update TODO

TODO.md

diff --git a/TODO.md b/TODO.md
index 1adb737..5213e8c 100644
--- a/TODO.md
+++ b/TODO.md
@@ -1,4 +1,46 @@
-# API Plans
+# Soon
+
+* define ZIP_STATIC when libzip is built statically
+
+* review guidelines/community standards
+  - (Linux Foundation Core Infrastructure Initiative Best Practices)[https://bestpractices.coreinfrastructure.org/]
+  - (Readme Maturity Level)[https://github.com/LappleApple/feedmereadmes/blob/master/README-maturity-model.md]
+  - (Github Community Profile)[https://github.com/nih-at/libzip/community]
+
+* migration to CMake
+  - tests (libgit2 tests using ctest)
+  - how to make source distributions
+  - replace `make distcheck`
+  - cmake on Linux: man pages not built (https://github.com/nih-at/libzip/issues/8)
+  - check generated xcode project
+  
+* clone support
+  - APFS
+  - `zip_source_buffer`: also support multiple buffers, compare `writev` `struct iovec`
+  - test using `zip_source_buffer`
+
+* randomness test: replace `zip_random()` instead of `open()`
+
+* run Coverity tests automatically via github/travis
+
+* switch to newer fcrypt sources, see https://github.com/BrianGladman/AES/issues/19
+
+* add HISTORY section to man pages (semi-automatically)
+  - check out `zip.h` from different releases
+  - compare signatures
+  - create HISTORY sections
+
+* improve man page formatting of tagged lists on webpage (`<dl>`)
+
+* build own version of `ziptool` for regress
+  - move source_hole, zip from memory there
+
+* test error cases with special source
+  - tell it which command should fail
+  - use it both as source for `zip_add` and `zip_open_from_source`
+  
+
+# Later
 
 ## Prefixes
 
@@ -8,12 +50,12 @@
 const zip_uint8_t *zip_get_archive_prefix(struct zip *za, zip_uint64_t *lengthp);
 ````
 
-# Compression
+## Compression
 
 * Test CMAKE for bzip2
 * add lzma support
 
-# API Issues
+## API Issues
 
 * `zip_get_archive_comment` has `int *lenp` argument.  Cleaner would be `zip_uint32_t *`.
   rename and fix.  which other functions for naming consistency?
@@ -22,12 +64,8 @@
 * compression/crypt error messages a la `ZIP_ER_ZLIB` (no detailed info passing)
 * check arguments for every entry point into libzip
 
-# Features
+## Features
 
-* Winzip AES support
-  * test cases decryption: <=20, >20, stat for both
-  * test cases encryption: no password, default password, file-specific password, 128/192/256, <=20, >20
-  * support testing on macOS
 * consistently use `_zip_crypto_clear()` for passwords
 * support setting extra fields from `zip_source`
   * introduce layers of extra fields:
@@ -66,7 +104,7 @@
 
 * support for old compression methods?????
 
-# Bugs
+## Bugs
 
 * support InfoZIP encryption header extension (copy data descriptor for encrypted files)
 * ensure that nentries is small enough not to cause overflow (size_t for entry, uint64 for CD on disk)
@@ -78,7 +116,7 @@
 * `cdr == NULL` -> `ER_NOENT` vs. `idx > cdir->nentry` -> `ER_INVAL` inconsistent (still there?)
 
 
-# Cleanup
+## Cleanup
 
 * go over cdir parser and rename various offset/size variables to make it clearer
 * use bool
@@ -87,17 +125,23 @@
 * get rid of `zip_get_{compression,encryption}_implementation()`
 * use `zip_*int*_t` internally
 
-# Analysis
+## Analysis
 
 * pass through coverity
 
-# Infrastructure
+## Infrastructure
 
 * create CMakefile.txt man page linking from links file
 * handle missing mandoc on Linux
+* configure appveyor for Windows builds of libzip
 
-# Test Case Issues
+## Test Case Issues
 
+* consider testing for malloc/realloc failures (see `ckmame/regress/malloc.c`)
+* Winzip AES support
+  * test cases decryption: <=20, >20, stat for both
+  * test cases encryption: no password, default password, file-specific password, 128/192/256, <=20, >20
+  * support testing on macOS
 * add test cases for lots of files (including too many)
 * add test cases for holes (between files, between files and cdir, between cdir and eocd, + zip64 where appropriate)
 * unchange on added file
@@ -154,7 +198,7 @@
   * zip_open_from_source
 * read two zip entries interleaved
 
-# Unsorted
+## Unsorted
 
 * `zip_source_file()`: don't allow write if start/len specify a part of the file
 * script to check if all exported symbols are marked with `ZIP_EXTERN`, add to make distcheck