-time not yet packaged
+# * allow bzip2 0.6; see
+#   https://github.com/zip-rs/zip2/commit/c8278990c40ddfbeb4a23877c1221792535d21b3,
+#   released upstream in 4.3.0
 Patch:          zip-fix-metadata.diff
 # * Downstream-only: patch out tests that would need omitted test files to
 #   compile
diff --git a/rust2rpm.toml b/rust2rpm.toml
index ae2e4ab..05dc845 100644
--- a/rust2rpm.toml
+++ b/rust2rpm.toml
@@ -9,6 +9,11 @@ cargo-toml-patch-comments = [
     https://github.com/zip-rs/zip2/issues/336.\
     """,
     "patch out the nt-time features; rust-nt-time not yet packaged",
+    """\
+    allow bzip2 0.6; see \
+    https://github.com/zip-rs/zip2/commit/c8278990c40ddfbeb4a23877c1221792535d21b3, \
+    released upstream in 4.3.0\
+    """,
 ]
 doc-files.exclude = ["pull_request_template.md"]
 exclude-crate-files = [
diff --git a/zip-fix-metadata-auto.diff b/zip-fix-metadata-auto.diff
index fa93a29..f0b39d1 100644
--- a/zip-fix-metadata-auto.diff
+++ b/zip-fix-metadata-auto.diff
@@ -1,5 +1,5 @@
 --- zip-3.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-3.0.0/Cargo.toml	2025-05-16T11:17:25.429348+00:00
++++ zip-3.0.0/Cargo.toml	2025-12-16T12:37:16.059987+00:00
 @@ -244,6 +244,3 @@
  [dev-dependencies.walkdir]
  version = "2.5"
diff --git a/zip-fix-metadata.diff b/zip-fix-metadata.diff
index 95bfdb7..c4e9c5b 100644
--- a/zip-fix-metadata.diff
+++ b/zip-fix-metadata.diff
@@ -1,5 +1,5 @@
 --- zip-3.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-3.0.0/Cargo.toml	2025-05-16T11:17:25.430552+00:00
++++ zip-3.0.0/Cargo.toml	2025-12-16T12:37:25.465467+00:00
 @@ -97,7 +97,6 @@
  ]
  jiff-02 = ["dep:jiff"]
@@ -8,6 +8,15 @@
  unreserved = []
  xz = ["dep:xz2"]
  
+@@ -125,7 +124,7 @@
+ optional = true
+ 
+ [dependencies.bzip2]
+-version = "0.5.0"
++version = ">=0.5.0, <0.7.0"
+ optional = true
+ 
+ [dependencies.chrono]
 @@ -151,7 +150,6 @@
  [dependencies.getrandom]
  version = "0.3.1"

From c92aec8fbb9d59389080f04feb8fc8fdabf63b9b Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Wed, 17 Dec 2025 10:33:48 +0000
Subject: [PATCH 3/5] Update to version 6.0.0

---
 .gitignore                         |   2 +
 get_test_data.sh                   |  55 +++++++++++++--
 rust-zip.spec                      | 103 ++++++++++++-----------------
 rust2rpm.toml                      |  33 ++++++---
 sources                            |   4 +-
 zip-3.0.0-omitted-test-files.patch |  12 ----
 zip-6.0.0-omitted-test-files.patch |  21 ++++++
 zip-fix-metadata-auto.diff         |   6 +-
 zip-fix-metadata.diff              |  55 +++++++++------
 9 files changed, 179 insertions(+), 112 deletions(-)
 delete mode 100644 zip-3.0.0-omitted-test-files.patch
 create mode 100644 zip-6.0.0-omitted-test-files.patch

diff --git a/.gitignore b/.gitignore
index ace15fb..145e028 100644
--- a/.gitignore
+++ b/.gitignore
@@ -36,3 +36,5 @@
 /zip2-2.6.1-filtered.tar.gz
 /zip-3.0.0.crate
 /zip2-3.0.0-filtered.tar.gz
+/zip-6.0.0.crate
+/zip2-6.0.0-filtered.tar.gz
diff --git a/get_test_data.sh b/get_test_data.sh
index c853d63..ab00a90 100755
--- a/get_test_data.sh
+++ b/get_test_data.sh
@@ -21,6 +21,12 @@ FORGEURL='https://github.com/zip-rs/zip2'
 # - lin-ub_iwd-v11.zip:
 #   LICENSE.lin-ub_iwd-v11.zip.txt clearly shows that this is at *best* not
 #   under a license acceptable in Fedora.
+# - omni.ja:
+#   This is a Firefox application resource bundle,
+#   https://udn.realityripple.com/docs/Mozilla/About_omni.ja_(formerly_omni.jar).
+#   It is very likely that everything in it is properly licensed for Fedora,
+#   but it is complex to audit, and we would rather not do all that work to
+#   confirm it’s OK when the alternative is just disabling a single test.
 # - pandoc_soft_links.zip:
 #   Contains a copy of pandoc 3.2 compiled for aarch64: pandoc itself is
 #   open-source, but who can say what was linked into it? The complete list of
@@ -28,27 +34,67 @@ FORGEURL='https://github.com/zip-rs/zip2'
 OK_FILES="$(grep -vE '^(#|$)' <<EOF
 # Contents are trivial: symlinks, zero-bytes files, sample text files
 # containing only a few words, etc.
+#
+# From the source for the applicable tests, the password is "helloworld":
+aes_archive.zip
+comment_garbage.zip
 data_descriptor.zip
+extended_timestamp.zip
+extended_timestamp_bad.zip
 files_and_dirs.zip
 linux-7z.zip
 mimetype.zip
+misaligned_comment.zip
 non_utf8.zip
+ntfs.zip
+ppmd.zip
 symlink.zip
 windows-7zip.zip
+xz.zip
 zip64_demo.zip
 zip64_magic_in_filename_1.zip
 zip64_magic_in_filename_2.zip
 zip64_magic_in_filename_4.zip
 zip64_magic_in_filename_5.zip
 
-# These don’t unzip with the "unzip" tool, so they are difficult to audit, but
-# their sizes are only from a few dozen to a few hundred bytes, so we assume
-# their contents are very likely to be unproblematic.
+# These are derived from the Project Gutenberg text of Shakespeare’s Hamlet,
+# https://www.gutenberg.org/cache/epub/1524/pg1524.txt. Both the play and the
+# print edition upon which the text is based are old enough to be unprotected
+# by copyright in the US, and probably worldwide. Fedora Legal has determined
+# that the “Project Gutenberg License” is “not a license” and content that is
+# actually in the public domain can be treated as such,
+# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/676.
+legacy/implode_hamlet_2048.out
+legacy/implode_hamlet_256.bin
+legacy/implode_hamlet_256.out
+legacy/implode.zip
+legacy/reduce_hamlet_2048.bin
+legacy/reduce_zero_reduced.bin
+legacy/reduce.zip
+legacy/shrink.zip
+
+# The interesting part here is the file binary.wmv, which is a bit over a
+# minute of spoken-word audio from some kind of talk or lecture. Upstream
+# claims (via folder/LICENSE.binary.wmv.txt) that the license is MIT. The text
+# file first.txt is taken from Project Gutenberg text of Shakespeare’s Hamlet,
+# discussed above.
+deflate64.zip
+folder/LICENSE.binary.wmv.txt
+folder/binary.wmv
+folder/first.txt
+lzma.zip
+
+# These don’t unzip with the "unzip" tool or the "7z" tool, so they are
+# difficult to audit, but their sizes are only from a few dozen to a few
+# hundred bytes, so we assume their contents are very likely to be
+# unproblematic.
+#
 deflate64_issue_25.zip
+ignore_encryption_flag.zip
 invalid_cde_number_of_files_allocation_greater_offset.zip
 invalid_cde_number_of_files_allocation_smaller_offset.zip
-invalid_offset2.zip
 invalid_offset.zip
+invalid_offset2.zip
 raw_deflate64_index_out_of_bounds.zip
 zip64_magic_in_filename_3.zip
 EOF
@@ -103,6 +149,7 @@ cp -lrp "${TARDIR}/tests/data" data_unfiltered
 find "${TARDIR}/tests/data" -type f -delete
 echo "${OK_FILES}" | while read -r fn
 do
+  mkdir -p "${TARDIR}/tests/data/$(dirname "${fn}")"
   mv "data_unfiltered/${fn}" "${TARDIR}/tests/data/${fn}"
 done
 # https://www.gnu.org/software/tar/manual/html_section/Reproducibility.html
diff --git a/rust-zip.spec b/rust-zip.spec
index 7ec653b..465ffea 100644
--- a/rust-zip.spec
+++ b/rust-zip.spec
@@ -5,7 +5,7 @@
 %global crate zip
 
 Name:           rust-zip
-Version:        3.0.0
+Version:        6.0.0
 Release:        %autorelease
 Summary:        Library to support the reading and writing of zip files
 
@@ -24,19 +24,29 @@ Source11:       get_test_data.sh
 Patch:          zip-fix-metadata-auto.diff
 # Manually created patch for downstream crate metadata changes
 # * drop unused benchmark-only / example-only dev-dependencies
-# * Remove the wasm_js feature from the getrandom dependency for the getrandom
-#   feature, and from the getrandom dev-dependency. Our rust-getrandom does not
-#   provide this feature; see also “Unconditional use of getrandom’s wasm_js
-#   feature is counter to upstream guidance,”
-#   https://github.com/zip-rs/zip2/issues/336.
+# * Remove the wasm_js feature from the getrandom dev-dependency. Our
+#   rust-getrandom does not provide this feature; see also “Unconditional use of
+#   getrandom’s wasm_js feature is counter to upstream guidance,”
+#   https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the
+#   dependency since 4.3.0, but not yet for the dev-dependency.
 # * patch out the nt-time features; rust-nt-time not yet packaged
-# * allow bzip2 0.6; see
-#   https://github.com/zip-rs/zip2/commit/c8278990c40ddfbeb4a23877c1221792535d21b3,
-#   released upstream in 4.3.0
+# * deps: Bump lzma-rust2 to v0.15:
+#   https://github.com/zip-rs/zip2/commit/d6d106fea2844793a8c80d27192b52694fcc57ca
+# * Patch out ppmd support, even though it is in the default features. While the
+#   README.md for the ppmd-rust crate says “The code in this crate is in the
+#   public domain as the original code by their authors,” Cargo.toml lists the
+#   license as CC0-1.0, which is not precisely equivalent to the public-domain
+#   declaration in the README and is not-allowed for code in Fedora.
+# * Remove lzma-static and xz-static features, which were supposed to be removed
+#   in this release
+#   (https://github.com/zip-rs/zip2/commit/af0f3349dae5640a0b756ea065c95af8a1a0e2a5),
+#   but apparently were not due to
+#   https://github.com/release-plz/release-plz/issues/2446 causing the previous
+#   commit to be published.
 Patch:          zip-fix-metadata.diff
 # * Downstream-only: patch out tests that would need omitted test files to
 #   compile
-Patch10:        zip-3.0.0-omitted-test-files.patch
+Patch10:        zip-6.0.0-omitted-test-files.patch
 
 BuildRequires:  cargo-rpm-macros >= 24
 
@@ -102,18 +112,6 @@ use the "_deflate-any" feature of the "%{crate}" crate.
 %files       -n %{name}+_deflate-any-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+aes-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+aes-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "aes" feature of the "%{crate}" crate.
-
-%files       -n %{name}+aes-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+aes-crypto-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -126,6 +124,18 @@ use the "aes-crypto" feature of the "%{crate}" crate.
 %files       -n %{name}+aes-crypto-devel
 %ghost %{crate_instdir}/Cargo.toml
 
+%package     -n %{name}+bitstream-io-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+bitstream-io-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "bitstream-io" feature of the "%{crate}" crate.
+
+%files       -n %{name}+bitstream-io-devel
+%ghost %{crate_instdir}/Cargo.toml
+
 %package     -n %{name}+bzip2-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -150,18 +160,6 @@ use the "chrono" feature of the "%{crate}" crate.
 %files       -n %{name}+chrono-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+constant_time_eq-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+constant_time_eq-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "constant_time_eq" feature of the "%{crate}" crate.
-
-%files       -n %{name}+constant_time_eq-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+deflate-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -270,6 +268,18 @@ use the "jiff-02" feature of the "%{crate}" crate.
 %files       -n %{name}+jiff-02-devel
 %ghost %{crate_instdir}/Cargo.toml
 
+%package     -n %{name}+legacy-zip-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+legacy-zip-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "legacy-zip" feature of the "%{crate}" crate.
+
+%files       -n %{name}+legacy-zip-devel
+%ghost %{crate_instdir}/Cargo.toml
+
 %package     -n %{name}+lzma-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -282,18 +292,6 @@ use the "lzma" feature of the "%{crate}" crate.
 %files       -n %{name}+lzma-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+lzma-rs-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+lzma-rs-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "lzma-rs" feature of the "%{crate}" crate.
-
-%files       -n %{name}+lzma-rs-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+pbkdf2-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -366,18 +364,6 @@ use the "zeroize" feature of the "%{crate}" crate.
 %files       -n %{name}+zeroize-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+zopfli-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+zopfli-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "zopfli" feature of the "%{crate}" crate.
-
-%files       -n %{name}+zopfli-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+zstd-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -407,7 +393,6 @@ use the "zstd" feature of the "%{crate}" crate.
 %check
 # Extract test data (only) from the GitHub archive
 tar -xzvf '%{SOURCE10}' --strip-components=1 'zip2-%{version}/tests/data/'
-cp -vp '%{SOURCE11}' tests/data/
 %cargo_test -a
 %endif
 
diff --git a/rust2rpm.toml b/rust2rpm.toml
index 05dc845..bba509c 100644
--- a/rust2rpm.toml
+++ b/rust2rpm.toml
@@ -2,17 +2,31 @@
 cargo-toml-patch-comments = [
     "drop unused benchmark-only / example-only dev-dependencies",
     """\
-    Remove the wasm_js feature from the getrandom dependency for the getrandom \
-    feature, and from the getrandom dev-dependency. Our rust-getrandom does not \
-    provide this feature; see also “Unconditional use of getrandom’s wasm_js \
-    feature is counter to upstream guidance,” \
-    https://github.com/zip-rs/zip2/issues/336.\
+    Remove the wasm_js feature from the getrandom dev-dependency. Our \
+    rust-getrandom does not provide this feature; see also “Unconditional use of \
+    getrandom’s wasm_js feature is counter to upstream guidance,” \
+    https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the \
+    dependency since 4.3.0, but not yet for the dev-dependency.\
     """,
     "patch out the nt-time features; rust-nt-time not yet packaged",
     """\
-    allow bzip2 0.6; see \
-    https://github.com/zip-rs/zip2/commit/c8278990c40ddfbeb4a23877c1221792535d21b3, \
-    released upstream in 4.3.0\
+    deps: Bump lzma-rust2 to v0.15: \
+    https://github.com/zip-rs/zip2/commit/d6d106fea2844793a8c80d27192b52694fcc57ca\
+    """,
+    """\
+    Patch out ppmd support, even though it is in the default features. While \
+    the README.md for the ppmd-rust crate says “The code in this crate is in the \
+    public domain as the original code by their authors,” Cargo.toml lists the \
+    license as CC0-1.0, which is not precisely equivalent to the public-domain \
+    declaration in the README and is not-allowed for code in Fedora.\
+    """,
+    """\
+    Remove lzma-static and xz-static features, which were supposed to be \
+    removed in this release \
+    (https://github.com/zip-rs/zip2/commit/af0f3349dae5640a0b756ea065c95af8a1a0e2a5), \
+    but apparently were not due to \
+    https://github.com/release-plz/release-plz/issues/2446 causing the previous \
+    commit to be published.\
     """,
 ]
 doc-files.exclude = ["pull_request_template.md"]
@@ -42,7 +56,7 @@ comments = [
 
 [[package.extra-patches]]
 number = 10
-file = "zip-3.0.0-omitted-test-files.patch"
+file = "zip-6.0.0-omitted-test-files.patch"
 comments = [
     """\
     Downstream-only: patch out tests that would need omitted test files to \
@@ -57,6 +71,5 @@ enable-all = true
 check.pre = [
     "# Extract test data (only) from the GitHub archive",
     "tar -xzvf '%{SOURCE10}' --strip-components=1 'zip2-%{version}/tests/data/'",
-    "cp -vp '%{SOURCE11}' tests/data/",
 ]
 
diff --git a/sources b/sources
index 8fa925c..f0b1d24 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (zip-3.0.0.crate) = 64e0952ab5232a4c36e0f7c019fefd382f0373d2e7bbcdbe026bad522e14d9e483aa75793e9f592371497e068ba416a6939ef242223ed387c4d077a3ca044bc5
-SHA512 (zip2-3.0.0-filtered.tar.gz) = 8eb13dae727299566790ba067ebd85686fe62f4474cdfa8ac4d18c39d56c5fd258aba0d2f3babae1c6378f17d2e620c35dbb9e4afdc636fd45bf1b2924c6058d
+SHA512 (zip-6.0.0.crate) = 0fbcc6ef6580df7db0d98f677bb5097a7c420646d1eec44b89714a7c9c7f54e4abe6489192f85e1debccfa241e3cbed2ef0a7eab3f0864b7f008527ace8e0996
+SHA512 (zip2-6.0.0-filtered.tar.gz) = 31db89194ac1512a8afe14f817aed588666853001a9c8bac2d64f93e2b818cd2ff1b4b784bb149febdfe5fd63f0b089bf8dcca04c36b2810c41e285ddb5a684a
diff --git a/zip-3.0.0-omitted-test-files.patch b/zip-3.0.0-omitted-test-files.patch
deleted file mode 100644
index 876a903..0000000
--- a/zip-3.0.0-omitted-test-files.patch
+++ /dev/null
@@ -1,12 +0,0 @@
-diff -Naur zip-3.0.0-original/src/read.rs zip-3.0.0/src/read.rs
---- zip-3.0.0-original/src/read.rs	2006-07-23 21:21:28.000000000 -0400
-+++ zip-3.0.0/src/read.rs	2025-05-16 07:16:07.587241056 -0400
-@@ -2170,6 +2170,8 @@
- 
-     #[test]
-     #[cfg(feature = "deflate-flate2")]
-+    // Downstream patch: we do not include the test file needed for this test.
-+    #[cfg(any())]
-     fn test_utf8_extra_field() {
-         let mut v = Vec::new();
-         v.extend_from_slice(include_bytes!("../tests/data/chinese.zip"));
diff --git a/zip-6.0.0-omitted-test-files.patch b/zip-6.0.0-omitted-test-files.patch
new file mode 100644
index 0000000..9bc23c1
--- /dev/null
+++ b/zip-6.0.0-omitted-test-files.patch
@@ -0,0 +1,21 @@
+diff -Naur zip-6.0.0-original/src/read.rs zip-6.0.0/src/read.rs
+--- zip-6.0.0-original/src/read.rs	2006-07-24 02:21:28.000000000 +0100
++++ zip-6.0.0/src/read.rs	2025-12-17 11:48:28.449459541 +0000
+@@ -2316,6 +2316,8 @@
+ 
+     #[test]
+     #[cfg(feature = "deflate-flate2")]
++    // Downstream patch: we do not include the test file needed for this test.
++    #[cfg(any())]
+     fn test_utf8_extra_field() {
+         let mut reader =
+             ZipArchive::new(Cursor::new(include_bytes!("../tests/data/chinese.zip"))).unwrap();
+@@ -2399,6 +2401,8 @@
+     }
+ 
+     #[test]
++    // Downstream patch: we do not include the test file needed for this test.
++    #[cfg(any())]
+     fn test_central_directory_not_at_end() -> ZipResult<()> {
+         let mut reader = ZipArchive::new(Cursor::new(include_bytes!("../tests/data/omni.ja")))?;
+         let mut file = reader.by_name("chrome.manifest")?;
diff --git a/zip-fix-metadata-auto.diff b/zip-fix-metadata-auto.diff
index f0b39d1..580f862 100644
--- a/zip-fix-metadata-auto.diff
+++ b/zip-fix-metadata-auto.diff
@@ -1,6 +1,6 @@
---- zip-3.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-3.0.0/Cargo.toml	2025-12-16T12:37:16.059987+00:00
-@@ -244,6 +244,3 @@
+--- zip-6.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-6.0.0/Cargo.toml	2025-12-18T14:11:57.288488+00:00
+@@ -256,6 +256,3 @@
  [dev-dependencies.walkdir]
  version = "2.5"
  
diff --git a/zip-fix-metadata.diff b/zip-fix-metadata.diff
index c4e9c5b..f58a6c6 100644
--- a/zip-fix-metadata.diff
+++ b/zip-fix-metadata.diff
@@ -1,31 +1,36 @@
---- zip-3.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-3.0.0/Cargo.toml	2025-12-16T12:37:25.465467+00:00
-@@ -97,7 +97,6 @@
- ]
+--- zip-6.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-6.0.0/Cargo.toml	2025-12-18T14:12:06.721249+00:00
+@@ -71,7 +71,6 @@
+     "deflate64",
+     "deflate",
+     "lzma",
+-    "ppmd",
+     "time",
+     "zstd",
+     "xz",
+@@ -99,12 +98,8 @@
  jiff-02 = ["dep:jiff"]
- lzma = ["lzma-rs/stream"]
+ legacy-zip = ["bitstream-io"]
+ lzma = ["dep:lzma-rust2"]
+-lzma-static = ["lzma"]
 -nt-time = ["dep:nt-time"]
+-ppmd = ["dep:ppmd-rust"]
  unreserved = []
- xz = ["dep:xz2"]
+ xz = ["dep:lzma-rust2"]
+-xz-static = ["lzma"]
  
-@@ -125,7 +124,7 @@
+ [lib]
+ name = "zip"
+@@ -175,7 +170,7 @@
  optional = true
  
- [dependencies.bzip2]
--version = "0.5.0"
-+version = ">=0.5.0, <0.7.0"
- optional = true
- 
- [dependencies.chrono]
-@@ -151,7 +150,6 @@
- [dependencies.getrandom]
- version = "0.3.1"
+ [dependencies.lzma-rust2]
+-version = "0.13"
++version = "0.15"
  features = [
--    "wasm_js",
      "std",
- ]
- optional = true
-@@ -176,11 +174,6 @@
+     "encoder",
+@@ -188,17 +183,8 @@
  [dependencies.memchr]
  version = "2.7"
  
@@ -36,8 +41,14 @@
 -
  [dependencies.pbkdf2]
  version = "0.12"
+-optional = true
+-
+-[dependencies.ppmd-rust]
+-version = "1.2"
  optional = true
-@@ -213,20 +206,9 @@
+ 
+ [dependencies.sha1]
+@@ -225,20 +211,9 @@
  optional = true
  default-features = false
  
@@ -58,7 +69,7 @@
      "std",
  ]
  
-@@ -241,6 +223,3 @@
+@@ -253,6 +228,3 @@
  ]
  default-features = false
  

From 5f5c8daa03444ac2d9c277b36a82f209c306bcfe Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Thu, 8 Jan 2026 21:08:52 +0000
Subject: [PATCH 4/5] Update to version 7.0.0; Fixes RHBZ#2367905

---
 .gitignore                 |  2 +
 rust-zip.spec              | 91 +++++++++-----------------------------
 rust2rpm.toml              | 21 ++++-----
 sources                    |  4 +-
 zip-fix-metadata-auto.diff |  6 +--
 zip-fix-metadata.diff      | 43 ++++++++++--------
 6 files changed, 61 insertions(+), 106 deletions(-)

diff --git a/.gitignore b/.gitignore
index 145e028..66c40c1 100644
--- a/.gitignore
+++ b/.gitignore
@@ -38,3 +38,5 @@
 /zip2-3.0.0-filtered.tar.gz
 /zip-6.0.0.crate
 /zip2-6.0.0-filtered.tar.gz
+/zip-7.0.0.crate
+/zip2-7.0.0-filtered.tar.gz
diff --git a/rust-zip.spec b/rust-zip.spec
index 465ffea..efe3103 100644
--- a/rust-zip.spec
+++ b/rust-zip.spec
@@ -5,7 +5,7 @@
 %global crate zip
 
 Name:           rust-zip
-Version:        6.0.0
+Version:        7.0.0
 Release:        %autorelease
 Summary:        Library to support the reading and writing of zip files
 
@@ -23,26 +23,23 @@ Source11:       get_test_data.sh
 # Automatically generated patch to strip dependencies and normalize metadata
 Patch:          zip-fix-metadata-auto.diff
 # Manually created patch for downstream crate metadata changes
-# * drop unused benchmark-only / example-only dev-dependencies
+# * Drop unused benchmark-only / example-only dev-dependencies
 # * Remove the wasm_js feature from the getrandom dev-dependency. Our
 #   rust-getrandom does not provide this feature; see also “Unconditional use of
 #   getrandom’s wasm_js feature is counter to upstream guidance,”
 #   https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the
 #   dependency since 4.3.0, but not yet for the dev-dependency.
-# * patch out the nt-time features; rust-nt-time not yet packaged
-# * deps: Bump lzma-rust2 to v0.15:
-#   https://github.com/zip-rs/zip2/commit/d6d106fea2844793a8c80d27192b52694fcc57ca
+# * Patch out the nt-time features; rust-nt-time not yet packaged
 # * Patch out ppmd support, even though it is in the default features. While the
 #   README.md for the ppmd-rust crate says “The code in this crate is in the
 #   public domain as the original code by their authors,” Cargo.toml lists the
 #   license as CC0-1.0, which is not precisely equivalent to the public-domain
 #   declaration in the README and is not-allowed for code in Fedora.
-# * Remove lzma-static and xz-static features, which were supposed to be removed
-#   in this release
-#   (https://github.com/zip-rs/zip2/commit/af0f3349dae5640a0b756ea065c95af8a1a0e2a5),
-#   but apparently were not due to
-#   https://github.com/release-plz/release-plz/issues/2446 causing the previous
-#   commit to be published.
+# * Patch out the deflate-flate2-zlib-ng-compat feature, which requires
+#   flate2/zlib-ng-compat, not packaged.
+# * Unpin generic-array; see https://github.com/zip-rs/zip2/pull/458 for the
+#   upstream rationale, but we cannot use an old version and are not so
+#   concerned about deprecation warnings anyway.
 Patch:          zip-fix-metadata.diff
 # * Downstream-only: patch out tests that would need omitted test files to
 #   compile
@@ -196,6 +193,18 @@ use the "deflate-flate2-zlib" feature of the "%{crate}" crate.
 %files       -n %{name}+deflate-flate2-zlib-devel
 %ghost %{crate_instdir}/Cargo.toml
 
+%package     -n %{name}+deflate-flate2-zlib-ng-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+deflate-flate2-zlib-ng-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "deflate-flate2-zlib-ng" feature of the "%{crate}" crate.
+
+%files       -n %{name}+deflate-flate2-zlib-ng-devel
+%ghost %{crate_instdir}/Cargo.toml
+
 %package     -n %{name}+deflate-flate2-zlib-rs-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -232,30 +241,6 @@ use the "deflate64" feature of the "%{crate}" crate.
 %files       -n %{name}+deflate64-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+getrandom-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+getrandom-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "getrandom" feature of the "%{crate}" crate.
-
-%files       -n %{name}+getrandom-devel
-%ghost %{crate_instdir}/Cargo.toml
-
-%package     -n %{name}+hmac-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+hmac-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "hmac" feature of the "%{crate}" crate.
-
-%files       -n %{name}+hmac-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+jiff-02-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -292,30 +277,6 @@ use the "lzma" feature of the "%{crate}" crate.
 %files       -n %{name}+lzma-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+pbkdf2-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+pbkdf2-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "pbkdf2" feature of the "%{crate}" crate.
-
-%files       -n %{name}+pbkdf2-devel
-%ghost %{crate_instdir}/Cargo.toml
-
-%package     -n %{name}+sha1-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+sha1-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "sha1" feature of the "%{crate}" crate.
-
-%files       -n %{name}+sha1-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+time-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -352,18 +313,6 @@ use the "xz" feature of the "%{crate}" crate.
 %files       -n %{name}+xz-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+zeroize-devel
-Summary:        %{summary}
-BuildArch:      noarch
-
-%description -n %{name}+zeroize-devel %{_description}
-
-This package contains library source intended for building other packages which
-use the "zeroize" feature of the "%{crate}" crate.
-
-%files       -n %{name}+zeroize-devel
-%ghost %{crate_instdir}/Cargo.toml
-
 %package     -n %{name}+zstd-devel
 Summary:        %{summary}
 BuildArch:      noarch
diff --git a/rust2rpm.toml b/rust2rpm.toml
index bba509c..d4dd7a0 100644
--- a/rust2rpm.toml
+++ b/rust2rpm.toml
@@ -1,6 +1,6 @@
 [package]
 cargo-toml-patch-comments = [
-    "drop unused benchmark-only / example-only dev-dependencies",
+    "Drop unused benchmark-only / example-only dev-dependencies",
     """\
     Remove the wasm_js feature from the getrandom dev-dependency. Our \
     rust-getrandom does not provide this feature; see also “Unconditional use of \
@@ -8,11 +8,7 @@ cargo-toml-patch-comments = [
     https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the \
     dependency since 4.3.0, but not yet for the dev-dependency.\
     """,
-    "patch out the nt-time features; rust-nt-time not yet packaged",
-    """\
-    deps: Bump lzma-rust2 to v0.15: \
-    https://github.com/zip-rs/zip2/commit/d6d106fea2844793a8c80d27192b52694fcc57ca\
-    """,
+    "Patch out the nt-time features; rust-nt-time not yet packaged",
     """\
     Patch out ppmd support, even though it is in the default features. While \
     the README.md for the ppmd-rust crate says “The code in this crate is in the \
@@ -21,12 +17,13 @@ cargo-toml-patch-comments = [
     declaration in the README and is not-allowed for code in Fedora.\
     """,
     """\
-    Remove lzma-static and xz-static features, which were supposed to be \
-    removed in this release \
-    (https://github.com/zip-rs/zip2/commit/af0f3349dae5640a0b756ea065c95af8a1a0e2a5), \
-    but apparently were not due to \
-    https://github.com/release-plz/release-plz/issues/2446 causing the previous \
-    commit to be published.\
+    Patch out the deflate-flate2-zlib-ng-compat feature, which requires \
+    flate2/zlib-ng-compat, not packaged.\
+    """,
+    """\
+    Unpin generic-array; see https://github.com/zip-rs/zip2/pull/458 for the \
+    upstream rationale, but we cannot use an old version and are not so \
+    concerned about deprecation warnings anyway.\
     """,
 ]
 doc-files.exclude = ["pull_request_template.md"]
diff --git a/sources b/sources
index f0b1d24..ce5d3d4 100644
--- a/sources
+++ b/sources
@@ -1,2 +1,2 @@
-SHA512 (zip-6.0.0.crate) = 0fbcc6ef6580df7db0d98f677bb5097a7c420646d1eec44b89714a7c9c7f54e4abe6489192f85e1debccfa241e3cbed2ef0a7eab3f0864b7f008527ace8e0996
-SHA512 (zip2-6.0.0-filtered.tar.gz) = 31db89194ac1512a8afe14f817aed588666853001a9c8bac2d64f93e2b818cd2ff1b4b784bb149febdfe5fd63f0b089bf8dcca04c36b2810c41e285ddb5a684a
+SHA512 (zip-7.0.0.crate) = ef79949f6acb5e6d46f0458fb08fc465baab032e03b66af517c7db0812a33671cf12124e8a279521e072b83ae9d6ad74ca69a12541079e8b7d6db242e612f260
+SHA512 (zip2-7.0.0-filtered.tar.gz) = 68e02788edb45009430c808e79f89e0141082c883f13d653676152402ef54056af602721b388e4c0c186dcbc0c8d7699f476ecb7339b932cd9c48e6a669e65ad
diff --git a/zip-fix-metadata-auto.diff b/zip-fix-metadata-auto.diff
index 580f862..46c64ed 100644
--- a/zip-fix-metadata-auto.diff
+++ b/zip-fix-metadata-auto.diff
@@ -1,6 +1,6 @@
---- zip-6.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-6.0.0/Cargo.toml	2025-12-18T14:11:57.288488+00:00
-@@ -256,6 +256,3 @@
+--- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-08T21:12:30.103500+00:00
+@@ -267,6 +267,3 @@
  [dev-dependencies.walkdir]
  version = "2.5"
  
diff --git a/zip-fix-metadata.diff b/zip-fix-metadata.diff
index f58a6c6..de084f1 100644
--- a/zip-fix-metadata.diff
+++ b/zip-fix-metadata.diff
@@ -1,6 +1,6 @@
---- zip-6.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-6.0.0/Cargo.toml	2025-12-18T14:12:06.721249+00:00
-@@ -71,7 +71,6 @@
+--- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-08T21:12:43.954211+00:00
+@@ -72,7 +72,6 @@
      "deflate64",
      "deflate",
      "lzma",
@@ -8,29 +8,36 @@
      "time",
      "zstd",
      "xz",
-@@ -99,12 +98,8 @@
+@@ -93,10 +92,6 @@
+     "deflate-flate2",
+     "flate2/zlib-ng",
+ ]
+-deflate-flate2-zlib-ng-compat = [
+-    "deflate-flate2",
+-    "flate2/zlib-ng-compat",
+-]
+ deflate-flate2-zlib-rs = [
+     "deflate-flate2",
+     "flate2/zlib-rs",
+@@ -108,8 +103,6 @@
  jiff-02 = ["dep:jiff"]
  legacy-zip = ["bitstream-io"]
  lzma = ["dep:lzma-rust2"]
--lzma-static = ["lzma"]
 -nt-time = ["dep:nt-time"]
 -ppmd = ["dep:ppmd-rust"]
  unreserved = []
  xz = ["dep:lzma-rust2"]
--xz-static = ["lzma"]
  
- [lib]
- name = "zip"
-@@ -175,7 +170,7 @@
+@@ -165,7 +158,7 @@
+ default-features = false
+ 
+ [dependencies.generic-array]
+-version = "=0.14.7"
++version = "0.14.7"
  optional = true
  
- [dependencies.lzma-rust2]
--version = "0.13"
-+version = "0.15"
- features = [
-     "std",
-     "encoder",
-@@ -188,17 +183,8 @@
+ [dependencies.getrandom]
+@@ -199,17 +192,8 @@
  [dependencies.memchr]
  version = "2.7"
  
@@ -48,7 +55,7 @@
  optional = true
  
  [dependencies.sha1]
-@@ -225,20 +211,9 @@
+@@ -236,20 +220,9 @@
  optional = true
  default-features = false
  
@@ -69,7 +76,7 @@
      "std",
  ]
  
-@@ -253,6 +228,3 @@
+@@ -264,6 +237,3 @@
  ]
  default-features = false
  

From 2ddbb8fece2f44c2ae399d395629c1b5ab09d2fb Mon Sep 17 00:00:00 2001
From: "Benjamin A. Beasley" <code@musicinmybrain.net>
Date: Fri, 9 Jan 2026 22:12:51 +0000
Subject: [PATCH 5/5] Update constant_time_eq from 0.3.1 to 0.4.2

---
 rust-zip.spec              |  2 ++
 rust2rpm.toml              |  4 ++++
 zip-fix-metadata-auto.diff |  2 +-
 zip-fix-metadata.diff      | 11 ++++++++++-
 4 files changed, 17 insertions(+), 2 deletions(-)

diff --git a/rust-zip.spec b/rust-zip.spec
index efe3103..75c22f5 100644
--- a/rust-zip.spec
+++ b/rust-zip.spec
@@ -40,6 +40,8 @@ Patch:          zip-fix-metadata-auto.diff
 # * Unpin generic-array; see https://github.com/zip-rs/zip2/pull/458 for the
 #   upstream rationale, but we cannot use an old version and are not so
 #   concerned about deprecation warnings anyway.
+# * Update constant_time_eq from 0.3.1 to 0.4.2. Downstream-only for MSRV
+#   reasons.
 Patch:          zip-fix-metadata.diff
 # * Downstream-only: patch out tests that would need omitted test files to
 #   compile
diff --git a/rust2rpm.toml b/rust2rpm.toml
index d4dd7a0..c25ed64 100644
--- a/rust2rpm.toml
+++ b/rust2rpm.toml
@@ -25,6 +25,10 @@ cargo-toml-patch-comments = [
     upstream rationale, but we cannot use an old version and are not so \
     concerned about deprecation warnings anyway.\
     """,
+    """\
+    Update constant_time_eq from 0.3.1 to 0.4.2. Downstream-only for MSRV \
+    reasons.\
+    """,
 ]
 doc-files.exclude = ["pull_request_template.md"]
 exclude-crate-files = [
diff --git a/zip-fix-metadata-auto.diff b/zip-fix-metadata-auto.diff
index 46c64ed..d1d32f2 100644
--- a/zip-fix-metadata-auto.diff
+++ b/zip-fix-metadata-auto.diff
@@ -1,5 +1,5 @@
 --- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-7.0.0/Cargo.toml	2026-01-08T21:12:30.103500+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-09T22:11:25.991905+00:00
 @@ -267,6 +267,3 @@
  [dev-dependencies.walkdir]
  version = "2.5"
diff --git a/zip-fix-metadata.diff b/zip-fix-metadata.diff
index de084f1..d869273 100644
--- a/zip-fix-metadata.diff
+++ b/zip-fix-metadata.diff
@@ -1,5 +1,5 @@
 --- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-7.0.0/Cargo.toml	2026-01-08T21:12:43.954211+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-09T22:11:31.620816+00:00
 @@ -72,7 +72,6 @@
      "deflate64",
      "deflate",
@@ -28,6 +28,15 @@
  unreserved = []
  xz = ["dep:lzma-rust2"]
  
+@@ -149,7 +142,7 @@
+ optional = true
+ 
+ [dependencies.constant_time_eq]
+-version = "0.3.1"
++version = "0.4.2"
+ optional = true
+ 
+ [dependencies.crc32fast]
 @@ -165,7 +158,7 @@
  default-features = false