From f654908dfcbfe2a6ac359aec75f872f6769f5a3d Mon Sep 17 00:00:00 2001
From: Ihar Hrachyshka <ihar.hrachyshka@gmail.com>
Date: Sat, 25 Apr 2026 21:07:21 -0400
Subject: [PATCH] runzip: mark package as insecure

The package vendorized a (customized) old libzip version. Since the
library was customized, it's not easy to unvendorize it. We should
probably assume that CVEs that affected the old libzip version still
affect the package.
---
 pkgs/by-name/ru/runzip/package.nix | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/pkgs/by-name/ru/runzip/package.nix b/pkgs/by-name/ru/runzip/package.nix
index 1beae9283ca6..e03077e804bd 100644
--- a/pkgs/by-name/ru/runzip/package.nix
+++ b/pkgs/by-name/ru/runzip/package.nix
@@ -39,6 +39,11 @@ stdenv.mkDerivation (finalAttrs: {
     description = "Tool to convert filename encoding inside a ZIP archive";
     license = lib.licenses.bsd2;
     maintainers = [ lib.maintainers.raskin ];
+    # runzip vendors libzip 0.7.1.
+    knownVulnerabilities = [
+      "CVE-2015-2331"
+      "CVE-2017-14107"
+    ];
     platforms = lib.platforms.unix;
     mainProgram = "runzip";
   };