From 81082ac05d3c0c8d5156d1d1bda62a9137c6e931 Mon Sep 17 00:00:00 2001
From: Colin Murphy <colmurph@adobe.com>
Date: Wed, 21 Jan 2026 10:42:42 -0500
Subject: [PATCH 1/2] fix: Use patched version of typed-path for zip

Temporary fix until https://github.com/chipsenkbeil/typed-path/pull/57
is merged.
---
 Cargo.lock | 3 +--
 Cargo.toml | 4 ++++
 2 files changed, 5 insertions(+), 2 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 1b116bd37..5f2bf3464 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -4476,8 +4476,7 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 [[package]]
 name = "typed-path"
 version = "0.12.0"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7922f2cdc51280d47b491af9eafc41eb0cdab85eabcb390c854412fcbf26dbe8"
+source = "git+https://github.com/cdmurph32/typed-path?branch=wasip2_fix#12b0113ac811c89d37e267eaf57221e1673bcd9f"
 
 [[package]]
 name = "typenum"
diff --git a/Cargo.toml b/Cargo.toml
index c5ced7f2d..3883e79c8 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,6 +17,10 @@ version = "0.75.4"
 [workspace.dependencies]
 c2pa = { path = "sdk", default-features = false }
 
+# Remove once http://github.com/chipsenkbeil/typed-path/pull/57 is merged and released
+[patch.crates-io]
+typed-path = { git = "https://github.com/cdmurph32/typed-path", branch = "wasip2_fix" }
+
 [profile.release]
 strip = true  # Automatically strip symbols from the binary.
 opt-level = 3

From 6c9e3817c4a33aedfe2fdd1de20db03710abeef4 Mon Sep 17 00:00:00 2001
From: Colin Murphy <colmurph@adobe.com>
Date: Wed, 21 Jan 2026 10:57:38 -0500
Subject: [PATCH 2/2] fix: Downgrade zip to 6 for WASI

---
 Cargo.lock     | 38 ++++++++++++++++++++++++++++++++++++--
 Cargo.toml     |  4 ----
 sdk/Cargo.toml |  5 ++++-
 3 files changed, 40 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index 5f2bf3464..bbcc98332 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -127,6 +127,15 @@ dependencies = [
  "num-traits",
 ]
 
+[[package]]
+name = "arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "c3d036a3c4ab069c7b410a2ce876bd74808d2d0888a82667669f8e783a898bf1"
+dependencies = [
+ "derive_arbitrary",
+]
+
 [[package]]
 name = "asn1-rs"
 version = "0.7.1"
@@ -516,7 +525,8 @@ dependencies = [
  "wstd",
  "x509-parser",
  "zeroize",
- "zip",
+ "zip 6.0.0",
+ "zip 7.2.0",
 ]
 
 [[package]]
@@ -1078,6 +1088,17 @@ dependencies = [
  "serde_core",
 ]
 
+[[package]]
+name = "derive_arbitrary"
+version = "1.4.2"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1e567bd82dcff979e4b03460c307b3cdc9e96fde3d73bed1496d2bc75d9dd62a"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn 2.0.114",
+]
+
 [[package]]
 name = "difflib"
 version = "0.4.0"
@@ -4476,7 +4497,8 @@ checksum = "d2df906b07856748fa3f6e0ad0cbaa047052d4a7dd609e231c4f72cee8c36f31"
 [[package]]
 name = "typed-path"
 version = "0.12.0"
-source = "git+https://github.com/cdmurph32/typed-path?branch=wasip2_fix#12b0113ac811c89d37e267eaf57221e1673bcd9f"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7922f2cdc51280d47b491af9eafc41eb0cdab85eabcb390c854412fcbf26dbe8"
 
 [[package]]
 name = "typenum"
@@ -5246,6 +5268,18 @@ dependencies = [
  "syn 2.0.114",
 ]
 
+[[package]]
+name = "zip"
+version = "6.0.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "eb2a05c7c36fde6c09b08576c9f7fb4cda705990f73b58fe011abf7dfb24168b"
+dependencies = [
+ "arbitrary",
+ "crc32fast",
+ "indexmap 2.13.0",
+ "memchr",
+]
+
 [[package]]
 name = "zip"
 version = "7.2.0"
diff --git a/Cargo.toml b/Cargo.toml
index 3883e79c8..c5ced7f2d 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -17,10 +17,6 @@ version = "0.75.4"
 [workspace.dependencies]
 c2pa = { path = "sdk", default-features = false }
 
-# Remove once http://github.com/chipsenkbeil/typed-path/pull/57 is merged and released
-[patch.crates-io]
-typed-path = { git = "https://github.com/cdmurph32/typed-path", branch = "wasip2_fix" }
-
 [profile.release]
 strip = true  # Automatically strip symbols from the binary.
 opt-level = 3
diff --git a/sdk/Cargo.toml b/sdk/Cargo.toml
index e0a15e8b1..485299103 100644
--- a/sdk/Cargo.toml
+++ b/sdk/Cargo.toml
@@ -183,7 +183,6 @@ uuid = { version = "1.18.0", features = ["serde", "v4"] }
 web-time = "1.1"
 x509-parser = "0.18.0"
 zeroize = { version = "1.8", features = ["zeroize_derive"] }
-zip = { version = "7.0.0", default-features = false }
 
 # Use the asm feature of sha2 on aarch64 macOS for better performance. This nearly
 # halves hashing time for large assets (> 50gb mp4, for example).
@@ -211,10 +210,13 @@ openssl = { version = "0.10.72", features = ["vendored"], optional = true }
 ureq = { version = "3.1.0", default-features = false, features = [
     "rustls"
 ], optional = true }
+zip = { version = "7.0.0", default-features = false }
 
 [target.'cfg(target_os = "wasi")'.dependencies]
 wasi = { version = "0.14.3", optional = true }
 wstd = { version = "0.5.4", optional = true }
+# Use zip 6 for WASI to avoid typed-path wasip2 issue. Fix: http://github.com/chipsenkbeil/typed-path/pull/57
+zip = { version = "6.0.0", default-features = false }
 
 # `wstd` is required for testing, but optional as a normal dependency.
 [target.'cfg(target_os = "wasi")'.dev-dependencies]
@@ -282,6 +284,7 @@ web-sys = { version = "0.3.58", features = [
     "Window",
     "WorkerGlobalScope",
 ] }
+zip = { version = "7.0.0", default-features = false }
 
 [dev-dependencies]
 anyhow = "1.0.97"