Info-ZIP Zip 3.0 and UnZip 6.0 for OpenVMS VAX 7.3
==================================================

Altered builds of the Info-ZIP programs (the version banner says so; see
"Licence" below).  Built on 13-OCT-2026 on a VAXstation 4000/90 (VAX90) with
Compaq C V6.4-005 and the DCL builders that Info-ZIP ships (BUILD_UNZIP.COM,
BUILD_ZIP.COM).  Douglas P. Fields, Jr. (symbolics@lisp.engineer).

What is in the kit (installed in SYS$COMMON:[SYSLIB.INFOZIP])
-------------------------------------------------------------
  ZIP.EXE ZIPCLOAK.EXE ZIPNOTE.EXE ZIPSPLIT.EXE      Zip 3.0 (5-JUL-2008)
  UNZIP.EXE UNZIPSFX.EXE                             UnZip 6.0 (20-APR-2009)
  ZIP_CLI.EXE UNZIP_CLI.EXE UNZIPSFX_CLI.EXE         the same with VMS qualifiers
  ZIP_MSG.EXE UNZIP_MSG.EXE                          message files (%IZ_ZIP-..)
  INFOZIP.HLB INFOZIP_VMS.HLB                        help libraries
  INFOZIP_SETUP.COM                                  defines the commands
  [.DOC]       the Info-ZIP documents, licences and VMS notes
  [.PATCHES]   the 34 patches that were applied, PATCHES.TXT (what each is)
  [.SRC]       the complete patched sources as built
  [.BUILD]     the build procedures and the logs of the build
  [.EXAMPLES]  RUN_TESTS.COM and its data; examples ZIPDIR.COM (zip a tree with -V),
               UNZIPALL.COM, SHOWATTR.COM, RMTREE.COM, HERO.COM (the blog picture)

Install and remove (as SYSTEM, files next to each other)
--------------------------------------------------------
  $ @INFOZIP_INSTALL [saveset] [REPLACE]   restores the saveset into SYS$COMMON:[SYSLIB.INFOZIP],
                                           writes INFOZIP_MANIFEST.LIS, smoke-tests it
  $ @INFOZIP_UNINSTALL [CHECK]             removes exactly the files in the manifest that are
                                           unchanged; a changed file is kept; CHECK changes nothing
It changes nothing outside that directory (no startup file, SYSUAF, DCLTABLES or logical name).

Use (each user, once per login or from LOGIN.COM)
-------------------------------------------------
  $ @SYS$COMMON:[SYSLIB.INFOZIP]INFOZIP_SETUP
  $ ZIP "-V" -r -q BACKUP.ZIP [...]*.*       $ UNZIP -l BACKUP.ZIP
  $ UNZIP "-V" BACKUP.ZIP                    $ ZIPINFO BACKUP.ZIP
  $ UNZIP_VMS /LIST BACKUP.ZIP               $ ZIP_VMS /VMS BACKUP.ZIP *.*
  $ HELP/LIBRARY=INFOZIP_BIN:INFOZIP UNZIP
Commands: ZIP UNZIP ZIPINFO ZIPCLOAK ZIPNOTE ZIPSPLIT (UNIX-style options) and
ZIP_VMS UNZIP_VMS (VMS qualifiers).

On a VAX, DCL makes an unquoted argument lower case and there is no C run-time switch
that keeps the case: write upper-case options in double quotes: "-V" (keep VMS file
attributes), "-P" (password), "-Z" (use ZIPINFO instead).  Without -V, a file comes back
as a plain Stream_LF file, so a BACKUP saveset, a fixed-512 file or an indexed file is
damaged; with -V it comes back with every attribute (organisation, record format,
key definitions, creation date).  -a converts text files to VMS variable-length records.

Tests
-----
  $ @SYS$COMMON:[SYSLIB.INFOZIP.EXAMPLES]RUN_TESTS [KEEP] [saveset]
works in SYS$SCRATCH:[.IZTEST_<pid>], needs no privilege, deletes what it made, and
ends with "RUN_TESTS: PASS n of n".

Security fixes
--------------
The kit contains Debian's fixes for UnZip 6.0 (27 patches) and Zip 3.0 (5 patches), taken
from Debian unzip 6.0-31 and zip 3.0-16; PATCHES.TXT lists each one with the CVE id and
text of its own header.  CVE-2021-4217 (a null pointer dereference in the Unicode string
handling) is NOT fixed: no patch exists (Debian rates it "unimportant").  Do not use these
programs on archives from sources you do not trust more than you would use the originals.

Licence
-------
Info-ZIP license (UnZip: version 2009-Jan-02; Zip: 2007-Mar-4), in [.DOC]UNZIP_LICENSE.TXT and
[.DOC]ZIP_LICENSE.TXT.  These are ALTERED versions in the sense of its section 3: patches
were applied and the build was made for OpenVMS VAX by us, not by Info-ZIP; the version dates
printed by "unzip -v" and "zip -v" say "altered build with security patches".  The name
"Info-ZIP" in the directory and kit names states where the programs come from; Info-ZIP does
not support this build, and problems should not be reported to Info-ZIP.  The source
is in [.SRC]; SOURCES.TXT gives its origin and hashes.