diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index c42efbc7..38c5717c 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -286,7 +286,7 @@ jobs:
           git config --global core.autocrlf input
           git --version && bash --version
           git clone --depth=1 https://github.com/upx/upx-testsuite ../deps/upx-testsuite
-          mkdir -p -v build/$C/$B/{ucl,upx,zlib,zstd}
+          mkdir -p -v build/$C/$B/{bzip2,ucl,upx,zlib,zstd}
       - name: 'Set up Developer Command Prompt'
         uses: ilammy/msvc-dev-cmd@v1
         with:
@@ -302,6 +302,10 @@ jobs:
           set DEFS=-D_CRT_NONSTDC_NO_WARNINGS -D_CRT_SECURE_NO_WARNINGS
           set BDIR=%H%\build\%C%\%B%
           git rev-parse --short=12 HEAD > %BDIR%\upx\.GITREV.txt
+          @REM ===== build bzip2 =====
+          cd %BDIR%\bzip2
+          @rem %RUN_CL% -J -O2 -W4 -wd4127 -wd4244 -wd4267 -WX %DEFS% -c %H%\vendor\bzip2\*.c
+          @rem %RUN_LIB% -out:bzip2.lib *.obj
           @REM ===== build UCL =====
           cd %BDIR%\ucl
           set s=%H%\vendor\ucl
@@ -312,8 +316,8 @@ jobs:
           %RUN_CL% -J -O2 -W3 -WX %DEFS% -c %H%\vendor\zlib\*.c
           %RUN_LIB% -out:zlib.lib *.obj
           @REM ===== build zstd =====
-          @rem cd %BDIR%\zstd
-          @rem set s=%H%\vendor\zstd\lib
+          cd %BDIR%\zstd
+          set s=%H%\vendor\zstd\lib
           @rem %RUN_CL% -J -O2 -W4 -WX -DDYNAMIC_BMI2=0 -DZSTD_DISABLE_ASM %DEFS% -c %s%\common\*.c %s%\compress\*.c %s%\decompress\*.c
           @rem %RUN_LIB% -out:zstd.lib *.obj
           @REM ===== build UPX =====
@@ -321,9 +325,11 @@ jobs:
           set s=%H%\src
           cat .GITREV.txt
           set /p GITREV=<.GITREV.txt
-          set UPX_DEFS=-DUPX_CONFIG_DISABLE_WSTRICT=0 -DUPX_CONFIG_DISABLE_WERROR=0 -DWITH_ZSTD=0
+          set UPX_DEFS=-DUPX_CONFIG_DISABLE_WSTRICT=0 -DUPX_CONFIG_DISABLE_WERROR=0 -DWITH_BZIP2=0 -DWITH_ZSTD=0
+          set UPX_LIBS=%BDIR%\bzip2\bzip2.lib %BDIR%\ucl\ucl.lib %BDIR%\zlib\zlib.lib %BDIR%\zstd\zstd.lib
+          set UPX_LIBS=%BDIR%\ucl\ucl.lib %BDIR%\zlib\zlib.lib
           set sources=%s%\*.cpp %s%\check\*.cpp %s%\compress\*.cpp %s%\console\*.cpp %s%\filter\*.cpp %s%\util\*.cpp
-          %RUN_CL% -std:c++17 -Zc:__cplusplus -EHsc -J -O2 -W4 -WX -DUPX_VERSION_GITREV="""%GITREV%""" %UPX_DEFS% %DEFS% -I%H%\vendor -Feupx.exe %sources% %BDIR%\ucl\ucl.lib %BDIR%\zlib\zlib.lib /link ${{ matrix.link_machine_flags }} setargv.obj
+          %RUN_CL% -J -O2 -W4 -WX -std:c++17 -Zc:__cplusplus -EHsc -DUPX_VERSION_GITREV="""%GITREV%""" %UPX_DEFS% %DEFS% -I%H%\vendor -Feupx.exe %sources% %UPX_LIBS% /link ${{ matrix.link_machine_flags }} setargv.obj
       - name: 'Make artifact'
         shell: bash
         run: |
diff --git a/.github/workflows/weekly-ci-alpine.yml b/.github/workflows/weekly-ci-alpine.yml
index c223d6d3..23715e0a 100644
--- a/.github/workflows/weekly-ci-alpine.yml
+++ b/.github/workflows/weekly-ci-alpine.yml
@@ -1,5 +1,8 @@
 # build under various Alpine Linux versions with clang and gcc
 
+# info: Alpine 3.9 has clang-5, cmake-3.13.0 and gcc-8 which nicely
+#   matches our minimal build requirements
+
 name: 'Weekly CI - Alpine Linux'
 
 on:
@@ -18,7 +21,12 @@ jobs:
     env: { UPX_CMAKE_CONFIG_FLAGS: '-DCMAKE_VERBOSE_MAKEFILE=ON' }
     steps:
       - name: ${{ format('Install packages {0}', matrix.container) }}
-        run: 'apk update && apk upgrade && apk add clang cmake g++ git make'
+        run: |
+          apk update && apk upgrade && apk add clang cmake g++ git make
+          case ${{ matrix.container }} in
+            # clang-dev is needed on older Alpine versions for clang headers like <emmintrin.h>
+            *:3.[0-9]|*:3.10|*:3.11) apk add clang-dev ;;
+          esac
       - name: ${{ format('Check out UPX {0} source code', github.ref_name) }}
         run: |
           git clone --branch "$GITHUB_REF_NAME" --depth 1 https://github.com/upx/upx
diff --git a/CMakeLists.txt b/CMakeLists.txt
index e4459998..a5444b37 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -1,4 +1,12 @@
+#
+# UPX CMake file; see https://cmake.org/
+# Copyright (C) Markus Franz Xaver Johannes Oberhumer
+#
+
 cmake_minimum_required(VERSION 3.8.0 FATAL_ERROR) # CMake >= 3.20 is recommended
+# Build requirements:
+#   A C++ compiler that supports C++17: clang-5, gcc-8 or msvc-2019 16.11
+#   (older or other compilers may work but are unsupported, use at your own risk)
 
 # compilation config options
 if(NOT IS_DIRECTORY "${CMAKE_CURRENT_SOURCE_DIR}/.git")
@@ -110,12 +118,20 @@ endif()
 #***********************************************************************
 
 set(UPX_CONFIG_DISABLE_THREADS ON) # multithreading is currently not used; maybe in UPX version 5
-set(UPX_CONFIG_DISABLE_ZSTD ON) # zstd is currently not used; maybe in UPX version 5
+set(UPX_CONFIG_DISABLE_BZIP2 ON)   # bzip2 is currently not used; we might need it to decompress linux kernels
+set(UPX_CONFIG_DISABLE_ZSTD ON)    # zstd is currently not used; maybe in UPX version 5
 
 if(NOT UPX_CONFIG_DISABLE_THREADS)
     find_package(Threads)
 endif()
 
+if(NOT UPX_CONFIG_DISABLE_BZIP2)
+file(GLOB bzip2_SOURCES "vendor/bzip2/*.c")
+list(SORT bzip2_SOURCES)
+add_library(upx_vendor_bzip2 STATIC ${bzip2_SOURCES})
+set_property(TARGET upx_vendor_bzip2 PROPERTY C_STANDARD 11)
+endif()
+
 file(GLOB ucl_SOURCES "vendor/ucl/src/*.c")
 list(SORT ucl_SOURCES)
 add_library(upx_vendor_ucl STATIC ${ucl_SOURCES})
@@ -138,6 +154,9 @@ list(SORT upx_SOURCES)
 add_executable(upx ${upx_SOURCES})
 set_property(TARGET upx PROPERTY CXX_STANDARD 17)
 target_link_libraries(upx upx_vendor_ucl upx_vendor_zlib)
+if(NOT UPX_CONFIG_DISABLE_BZIP2)
+    target_link_libraries(upx upx_vendor_bzip2)
+endif()
 if(NOT UPX_CONFIG_DISABLE_ZSTD)
     target_link_libraries(upx upx_vendor_zstd)
 endif()
@@ -225,6 +244,17 @@ function(upx_sanitize_target)
     endforeach()
 endfunction()
 
+if(NOT UPX_CONFIG_DISABLE_BZIP2)
+set(t upx_vendor_bzip2)
+upx_compile_target_debug_with_O2(${t})
+upx_sanitize_target(${t})
+if(MSVC_FRONTEND)
+    target_compile_options(${t} PRIVATE ${warn_WN} -wd4127 -wd4244 -wd4267 ${warn_WX})
+else()
+    target_compile_options(${t} PRIVATE ${warn_Wall} -Wno-implicit-fallthrough ${warn_Werror})
+endif()
+endif() # UPX_CONFIG_DISABLE_BZIP2
+
 set(t upx_vendor_ucl)
 target_include_directories(${t} PRIVATE vendor/ucl/include vendor/ucl)
 upx_compile_target_debug_with_O2(${t})
@@ -277,6 +307,9 @@ endif()
 if(NOT UPX_CONFIG_DISABLE_WERROR)
     target_compile_definitions(${t} PRIVATE UPX_CONFIG_DISABLE_WERROR=0)
 endif()
+if(NOT UPX_CONFIG_DISABLE_BZIP2)
+    target_compile_definitions(${t} PRIVATE WITH_BZIP2=0) # FIXME TODO
+endif()
 if(NOT UPX_CONFIG_DISABLE_ZSTD)
     target_compile_definitions(${t} PRIVATE WITH_ZSTD=1)
 endif()
diff --git a/Makefile b/Makefile
index 06a59cbb..549e0253 100644
--- a/Makefile
+++ b/Makefile
@@ -1,5 +1,6 @@
 #
 # UPX top-level Makefile - needs GNU make and CMake >= 3.13
+# Copyright (C) Markus Franz Xaver Johannes Oberhumer
 #
 
 # INFO: this Makefile is just a convenience wrapper for calling CMake
@@ -187,4 +188,4 @@ endif
 SUBMODULES = doctest lzma-sdk ucl valgrind zlib
 
 dummy := $(foreach m,$(SUBMODULES),$(if $(wildcard vendor/$m/[CL]*),$m,\
-    $(error ERROR: missing git submodule $m; run 'git submodule update --init')))
+    $(error ERROR: missing git submodule '$m'; run 'git submodule update --init')))
diff --git a/misc/cross-compile-upx-with-podman/11-list-packages.sh b/misc/cross-compile-upx-with-podman/11-list-packages.sh
index 55c8aa6c..bf2a8c0d 100755
--- a/misc/cross-compile-upx-with-podman/11-list-packages.sh
+++ b/misc/cross-compile-upx-with-podman/11-list-packages.sh
@@ -21,14 +21,17 @@ podman run "${flags[@]}" "$image" bash -c $'dpkg -l | sed \'s/ *$//\' | LC_ALL=C
 echo
 echo 'Packages sorted by Installed-Size:'
 podman run "${flags[@]}" "$image" bash -c $'awk \'
+BEGIN {
+    arch = "UNKNOWN"; size = 0; package = "UNKNOWN";
+}
 {
     if ($1 == "Architecture:") arch = $2;
     if ($1 == "Installed-Size:") size = $2;
-    if ($1 == "Package:") p = $2;
+    if ($1 == "Package:") package = $2;
     if ($1 == "") {
-        printf("%9d %-40s %s\\n", size, p, arch);
+        printf("%9d %-40s %s\\n", size, package, arch);
         count += 1; total += size;
-        arch = ""; size = 0; p = "";
+        arch = "UNKNOWN"; size = 0; package = "UNKNOWN";
     }
 }
 END {
diff --git a/misc/rebuild-stubs-with-podman/11-list-packages.sh b/misc/rebuild-stubs-with-podman/11-list-packages.sh
index 6a26046d..8c18dca7 100755
--- a/misc/rebuild-stubs-with-podman/11-list-packages.sh
+++ b/misc/rebuild-stubs-with-podman/11-list-packages.sh
@@ -21,14 +21,17 @@ podman run "${flags[@]}" "$image" bash -c $'dpkg -l | sed \'s/ *$//\' | LC_ALL=C
 echo
 echo 'Packages sorted by Installed-Size:'
 podman run "${flags[@]}" "$image" bash -c $'awk \'
+BEGIN {
+    arch = "UNKNOWN"; size = 0; package = "UNKNOWN";
+}
 {
     if ($1 == "Architecture:") arch = $2;
     if ($1 == "Installed-Size:") size = $2;
-    if ($1 == "Package:") p = $2;
+    if ($1 == "Package:") package = $2;
     if ($1 == "") {
-        printf("%9d %-40s %s\\n", size, p, arch);
+        printf("%9d %-40s %s\\n", size, package, arch);
         count += 1; total += size;
-        arch = ""; size = 0; p = "";
+        arch = "UNKNOWN"; size = 0; package = "UNKNOWN";
     }
 }
 END {
diff --git a/src/Makefile b/src/Makefile
index 23e20d88..6ac88212 100644
--- a/src/Makefile
+++ b/src/Makefile
@@ -1,5 +1,6 @@
 #
 # UPX src Makefile - needs GNU make and CMake >= 3.13
+# Copyright (C) Markus Franz Xaver Johannes Oberhumer
 #
 
 # NOTE: this Makefile is deprecated - please directly use the CMake build
@@ -7,7 +8,6 @@
 # build configurations.
 
 MAKEFLAGS += -r
-.SUFFIXES:
 export SHELL = /bin/sh
 
 ifndef srcdir
diff --git a/src/help.cpp b/src/help.cpp
index fe253465..7aa85c42 100644
--- a/src/help.cpp
+++ b/src/help.cpp
@@ -360,15 +360,15 @@ void show_license(void) {
 **************************************************************************/
 
 void show_version(bool one_line) {
-    FILE *fp = stdout;
+    FILE *f = stdout;
     const char *v;
 
 #if defined(UPX_VERSION_GIT_DESCRIBE)
-    fprintf(fp, "upx %s\n", UPX_VERSION_GIT_DESCRIBE);
+    fprintf(f, "upx %s\n", UPX_VERSION_GIT_DESCRIBE);
 #elif defined(UPX_VERSION_GITREV)
-    fprintf(fp, "upx %s\n", UPX_VERSION_STRING "-git-" UPX_VERSION_GITREV);
+    fprintf(f, "upx %s\n", UPX_VERSION_STRING "-git-" UPX_VERSION_GITREV);
 #else
-    fprintf(fp, "upx %s\n", UPX_VERSION_STRING);
+    fprintf(f, "upx %s\n", UPX_VERSION_STRING);
 #endif
     if (one_line)
         return;
@@ -376,50 +376,50 @@ void show_version(bool one_line) {
 #if (WITH_NRV)
     v = upx_nrv_version_string();
     if (v != nullptr && v[0])
-        fprintf(fp, "NRV data compression library %s\n", v);
+        fprintf(f, "NRV data compression library %s\n", v);
 #endif
 #if (WITH_UCL)
     v = upx_ucl_version_string();
     if (v != nullptr && v[0])
-        fprintf(fp, "UCL data compression library %s\n", v);
+        fprintf(f, "UCL data compression library %s\n", v);
 #endif
 #if (WITH_ZLIB)
     v = upx_zlib_version_string();
     if (v != nullptr && v[0])
-        fprintf(fp, "zlib data compression library %s\n", v);
+        fprintf(f, "zlib data compression library %s\n", v);
 #endif
 #if (WITH_LZMA)
     v = upx_lzma_version_string();
     if (v != nullptr && v[0])
-        fprintf(fp, "LZMA SDK version %s\n", v);
+        fprintf(f, "LZMA SDK version %s\n", v);
 #endif
 #if (WITH_ZSTD)
     v = upx_zstd_version_string();
     if (v != nullptr && v[0])
-        fprintf(fp, "zstd data compression library %s\n", v);
+        fprintf(f, "zstd data compression library %s\n", v);
 #endif
 #if !defined(DOCTEST_CONFIG_DISABLE)
-    fprintf(fp, "doctest C++ testing framework version %s\n", DOCTEST_VERSION_STR);
+    fprintf(f, "doctest C++ testing framework version %s\n", DOCTEST_VERSION_STR);
 #endif
     // clang-format off
-    fprintf(fp, "Copyright (C) 1996-2023 Markus Franz Xaver Johannes Oberhumer\n");
-    fprintf(fp, "Copyright (C) 1996-2023 Laszlo Molnar\n");
-    fprintf(fp, "Copyright (C) 2000-2023 John F. Reiser\n");
-    fprintf(fp, "Copyright (C) 2002-2023 Jens Medoch\n");
+    fprintf(f, "Copyright (C) 1996-2023 Markus Franz Xaver Johannes Oberhumer\n");
+    fprintf(f, "Copyright (C) 1996-2023 Laszlo Molnar\n");
+    fprintf(f, "Copyright (C) 2000-2023 John F. Reiser\n");
+    fprintf(f, "Copyright (C) 2002-2023 Jens Medoch\n");
 #if (WITH_ZLIB)
-    fprintf(fp, "Copyright (C) 1995" "-2023 Jean-loup Gailly and Mark Adler\n");
+    fprintf(f, "Copyright (C) 1995" "-2023 Jean-loup Gailly and Mark Adler\n");
 #endif
 #if (WITH_LZMA)
-    fprintf(fp, "Copyright (C) 1999" "-2006 Igor Pavlov\n");
+    fprintf(f, "Copyright (C) 1999" "-2006 Igor Pavlov\n");
 #endif
 #if (WITH_ZSTD)
     // see vendor/zstd/LICENSE; main author is Yann Collet
-    fprintf(fp, "Copyright (C) 2015" "-2023 Meta Platforms, Inc. and affiliates\n");
+    fprintf(f, "Copyright (C) 2015" "-2023 Meta Platforms, Inc. and affiliates\n");
 #endif
 #if !defined(DOCTEST_CONFIG_DISABLE)
-    fprintf(fp, "Copyright (C) 2016" "-2023 Viktor Kirilov\n");
+    fprintf(f, "Copyright (C) 2016" "-2023 Viktor Kirilov\n");
 #endif
-    fprintf(fp, "UPX comes with ABSOLUTELY NO WARRANTY; for details type '%s -L'.\n", progname);
+    fprintf(f, "UPX comes with ABSOLUTELY NO WARRANTY; for details type '%s -L'.\n", progname);
     // clang-format on
 }
 
diff --git a/src/main.cpp b/src/main.cpp
index 1ff690ed..66dc4e89 100644
--- a/src/main.cpp
+++ b/src/main.cpp
@@ -1158,7 +1158,7 @@ int upx_main(int argc, char *argv[]) {
         if (dt_res == 2)
             fprintf(stderr, "%s: doctest requested program exit; Stop.\n", argv0);
         else
-            fprintf(stderr, "%s: internal error: doctest failed\n", argv0);
+            fprintf(stderr, "%s: internal error: doctest check failed\n", argv0);
         e_exit(EXIT_INIT);
     }
 
@@ -1240,7 +1240,7 @@ int upx_main(int argc, char *argv[]) {
         e_exit(EXIT_OK);
         break;
     default:
-        /* ??? */
+        assert(false); // should not happen
         break;
     }