Security fixes, thread safety, and complete data provider actions

.gitlab-ci.yml

@@ -14,6 +14,7 @@ default:
 
 variables:
   REPO_NAME: module-zip
+  GIT_SUBMODULE_STRATEGY: recursive
 
 test-ubuntu:
   stage: test

CMakeLists.txt

@@ -59,6 +59,22 @@ set(MZ_BUILD_TESTS OFF CACHE BOOL "Disable minizip-ng tests" FORCE)
 set(MZ_BUILD_UNIT_TESTS OFF CACHE BOOL "Disable minizip-ng unit tests" FORCE)
 set(MZ_BUILD_FUZZ_TESTS OFF CACHE BOOL "Disable minizip-ng fuzz tests" FORCE)
 
+# Apply patches to minizip-ng before building
+# OpenSSL 3.2+ removed ENGINE API - apply compatibility patch
+if(EXISTS "${CMAKE_SOURCE_DIR}/patches/openssl-3.2-fix.patch")
+    execute_process(
+        COMMAND patch -p1 --forward -i "${CMAKE_SOURCE_DIR}/patches/openssl-3.2-fix.patch"
+        WORKING_DIRECTORY "${CMAKE_SOURCE_DIR}/src/minizip-ng"
+        RESULT_VARIABLE PATCH_RESULT
+        OUTPUT_QUIET
+        ERROR_QUIET
+    )
+    # Result 0 = success, 1 = already applied (treated as success), >1 = error (e.g., 2 for patch failure)
+    if(PATCH_RESULT GREATER 1)
+        message(WARNING "Failed to apply OpenSSL 3.2 compatibility patch (patch exit code: ${PATCH_RESULT})")
+    endif()
+endif()
+
 # Add minizip-ng subdirectory
 add_subdirectory(src/minizip-ng)
 

patches/openssl-3.2-fix.patch

@@ -0,0 +1,28 @@
+--- a/mz_crypt_openssl.c
++++ b/mz_crypt_openssl.c
+@@ -12,7 +12,10 @@
+ #include "mz_crypt.h"
+
+ #include <openssl/err.h>
+-#include <openssl/engine.h>
++/* ENGINE API deprecated in OpenSSL 3.0, removed in OpenSSL 3.2 */
++#if OPENSSL_VERSION_NUMBER < 0x30000000L
++#  include <openssl/engine.h>
++#endif
+ #include <openssl/rand.h>
+ #include <openssl/sha.h>
+ #include <openssl/aes.h>
+@@ -37,8 +40,12 @@ static void mz_crypt_init(void) {
+
+         ENGINE_load_builtin_engines();
+         ENGINE_register_all_complete();
+-#else
++#elif OPENSSL_VERSION_NUMBER < 0x30000000L
++        /* ENGINE API deprecated in OpenSSL 3.0, removed in OpenSSL 3.2 */
+         OPENSSL_init_crypto(OPENSSL_INIT_ENGINE_ALL_BUILTIN, NULL);
++#else
++        /* OpenSSL 3.0+: ENGINE API deprecated, use provider-based init */
++        OPENSSL_init_crypto(OPENSSL_INIT_LOAD_CONFIG, NULL);
+ #endif
+
+         openssl_initialized = 1;