diff --git a/zip/.signature b/zip/.signature
index bb20a35f8..edb87e4ff 100644
--- a/zip/.signature
+++ b/zip/.signature
@@ -1,5 +1,12 @@
 untrusted comment: verify with /etc/ports/opt.pub
-RWSE3ohX2g5d/Q53W0gs2QQJmswNsHMpKgEhQoJiWHwYsoqHMDnUhVBbuj5wbjpSt9urDnTETgbPiTofsgj3nAlgiQOMaPCsJAs=
-SHA256 (Pkgfile) = d8d12acab81c38dde5216c9b27a63eb56524bcf12e2cb7a760b3e451605f5147
+RWSE3ohX2g5d/aFZpFocFUEjEvFwgcRikR0kIrqLgzTdKq9VkEtBLYFr6mcqiFU/tMTfr3aoCIQf/5LP/UxmrsZ+5if5+ySNoQ4=
+SHA256 (Pkgfile) = aea75f270fff6664c376e6d7248e429f47dd9e4be3638a9e99dc15cfa1cd95fa
 SHA256 (.footprint) = 7e128e0a910cd361b3d50b36d155016a1e368456fac92d076f1d7b8d6f320d34
 SHA256 (zip30.tar.gz) = f0e8bb1f9b7eb0b01285495a2699df3a4b766784c1765a8f1aeedf63c0806369
+SHA256 (zipnote.patch) = 89249a3f1fdf838b795ce432a2d763fdbe913d6a146541e41b7a2e2769291ba0
+SHA256 (zip-3.0-no-crypt.patch) = 32d263c492dbc2b37b71d0aa80e566283422e8e6493d91f8aa12946d6d587a4a
+SHA256 (zip-3.0-pic.patch) = afca923887828f6ccdcb98bcb1130f138d014614ca49c2a2526bd0fdc91dda6e
+SHA256 (zip-3.0-currdir.patch) = 44cac3d4e8b447988b6e4eeb4bb6e701110cedfb09ea49eac471011328c8acab
+SHA256 (zip-3.0-exec-shield.patch) = 10f0f3756a2415e33edf1455373b322404962b743b3a52a757b669e47dd7f1b2
+SHA256 (zip-gnu89-build.patch) = 74c767b5c6699c0fbb1649c93182d6aa89d595e115444cb67a3d380009fe7c1c
+SHA256 (zip-3.0-format-security.patch) = 3759134487afad9c63e2e9693aa05b9dcc67f55a9ef961e82074b587b094292a
diff --git a/zip/Pkgfile b/zip/Pkgfile
index e8f7908e4..77a2cdf80 100644
--- a/zip/Pkgfile
+++ b/zip/Pkgfile
@@ -6,10 +6,27 @@
 name=zip
 version=3.0
 release=2
-source=(https://downloads.sourceforge.net/sourceforge/infozip/${name}${version//./}.tar.gz)
+source=(https://downloads.sourceforge.net/sourceforge/infozip/${name}${version//./}.tar.gz
+    zipnote.patch
+    zip-3.0-no-crypt.patch
+    zip-3.0-pic.patch
+    zip-3.0-currdir.patch
+    zip-3.0-exec-shield.patch
+    zip-gnu89-build.patch
+    zip-3.0-format-security.patch)
 
 build() {
     cd ${name}${version//./}
-    make -f unix/Makefile LOCAL_ZIP="$CFLAGS" prefix=/usr generic
+
+    patch -Np1 -i $SRC/zip-3.0-format-security.patch
+    patch -Np1 -i $SRC/zip-3.0-exec-shield.patch
+    patch -Np1 -i $SRC/zip-3.0-currdir.patch
+    patch -Np1 -i $SRC/zipnote.patch
+    patch -Np1 -i $SRC/zip-3.0-pic.patch
+    patch -Np1 -i $SRC/zip-3.0-no-crypt.patch
+    patch -Np1 -i $SRC/zip-gnu89-build.patch
+
+
+    make -f unix/Makefile LOCAL_ZIP="$CFLAGS" prefix=/usr generic_gcc
     make -f unix/Makefile INSTALL=install prefix=$PKG/usr MANDIR=$PKG/usr/share/man/man1 install
 }
diff --git a/zip/zip-3.0-currdir.patch b/zip/zip-3.0-currdir.patch
new file mode 100644
index 000000000..40da32e7a
--- /dev/null
+++ b/zip/zip-3.0-currdir.patch
@@ -0,0 +1,12 @@
+diff -up zip30/util.c.currdir zip30/util.c
+--- zip30/util.c.currdir	2009-11-16 12:42:17.783961701 +0100
++++ zip30/util.c	2009-11-16 12:42:58.185960707 +0100
+@@ -493,6 +493,8 @@ int cs;                 /* force case-se
+ /* Compare the sh pattern p with the string s and return true if they match,
+    false if they don't or if there is a syntax error in the pattern. */
+ {
++  while (s[0] == '.' && s[1] == '/') 
++    s += 2;                /* strip redundant leading "./" sections */
+   return recmatch(p, s, cs) == 1;
+ }
+ 
diff --git a/zip/zip-3.0-exec-shield.patch b/zip/zip-3.0-exec-shield.patch
new file mode 100644
index 000000000..05c1a6c49
--- /dev/null
+++ b/zip/zip-3.0-exec-shield.patch
@@ -0,0 +1,20 @@
+diff -up zip30/crc_i386.S.exec_shield zip30/crc_i386.S
+--- zip30/crc_i386.S.exec_shield	2009-11-13 18:37:45.000000000 +0100
++++ zip30/crc_i386.S	2009-11-13 18:39:54.435390166 +0100
+@@ -302,3 +302,6 @@ _crc32:                         /* ulg c
+ #endif /* i386 || _i386 || _I386 || __i386 */
+ 
+ #endif /* !USE_ZLIB && !CRC_TABLE_ONLY */
++
++.section .note.GNU-stack, "", @progbits
++.previous
+diff -up zip30/match.S.exec_shield zip30/match.S
+--- zip30/match.S.exec_shield	2005-01-28 10:40:14.000000000 +0100
++++ zip30/match.S	2009-11-13 18:39:48.570389058 +0100
+@@ -405,3 +405,6 @@ L__return:
+ #endif /* i386 || _I386 || _i386 || __i386  */
+ 
+ #endif /* !USE_ZLIB */
++
++.section .note.GNU-stack, "", @progbits
++.previous
diff --git a/zip/zip-3.0-format-security.patch b/zip/zip-3.0-format-security.patch
new file mode 100644
index 000000000..54ce2e662
--- /dev/null
+++ b/zip/zip-3.0-format-security.patch
@@ -0,0 +1,20 @@
+--- a/zip.c	
++++ a/zip.c	
+@@ -1028,7 +1028,7 @@ local void help_extended()
+ 
+   for (i = 0; i < sizeof(text)/sizeof(char *); i++)
+   {
+-    printf(text[i]);
++    printf("%s", text[i]);
+     putchar('\n');
+   }
+ #ifdef DOS
+@@ -1225,7 +1225,7 @@ local void version_info()
+             CR_MAJORVER, CR_MINORVER, CR_BETA_VER, CR_VERSION_DATE);
+   for (i = 0; i < sizeof(cryptnote)/sizeof(char *); i++)
+   {
+-    printf(cryptnote[i]);
++    printf("%s", cryptnote[i]);
+     putchar('\n');
+   }
+   ++i;  /* crypt support means there IS at least one compilation option */
diff --git a/zip/zip-3.0-no-crypt.patch b/zip/zip-3.0-no-crypt.patch
new file mode 100644
index 000000000..9a1302c1b
--- /dev/null
+++ b/zip/zip-3.0-no-crypt.patch
@@ -0,0 +1,57 @@
+fix building when NO_CRYPT is used
+
+forward ported from zip-2.32
+
+http://bugs.gentoo.org/238398
+
+--- a/zip.c
++++ b/zip.c
+@@ -3452,6 +3452,9 @@ char **argv;            /* command line tokens */
+ 
+   /* Key not yet specified.  If needed, get/verify it now. */
+   if (key_needed) {
++#if !CRYPT
++    ZIPERR(ZE_PARMS, "encryption not supported");
++#else /* CRYPT */
+     if ((key = malloc(IZ_PWLEN+1)) == NULL) {
+       ZIPERR(ZE_MEM, "was getting encryption password");
+     }
+@@ -3478,6 +3481,7 @@ char **argv;            /* command line tokens */
+     if (r) {
+       ZIPERR(ZE_PARMS, "password verification failed");
+     }
++#endif
+   }
+   if (key) {
+     /* if -P "" could get here */
+--- a/zipcloak.c
++++ b/zipcloak.c
+@@ -744,6 +744,28 @@ struct option_struct far options[] = {
+ 
+ int main OF((void));
+ 
++void zipmessage_nl(a, nl)
++ZCONST char *a;
++int nl;
++{
++}
++
++void zipmessage(a, b)
++ZCONST char *a, *b;
++{
++}
++
++int set_filetype(out_path)
++  char *out_path;
++{
++}
++
++int rename_split(temp_name, out_path)
++  char *temp_name;
++  char *out_path;
++{
++}
++
+ void zipwarn(msg1, msg2)
+ ZCONST char  *msg1, *msg2;
+ {
diff --git a/zip/zip-3.0-pic.patch b/zip/zip-3.0-pic.patch
new file mode 100644
index 000000000..89a52e246
--- /dev/null
+++ b/zip/zip-3.0-pic.patch
@@ -0,0 +1,15 @@
+if our toolchain generates PIC by default, then do not use the hand written
+assembly files as none of it is PIC friendly.
+
+--- a/unix/configure
++++ b/unix/configure
+@@ -29,6 +29,9 @@
+ echo Check if we can use asm code
+ OBJA=""
+ OCRCU8=""
++piclib="$(echo | $CPP -dM $CFLAGS - | grep -i __pic__)"
++echo "Checking if compiler wants to create pic code"
++[ "$piclib" = "" ] && \
+ if eval "$CPP match.S > _match.s 2>/dev/null"; then
+   if test ! -s _match.s || grep error < _match.s > /dev/null; then
+     :
diff --git a/zip/zip-gnu89-build.patch b/zip/zip-gnu89-build.patch
new file mode 100644
index 000000000..65ee7a76c
--- /dev/null
+++ b/zip/zip-gnu89-build.patch
@@ -0,0 +1,15 @@
+zip uses C89-only features, so it needs to be built in C89 mode.
+
+diff --git a/unix/Makefile b/unix/Makefile
+index 86cf54bf0f56cea9..244390893eab5fc6 100644
+--- a/unix/Makefile
++++ b/unix/Makefile
+@@ -202,7 +202,7 @@ generic: flags
+ 	eval $(MAKE) $(MAKEF) zips `cat flags`
+ 
+ generic_gcc:
+-	$(MAKE) $(MAKEF) generic CC=gcc CPP="gcc -E"
++	$(MAKE) $(MAKEF) generic CC="gcc -std=gnu89" CPP="gcc -E"
+ 
+ # AT&T 6300 PLUS (don't know yet how to allocate 64K bytes):
+ att6300nodir:
diff --git a/zip/zipnote.patch b/zip/zipnote.patch
new file mode 100644
index 000000000..4177a7df8
--- /dev/null
+++ b/zip/zipnote.patch
@@ -0,0 +1,13 @@
+diff --git a/zipnote.c b/zipnote.c
+index 5e02cb6..996f012 100644
+--- a/zipnote.c
++++ b/zipnote.c
+@@ -661,7 +661,7 @@ char **argv;            /* command line tokens */
+     if ((r = zipcopy(z)) != ZE_OK)
+       ziperr(r, "was copying an entry");
+   }
+-  fclose(x);
++  fclose(in_file);
+ 
+   /* Write central directory and end of central directory with new comments */
+   if ((c = zftello(y)) == (zoff_t)-1)    /* get start of central */