Update constant_time_eq from 0.3.1 to 0.4.2

There is nothing actually wrong with these (they are in quoted strings,
and specifically in a part that is treated as a comment), but they make
shellcheck nervous.

[skip changelog]

.gitignore

@@ -5,3 +5,38 @@
 /zip-0.5.12.crate
 /zip-0.5.13.crate
 /zip-0.6.4.crate
+/zip-0.6.6.crate
+/zip-1.1.4.crate
+/zip2-1.1.4.tar.gz
+/zip-2.1.0.crate
+/zip2-2.1.0-filtered.tar.gz
+/zip-2.1.3.crate
+/zip2-2.1.3-filtered.tar.gz
+/zip-2.1.4.crate
+/zip2-2.1.4-filtered.tar.gz
+/zip-2.1.5.crate
+/zip2-2.1.5-filtered.tar.gz
+/zip-2.2.2.crate
+/zip2-2.2.2-filtered.tar.gz
+/zip-2.2.3.crate
+/zip2-2.2.3-filtered.tar.gz
+/zip-2.3.0.crate
+/zip2-2.3.0-filtered.tar.gz
+/zip-2.4.0.crate
+/zip2-2.4.0-filtered.tar.gz
+/zip-2.4.1.crate
+/zip2-2.4.1-filtered.tar.gz
+/zip-2.4.2.crate
+/zip2-2.4.2-filtered.tar.gz
+/zip-2.5.0.crate
+/zip2-2.5.0-filtered.tar.gz
+/zip-2.6.0.crate
+/zip2-2.6.0-filtered.tar.gz
+/zip-2.6.1.crate
+/zip2-2.6.1-filtered.tar.gz
+/zip-3.0.0.crate
+/zip2-3.0.0-filtered.tar.gz
+/zip-6.0.0.crate
+/zip2-6.0.0-filtered.tar.gz
+/zip-7.0.0.crate
+/zip2-7.0.0-filtered.tar.gz

get_test_data.sh

@@ -0,0 +1,171 @@
+#!/bin/sh
+set -o nounset
+set -o errexit
+
+FORGEURL='https://github.com/zip-rs/zip2'
+
+# These are test data files that have been audited for obvious issues. What
+# kind of issues might there be?
+#
+# - Acceptable license, but no license text
+# - No known license / presumed or explicitly proprietary
+# - Mysterious precompiled binaries
+#
+# Files we have determined we should *not* include:
+#
+# - chinese.zip:
+#   The single text file it contains, 七个房间.txt, contains a significant
+#   amount of narrative text in GB2312 encoding: some kind of story, or an
+#   excerpt from one, perhaps a work of fiction. It’s not clear what the origin
+#   is or what license, if any, might apply.
+# - lin-ub_iwd-v11.zip:
+#   LICENSE.lin-ub_iwd-v11.zip.txt clearly shows that this is at *best* not
+#   under a license acceptable in Fedora.
+# - omni.ja:
+#   This is a Firefox application resource bundle,
+#   https://udn.realityripple.com/docs/Mozilla/About_omni.ja_(formerly_omni.jar).
+#   It is very likely that everything in it is properly licensed for Fedora,
+#   but it is complex to audit, and we would rather not do all that work to
+#   confirm it’s OK when the alternative is just disabling a single test.
+# - pandoc_soft_links.zip:
+#   Contains a copy of pandoc 3.2 compiled for aarch64: pandoc itself is
+#   open-source, but who can say what was linked into it? The complete list of
+#   applicable licenses is not knowable.
+OK_FILES="$(grep -vE '^(#|$)' <<EOF
+# Contents are trivial: symlinks, zero-bytes files, sample text files
+# containing only a few words, etc.
+#
+# From the source for the applicable tests, the password is "helloworld":
+aes_archive.zip
+comment_garbage.zip
+data_descriptor.zip
+extended_timestamp.zip
+extended_timestamp_bad.zip
+files_and_dirs.zip
+linux-7z.zip
+mimetype.zip
+misaligned_comment.zip
+non_utf8.zip
+ntfs.zip
+ppmd.zip
+symlink.zip
+windows-7zip.zip
+xz.zip
+zip64_demo.zip
+zip64_magic_in_filename_1.zip
+zip64_magic_in_filename_2.zip
+zip64_magic_in_filename_4.zip
+zip64_magic_in_filename_5.zip
+
+# These are derived from the Project Gutenberg text of Shakespeare’s Hamlet,
+# https://www.gutenberg.org/cache/epub/1524/pg1524.txt. Both the play and the
+# print edition upon which the text is based are old enough to be unprotected
+# by copyright in the US, and probably worldwide. Fedora Legal has determined
+# that the “Project Gutenberg License” is “not a license” and content that is
+# actually in the public domain can be treated as such,
+# https://gitlab.com/fedora/legal/fedora-license-data/-/issues/676.
+legacy/implode_hamlet_2048.out
+legacy/implode_hamlet_256.bin
+legacy/implode_hamlet_256.out
+legacy/implode.zip
+legacy/reduce_hamlet_2048.bin
+legacy/reduce_zero_reduced.bin
+legacy/reduce.zip
+legacy/shrink.zip
+
+# The interesting part here is the file binary.wmv, which is a bit over a
+# minute of spoken-word audio from some kind of talk or lecture. Upstream
+# claims (via folder/LICENSE.binary.wmv.txt) that the license is MIT. The text
+# file first.txt is taken from Project Gutenberg text of Shakespeare’s Hamlet,
+# discussed above.
+deflate64.zip
+folder/LICENSE.binary.wmv.txt
+folder/binary.wmv
+folder/first.txt
+lzma.zip
+
+# These don’t unzip with the "unzip" tool or the "7z" tool, so they are
+# difficult to audit, but their sizes are only from a few dozen to a few
+# hundred bytes, so we assume their contents are very likely to be
+# unproblematic.
+#
+deflate64_issue_25.zip
+ignore_encryption_flag.zip
+invalid_cde_number_of_files_allocation_greater_offset.zip
+invalid_cde_number_of_files_allocation_smaller_offset.zip
+invalid_offset.zip
+invalid_offset2.zip
+raw_deflate64_index_out_of_bounds.zip
+zip64_magic_in_filename_3.zip
+EOF
+)"
+
+
+print_help()
+{
+	cat <<EOF
+Usage: $1 VERSION
+
+Generate a copy of the GitHub source archive for zip-rs/zip2, with everything
+but the test/data/ subdirectory removed, and additionally, in which only test
+data files that have been audited for obvious license issues are included.  The
+result will be named zip2-\${VERSION}-filtered.tar.gz and will be written into
+the current working directory.
+EOF
+}
+
+if [ "$#" != '1' ]
+then
+	exec 1>&2
+	print_help "${0}"
+	exit 1
+elif [ "${1-}" = '-h' ] || [ "${1-}" = '--help' ]
+then
+	print_help "${0}"
+	exit 0
+fi
+
+VERSION="${1}"
+SOURCE0="${FORGEURL}/archive/v${VERSION}/zip2-${VERSION}.tar.gz"
+TARNAME="$(basename "${SOURCE0}")"
+TARDIR="$(basename "${SOURCE0}" '.tar.gz')"
+NEWTAR="${TARDIR}-filtered.tar.gz"
+
+SAVEDIR="${PWD}"
+XDIR="$(mktemp -d)"
+trap "rm -rf '${XDIR}'" INT TERM EXIT
+
+cd "${XDIR}"
+curl -L -O "${SOURCE0}"
+tar -xzf "${TARNAME}"
+MTIME="$(stat -c '%Y' "${TARDIR}")"
+# Remove everything but tests/data
+find "${TARDIR}" -mindepth 1 -maxdepth 1 ! -name tests -execdir rm -r '{}' '+'
+find "${TARDIR}/tests" -mindepth 1 -maxdepth 1 ! -name data \
+    -execdir rm -r '{}' '+'
+# Empty tests/data (keeping the files in a duplicate tree), then move the files
+# we want back in.
+cp -lrp "${TARDIR}/tests/data" data_unfiltered
+find "${TARDIR}/tests/data" -type f -delete
+echo "${OK_FILES}" | while read -r fn
+do
+  mkdir -p "${TARDIR}/tests/data/$(dirname "${fn}")"
+  mv "data_unfiltered/${fn}" "${TARDIR}/tests/data/${fn}"
+done
+# https://www.gnu.org/software/tar/manual/html_section/Reproducibility.html
+# We reset all mtimes to that of the top-level extracted directory; since git
+# archives don’t have meaningful per-file mtimes, nothing useful is lost.
+TZ=UTC LC_ALL=C tar \
+    --create --verbose \
+    --sort=name \
+    --format=posix \
+    --numeric-owner --owner=0 --group=0 \
+    --mode=go+u,go-w \
+    --pax-option='delete=atime,delete=ctime' \
+    --clamp-mtime --mtime="@${MTIME}" \
+    "${TARDIR}/" |
+  gzip -9 > "${NEWTAR}"
+touch -d @"${MTIME}" "${NEWTAR}"
+
+cd "${SAVEDIR}"
+mv -v "${XDIR}/${NEWTAR}" .

rust-zip.spec

@@ -1,23 +1,53 @@
-# Generated by rust2rpm 24
-%bcond_without check
+# Generated by rust2rpm 28
+%bcond check 1
 %global debug_package %{nil}
 
 %global crate zip
 
 Name:           rust-zip
-Version:        0.6.4
+Version:        7.0.0
 Release:        %autorelease
 Summary:        Library to support the reading and writing of zip files
 
 License:        MIT
 URL:            https://crates.io/crates/zip
 Source:         %{crates_source}
+# * A copy of the GitHub source archive for zip-rs/zip2, with everything but the
+#   test/data/ subdirectory removed, and additionally, from which test files
+#   with known license issues have been removed. Fortunately, no removed test
+#   files are required for any of the tests that are present in the published
+#   crates.
+Source10:       zip2-%{version}-filtered.tar.gz
+# * Script used to generate Source11: ./get_test_data.sh %%{version}
+Source11:       get_test_data.sh
+# Automatically generated patch to strip dependencies and normalize metadata
+Patch:          zip-fix-metadata-auto.diff
 # Manually created patch for downstream crate metadata changes
-# * bump constant_time_eq dependency from 0.1 to 0.2
-# * bump zstd dependency from 0.11 to 0.12
+# * Drop unused benchmark-only / example-only dev-dependencies
+# * Remove the wasm_js feature from the getrandom dev-dependency. Our
+#   rust-getrandom does not provide this feature; see also “Unconditional use of
+#   getrandom’s wasm_js feature is counter to upstream guidance,”
+#   https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the
+#   dependency since 4.3.0, but not yet for the dev-dependency.
+# * Patch out the nt-time features; rust-nt-time not yet packaged
+# * Patch out ppmd support, even though it is in the default features. While the
+#   README.md for the ppmd-rust crate says “The code in this crate is in the
+#   public domain as the original code by their authors,” Cargo.toml lists the
+#   license as CC0-1.0, which is not precisely equivalent to the public-domain
+#   declaration in the README and is not-allowed for code in Fedora.
+# * Patch out the deflate-flate2-zlib-ng-compat feature, which requires
+#   flate2/zlib-ng-compat, not packaged.
+# * Unpin generic-array; see https://github.com/zip-rs/zip2/pull/458 for the
+#   upstream rationale, but we cannot use an old version and are not so
+#   concerned about deprecation warnings anyway.
+# * Update constant_time_eq from 0.3.1 to 0.4.2. Downstream-only for MSRV
+#   reasons.
 Patch:          zip-fix-metadata.diff
+# * Downstream-only: patch out tests that would need omitted test files to
+#   compile
+Patch10:        zip-6.0.0-omitted-test-files.patch
 
-BuildRequires:  rust-packaging >= 21
+BuildRequires:  cargo-rpm-macros >= 24
 
 %global _description %{expand:
 Library to support the reading and writing of zip files.}
@@ -37,8 +67,13 @@ use the "%{crate}" crate.
 %license %{crate_instdir}/LICENSE
 %doc %{crate_instdir}/CHANGELOG.md
 %doc %{crate_instdir}/CODE_OF_CONDUCT.md
+%doc %{crate_instdir}/CONTRIBUTING.md
 %doc %{crate_instdir}/README.md
+%doc %{crate_instdir}/SECURITY.md
 %{crate_instdir}/
+%exclude %{crate_instdir}/cliff.toml
+%exclude %{crate_instdir}/pull_request_template.md
+%exclude %{crate_instdir}/release-plz.toml
 
 %package     -n %{name}+default-devel
 Summary:        %{summary}
@@ -52,16 +87,28 @@ use the "default" feature of the "%{crate}" crate.
 %files       -n %{name}+default-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+aes-devel
+%package     -n %{name}+_all-features-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+aes-devel %{_description}
+%description -n %{name}+_all-features-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "aes" feature of the "%{crate}" crate.
+use the "_all-features" feature of the "%{crate}" crate.
 
-%files       -n %{name}+aes-devel
+%files       -n %{name}+_all-features-devel
+%ghost %{crate_instdir}/Cargo.toml
+
+%package     -n %{name}+_deflate-any-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+_deflate-any-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "_deflate-any" feature of the "%{crate}" crate.
+
+%files       -n %{name}+_deflate-any-devel
 %ghost %{crate_instdir}/Cargo.toml
 
 %package     -n %{name}+aes-crypto-devel
@@ -76,6 +123,18 @@ use the "aes-crypto" feature of the "%{crate}" crate.
 %files       -n %{name}+aes-crypto-devel
 %ghost %{crate_instdir}/Cargo.toml
 
+%package     -n %{name}+bitstream-io-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+bitstream-io-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "bitstream-io" feature of the "%{crate}" crate.
+
+%files       -n %{name}+bitstream-io-devel
+%ghost %{crate_instdir}/Cargo.toml
+
 %package     -n %{name}+bzip2-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -88,16 +147,16 @@ use the "bzip2" feature of the "%{crate}" crate.
 %files       -n %{name}+bzip2-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+constant_time_eq-devel
+%package     -n %{name}+chrono-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+constant_time_eq-devel %{_description}
+%description -n %{name}+chrono-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "constant_time_eq" feature of the "%{crate}" crate.
+use the "chrono" feature of the "%{crate}" crate.
 
-%files       -n %{name}+constant_time_eq-devel
+%files       -n %{name}+chrono-devel
 %ghost %{crate_instdir}/Cargo.toml
 
 %package     -n %{name}+deflate-devel
@@ -112,76 +171,112 @@ use the "deflate" feature of the "%{crate}" crate.
 %files       -n %{name}+deflate-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+deflate-miniz-devel
+%package     -n %{name}+deflate-flate2-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+deflate-miniz-devel %{_description}
+%description -n %{name}+deflate-flate2-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "deflate-miniz" feature of the "%{crate}" crate.
+use the "deflate-flate2" feature of the "%{crate}" crate.
 
-%files       -n %{name}+deflate-miniz-devel
+%files       -n %{name}+deflate-flate2-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+deflate-zlib-devel
+%package     -n %{name}+deflate-flate2-zlib-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+deflate-zlib-devel %{_description}
+%description -n %{name}+deflate-flate2-zlib-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "deflate-zlib" feature of the "%{crate}" crate.
+use the "deflate-flate2-zlib" feature of the "%{crate}" crate.
 
-%files       -n %{name}+deflate-zlib-devel
+%files       -n %{name}+deflate-flate2-zlib-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+flate2-devel
+%package     -n %{name}+deflate-flate2-zlib-ng-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+flate2-devel %{_description}
+%description -n %{name}+deflate-flate2-zlib-ng-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "flate2" feature of the "%{crate}" crate.
+use the "deflate-flate2-zlib-ng" feature of the "%{crate}" crate.
 
-%files       -n %{name}+flate2-devel
+%files       -n %{name}+deflate-flate2-zlib-ng-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+hmac-devel
+%package     -n %{name}+deflate-flate2-zlib-rs-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+hmac-devel %{_description}
+%description -n %{name}+deflate-flate2-zlib-rs-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "hmac" feature of the "%{crate}" crate.
+use the "deflate-flate2-zlib-rs" feature of the "%{crate}" crate.
 
-%files       -n %{name}+hmac-devel
+%files       -n %{name}+deflate-flate2-zlib-rs-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+pbkdf2-devel
+%package     -n %{name}+deflate-zopfli-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+pbkdf2-devel %{_description}
+%description -n %{name}+deflate-zopfli-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "pbkdf2" feature of the "%{crate}" crate.
+use the "deflate-zopfli" feature of the "%{crate}" crate.
 
-%files       -n %{name}+pbkdf2-devel
+%files       -n %{name}+deflate-zopfli-devel
 %ghost %{crate_instdir}/Cargo.toml
 
-%package     -n %{name}+sha1-devel
+%package     -n %{name}+deflate64-devel
 Summary:        %{summary}
 BuildArch:      noarch
 
-%description -n %{name}+sha1-devel %{_description}
+%description -n %{name}+deflate64-devel %{_description}
 
 This package contains library source intended for building other packages which
-use the "sha1" feature of the "%{crate}" crate.
+use the "deflate64" feature of the "%{crate}" crate.
 
-%files       -n %{name}+sha1-devel
+%files       -n %{name}+deflate64-devel
+%ghost %{crate_instdir}/Cargo.toml
+
+%package     -n %{name}+jiff-02-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+jiff-02-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "jiff-02" feature of the "%{crate}" crate.
+
+%files       -n %{name}+jiff-02-devel
+%ghost %{crate_instdir}/Cargo.toml
+
+%package     -n %{name}+legacy-zip-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+legacy-zip-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "legacy-zip" feature of the "%{crate}" crate.
+
+%files       -n %{name}+legacy-zip-devel
+%ghost %{crate_instdir}/Cargo.toml
+
+%package     -n %{name}+lzma-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+lzma-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "lzma" feature of the "%{crate}" crate.
+
+%files       -n %{name}+lzma-devel
 %ghost %{crate_instdir}/Cargo.toml
 
 %package     -n %{name}+time-devel
@@ -208,6 +303,18 @@ use the "unreserved" feature of the "%{crate}" crate.
 %files       -n %{name}+unreserved-devel
 %ghost %{crate_instdir}/Cargo.toml
 
+%package     -n %{name}+xz-devel
+Summary:        %{summary}
+BuildArch:      noarch
+
+%description -n %{name}+xz-devel %{_description}
+
+This package contains library source intended for building other packages which
+use the "xz" feature of the "%{crate}" crate.
+
+%files       -n %{name}+xz-devel
+%ghost %{crate_instdir}/Cargo.toml
+
 %package     -n %{name}+zstd-devel
 Summary:        %{summary}
 BuildArch:      noarch
@@ -221,21 +328,23 @@ use the "zstd" feature of the "%{crate}" crate.
 %ghost %{crate_instdir}/Cargo.toml
 
 %prep
-%autosetup -n %{crate}-%{version_no_tilde} -p1
+%autosetup -n %{crate}-%{version} -p1
 %cargo_prep
 
 %generate_buildrequires
-%cargo_generate_buildrequires
+%cargo_generate_buildrequires -a
 
 %build
-%cargo_build
+%cargo_build -a
 
 %install
-%cargo_install
+%cargo_install -a
 
 %if %{with check}
 %check
-%cargo_test
+# Extract test data (only) from the GitHub archive
+tar -xzvf '%{SOURCE10}' --strip-components=1 'zip2-%{version}/tests/data/'
+%cargo_test -a
 %endif
 
 %changelog

rust2rpm.toml

@@ -0,0 +1,76 @@
+[package]
+cargo-toml-patch-comments = [
+    "Drop unused benchmark-only / example-only dev-dependencies",
+    """\
+    Remove the wasm_js feature from the getrandom dev-dependency. Our \
+    rust-getrandom does not provide this feature; see also “Unconditional use of \
+    getrandom’s wasm_js feature is counter to upstream guidance,” \
+    https://github.com/zip-rs/zip2/issues/336. Upstream fixed the issue for the \
+    dependency since 4.3.0, but not yet for the dev-dependency.\
+    """,
+    "Patch out the nt-time features; rust-nt-time not yet packaged",
+    """\
+    Patch out ppmd support, even though it is in the default features. While \
+    the README.md for the ppmd-rust crate says “The code in this crate is in the \
+    public domain as the original code by their authors,” Cargo.toml lists the \
+    license as CC0-1.0, which is not precisely equivalent to the public-domain \
+    declaration in the README and is not-allowed for code in Fedora.\
+    """,
+    """\
+    Patch out the deflate-flate2-zlib-ng-compat feature, which requires \
+    flate2/zlib-ng-compat, not packaged.\
+    """,
+    """\
+    Unpin generic-array; see https://github.com/zip-rs/zip2/pull/458 for the \
+    upstream rationale, but we cannot use an old version and are not so \
+    concerned about deprecation warnings anyway.\
+    """,
+    """\
+    Update constant_time_eq from 0.3.1 to 0.4.2. Downstream-only for MSRV \
+    reasons.\
+    """,
+]
+doc-files.exclude = ["pull_request_template.md"]
+exclude-crate-files = [
+    "cliff.toml",
+    "pull_request_template.md",
+    "release-plz.toml",
+]
+
+[[package.extra-sources]]
+number = 10
+file = "zip2-%{version}-filtered.tar.gz"
+comments = [
+    """\
+    A copy of the GitHub source archive for zip-rs/zip2, with everything but the \
+    test/data/ subdirectory removed, and additionally, from which test files with \
+    known license issues have been removed. Fortunately, no removed test files \
+    are required for any of the tests that are present in the published crates.\
+    """,
+]
+[[package.extra-sources]]
+number = 11
+file = "get_test_data.sh"
+comments = [
+    "Script used to generate Source11: ./get_test_data.sh %%{version}"
+]
+
+[[package.extra-patches]]
+number = 10
+file = "zip-6.0.0-omitted-test-files.patch"
+comments = [
+    """\
+    Downstream-only: patch out tests that would need omitted test files to \
+    compile\
+    """,
+]
+
+[features]
+enable-all = true
+
+[scripts]
+check.pre = [
+    "# Extract test data (only) from the GitHub archive",
+    "tar -xzvf '%{SOURCE10}' --strip-components=1 'zip2-%{version}/tests/data/'",
+]
+

sources

@@ -1 +1,2 @@
-SHA512 (zip-0.6.4.crate) = 29392175711fb8585d400f99798596e10415423b3fda245069ca3144bce4b1027db845526c233bcf8be13b756e9605df21657bd2b5713339adeb334fe964ff8e
+SHA512 (zip-7.0.0.crate) = ef79949f6acb5e6d46f0458fb08fc465baab032e03b66af517c7db0812a33671cf12124e8a279521e072b83ae9d6ad74ca69a12541079e8b7d6db242e612f260
+SHA512 (zip2-7.0.0-filtered.tar.gz) = 68e02788edb45009430c808e79f89e0141082c883f13d653676152402ef54056af602721b388e4c0c186dcbc0c8d7699f476ecb7339b932cd9c48e6a669e65ad

zip-6.0.0-omitted-test-files.patch

@@ -0,0 +1,21 @@
+diff -Naur zip-6.0.0-original/src/read.rs zip-6.0.0/src/read.rs
+--- zip-6.0.0-original/src/read.rs	2006-07-24 02:21:28.000000000 +0100
++++ zip-6.0.0/src/read.rs	2025-12-17 11:48:28.449459541 +0000
+@@ -2316,6 +2316,8 @@
+ 
+     #[test]
+     #[cfg(feature = "deflate-flate2")]
++    // Downstream patch: we do not include the test file needed for this test.
++    #[cfg(any())]
+     fn test_utf8_extra_field() {
+         let mut reader =
+             ZipArchive::new(Cursor::new(include_bytes!("../tests/data/chinese.zip"))).unwrap();
+@@ -2399,6 +2401,8 @@
+     }
+ 
+     #[test]
++    // Downstream patch: we do not include the test file needed for this test.
++    #[cfg(any())]
+     fn test_central_directory_not_at_end() -> ZipResult<()> {
+         let mut reader = ZipArchive::new(Cursor::new(include_bytes!("../tests/data/omni.ja")))?;
+         let mut file = reader.by_name("chrome.manifest")?;

zip-fix-metadata-auto.diff

@@ -0,0 +1,9 @@
+--- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-09T22:11:25.991905+00:00
+@@ -267,6 +267,3 @@
+ [dev-dependencies.walkdir]
+ version = "2.5"
+ 
+-[target."cfg(fuzzing)".dependencies.arbitrary]
+-version = "1.4.1"
+-features = ["derive"]

zip-fix-metadata.diff

@@ -1,20 +1,94 @@
---- zip-0.6.4/Cargo.toml	1970-01-01T00:00:01+00:00
-+++ zip-0.6.4/Cargo.toml	2023-04-15T11:49:45.631984+00:00
-@@ -49,7 +49,7 @@
+--- zip-7.0.0/Cargo.toml	1970-01-01T00:00:01+00:00
++++ zip-7.0.0/Cargo.toml	2026-01-09T22:11:31.620816+00:00
+@@ -72,7 +72,6 @@
+     "deflate64",
+     "deflate",
+     "lzma",
+-    "ppmd",
+     "time",
+     "zstd",
+     "xz",
+@@ -93,10 +92,6 @@
+     "deflate-flate2",
+     "flate2/zlib-ng",
+ ]
+-deflate-flate2-zlib-ng-compat = [
+-    "deflate-flate2",
+-    "flate2/zlib-ng-compat",
+-]
+ deflate-flate2-zlib-rs = [
+     "deflate-flate2",
+     "flate2/zlib-rs",
+@@ -108,8 +103,6 @@
+ jiff-02 = ["dep:jiff"]
+ legacy-zip = ["bitstream-io"]
+ lzma = ["dep:lzma-rust2"]
+-nt-time = ["dep:nt-time"]
+-ppmd = ["dep:ppmd-rust"]
+ unreserved = []
+ xz = ["dep:lzma-rust2"]
+ 
+@@ -149,7 +142,7 @@
  optional = true
  
  [dependencies.constant_time_eq]
--version = "0.1.5"
-+version = "0.2"
+-version = "0.3.1"
++version = "0.4.2"
  optional = true
  
  [dependencies.crc32fast]
-@@ -80,7 +80,7 @@
+@@ -165,7 +158,7 @@
  default-features = false
  
- [dependencies.zstd]
--version = "0.11.2"
-+version = "0.12"
+ [dependencies.generic-array]
+-version = "=0.14.7"
++version = "0.14.7"
  optional = true
  
- [dev-dependencies.bencher]
+ [dependencies.getrandom]
+@@ -199,17 +192,8 @@
+ [dependencies.memchr]
+ version = "2.7"
+ 
+-[dependencies.nt-time]
+-version = "0.10.6"
+-optional = true
+-default-features = false
+-
+ [dependencies.pbkdf2]
+ version = "0.12"
+-optional = true
+-
+-[dependencies.ppmd-rust]
+-version = "1.2"
+ optional = true
+ 
+ [dependencies.sha1]
+@@ -236,20 +220,9 @@
+ optional = true
+ default-features = false
+ 
+-[dev-dependencies.anyhow]
+-version = "1.0.95"
+-
+-[dev-dependencies.bencher]
+-version = "0.1.5"
+-
+-[dev-dependencies.clap]
+-version = "=4.4.18"
+-features = ["derive"]
+-
+ [dev-dependencies.getrandom]
+ version = "0.3.1"
+ features = [
+-    "wasm_js",
+     "std",
+ ]
+ 
+@@ -264,6 +237,3 @@
+ ]
+ default-features = false
+ 
+-[dev-dependencies.walkdir]
+-version = "2.5"
+-