diff --git a/BUILD b/BUILD
index 2f1ca43..25e7334 100644
--- a/BUILD
+++ b/BUILD
@@ -1,31 +1,33 @@
-package(default_visibility = ["//visibility:public"])
-
+load("@rules_java//java:defs.bzl", "java_binary", "java_library")
+load("@rules_cc//cc:defs.bzl", "cc_binary", "cc_library")
 load(
     "@rules_haskell//haskell:defs.bzl",
     "haskell_binary",
-    "haskell_test",
     "haskell_toolchain_library",
 )
 load(
     "@io_tweag_clodl//clodl:clodl.bzl",
-    "library_closure",
     "binary_closure",
+    "library_closure",
 )
+load("@com_github_bazelbuild_buildtools//buildifier:def.bzl", "buildifier")
+
+package(default_visibility = ["//visibility:public"])
 
 cc_library(
     name = "bootstrap-bz",
     srcs = ["src/main/cc/bootstrap.c"],
     copts = ["-std=c99"],
     deps = [
-        "@rules_haskell_ghc_nixpkgs//:include",
         "@openjdk//:include",
+        "@rules_haskell_ghc_nixpkgs//:include",
     ],
 )
 
 cc_binary(
     name = "libbootstrap.so",
-    deps = ["bootstrap-bz"],
     linkshared = 1,
+    deps = ["bootstrap-bz"],
 )
 
 java_library(
@@ -33,12 +35,11 @@ java_library(
     srcs = glob(["src/main/java/**/*.java"]),
 )
 
-
 haskell_toolchain_library(name = "base")
+
 haskell_binary(
     name = "hello-hs",
     testonly = True,
-    linkstatic = False,
     srcs = ["src/test/haskell/hello/Main.hs"],
     compiler_flags = [
         "-threaded",
@@ -46,23 +47,26 @@ haskell_binary(
         "-optl-Wl,--dynamic-list=main-symbol-list.ld",
     ],
     extra_srcs = ["main-symbol-list.ld"],
-    deps = [":base"],
+    linkstatic = False,
     src_strip_prefix = "src/test/haskell/hello",
+    deps = [":base"],
 )
 
 library_closure(
     name = "clotest",
     testonly = True,
-    srcs = ["hello-hs", "libbootstrap.so"],
+    srcs = [
+        "hello-hs",
+        "libbootstrap.so",
+    ],
     excludes = [
-        "ld-linux-x86-64\.so.*",
-        "libgcc_s\.so.*",
-        "libc\.so.*",
-        "libdl\.so.*",
-        "libm\.so.*",
-        "libpthread\.so.*",
+        "ld-linux-x86-64\\.so.*",
+        "libgcc_s\\.so.*",
+        "libc\\.so.*",
+        "libdl\\.so.*",
+        "libm\\.so.*",
+        "libpthread\\.so.*",
     ],
-    outzip = "closure.zip",
 )
 
 binary_closure(
@@ -70,12 +74,12 @@ binary_closure(
     testonly = True,
     src = "hello-hs",
     excludes = [
-        "ld-linux-x86-64\.so.*",
-        "libgcc_s\.so.*",
-        "libc\.so.*",
-        "libdl\.so.*",
-        "libm\.so.*",
-        "libpthread\.so.*",
+        "ld-linux-x86-64\\.so.*",
+        "libgcc_s\\.so.*",
+        "libc\\.so.*",
+        "libdl\\.so.*",
+        "libm\\.so.*",
+        "libpthread\\.so.*",
     ],
 )
 
@@ -89,16 +93,16 @@ java_binary(
 
 cc_library(
     name = "lib-cc",
-    srcs = ["src/test/cc/hello/lib.c"],
     testonly = True,
+    srcs = ["src/test/cc/hello/lib.c"],
 )
 
 cc_binary(
     name = "libhello-cc.so",
+    testonly = True,
     srcs = ["src/test/cc/hello/main.c"],
-    deps = ["lib-cc"],
     linkshared = 1,
-    testonly = True,
+    deps = ["lib-cc"],
 )
 
 binary_closure(
@@ -109,9 +113,9 @@ binary_closure(
 
 cc_binary(
     name = "libhello-cc-norunfiles.so",
+    testonly = True,
     srcs = ["src/test/cc/hello/main.c"],
     linkshared = 1,
-    testonly = True,
 )
 
 binary_closure(
@@ -122,10 +126,13 @@ binary_closure(
 
 cc_binary(
     name = "hello-cc-pie",
-    srcs = ["src/test/cc/hello/main.c"],
-    linkopts = ["-pie", "-Wl,--dynamic-list=main-symbol-list.ld"],
-	deps = ["main-symbol-list.ld"],
     testonly = True,
+    srcs = ["src/test/cc/hello/main.c"],
+    linkopts = [
+        "-pie",
+        "-Wl,--dynamic-list=main-symbol-list.ld",
+    ],
+    deps = ["main-symbol-list.ld"],
 )
 
 binary_closure(
@@ -138,3 +145,8 @@ sh_binary(
     name = "deps",
     srcs = ["src/main/bash/deps.sh"],
 )
+
+buildifier(
+    name = "buildifier",
+    lint_mode = "warn",
+)
diff --git a/WORKSPACE b/WORKSPACE
index 5ea2cb6..6bf30a1 100644
--- a/WORKSPACE
+++ b/WORKSPACE
@@ -9,21 +9,8 @@ http_archive(
     urls = ["https://github.com/tweag/rules_haskell/archive/6604b8c19701a64986e98d475959ff2a2e8a1379.tar.gz"],
 )
 
-http_archive(
-    name = "org_nixos_patchelf",
-    build_file_content = """
-cc_binary(
-    name = "patchelf",
-    srcs = ["src/patchelf.cc", "src/elf.h"],
-    copts = ["-DPAGESIZE=4096", '-DPACKAGE_STRING=\\\\"patchelf\\\\"'],
-    visibility = [ "//visibility:public" ],
-)
-""",
-    strip_prefix = "patchelf-1fa4d36fead44333528cbee4b5c04c207ce77ca4",
-    urls = ["https://github.com/NixOS/patchelf/archive/1fa4d36fead44333528cbee4b5c04c207ce77ca4.tar.gz"],
-)
-
 load("@rules_haskell//haskell:repositories.bzl", "haskell_repositories")
+
 haskell_repositories()
 
 load(
@@ -55,16 +42,6 @@ filegroup(
 
 haskell_register_ghc_nixpkgs(
     attribute_path = "haskell.compiler.ghc8102",
-    locale_archive = "@glibc_locales//:locale-archive",
-    repositories = {"nixpkgs": "@nixpkgs"},
-    version = "8.10.2",
-    compiler_flags = [
-        "-Werror",
-        "-Wall",
-        "-Wcompat",
-        "-Wincomplete-record-updates",
-        "-Wredundant-constraints",
-    ],
     build_file_content = """
 package(default_visibility = [ "//visibility:public" ])
 
@@ -79,6 +56,16 @@ cc_library(
     strip_include_prefix = glob(["lib/ghc-*/include"], exclude_directories=0)[0],
 )
 """,
+    compiler_flags = [
+        "-Werror",
+        "-Wall",
+        "-Wcompat",
+        "-Wincomplete-record-updates",
+        "-Wredundant-constraints",
+    ],
+    locale_archive = "@glibc_locales//:locale-archive",
+    repositories = {"nixpkgs": "@nixpkgs"},
+    version = "8.10.2",
 )
 
 nixpkgs_package(
@@ -95,7 +82,6 @@ cc_library(
     repository = "@nixpkgs",
 )
 
-
 http_archive(
     name = "io_bazel_stardoc",
     strip_prefix = "stardoc-0.4.0",
@@ -103,4 +89,55 @@ http_archive(
 )
 
 load("@io_bazel_stardoc//:setup.bzl", "stardoc_repositories")
+
 stardoc_repositories()
+
+##################################################################
+#  buildifier setup
+##################################################################
+
+# buildifier is written in Go and hence needs rules_go to be built.
+# See https://github.com/bazelbuild/rules_go for the up to date setup instructions.
+http_archive(
+    name = "io_bazel_rules_go",
+    sha256 = "d1ffd055969c8f8d431e2d439813e42326961d0942bdf734d2c95dc30c369566",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/rules_go/releases/download/v0.24.5/rules_go-v0.24.5.tar.gz",
+        "https://github.com/bazelbuild/rules_go/releases/download/v0.24.5/rules_go-v0.24.5.tar.gz",
+    ],
+)
+
+load("@io_bazel_rules_go//go:deps.bzl", "go_register_toolchains", "go_rules_dependencies")
+
+go_rules_dependencies()
+
+go_register_toolchains()
+
+http_archive(
+    name = "bazel_gazelle",
+    sha256 = "b85f48fa105c4403326e9525ad2b2cc437babaa6e15a3fc0b1dbab0ab064bc7c",
+    urls = [
+        "https://mirror.bazel.build/github.com/bazelbuild/bazel-gazelle/releases/download/v0.22.2/bazel-gazelle-v0.22.2.tar.gz",
+        "https://github.com/bazelbuild/bazel-gazelle/releases/download/v0.22.2/bazel-gazelle-v0.22.2.tar.gz",
+    ],
+)
+
+load("@bazel_gazelle//:deps.bzl", "gazelle_dependencies")
+
+gazelle_dependencies()
+
+http_archive(
+    name = "com_google_protobuf",
+    strip_prefix = "protobuf-master",
+    urls = ["https://github.com/protocolbuffers/protobuf/archive/master.zip"],
+)
+
+load("@com_google_protobuf//:protobuf_deps.bzl", "protobuf_deps")
+
+protobuf_deps()
+
+http_archive(
+    name = "com_github_bazelbuild_buildtools",
+    strip_prefix = "buildtools-master",
+    url = "https://github.com/bazelbuild/buildtools/archive/master.zip",
+)
diff --git a/clodl/clodl.bzl b/clodl/clodl.bzl
index f037391..6a15486 100644
--- a/clodl/clodl.bzl
+++ b/clodl/clodl.bzl
@@ -1,76 +1,51 @@
 """Library and binary closures"""
 
-load("@bazel_skylib//lib:paths.bzl", "paths")
-
-def _rename_as_solib_impl(ctx):
-    """Renames files as libraries."""
-
-    output_files = []
-    for f in ctx.files.deps:
-        if f.basename.endswith(".so") or f.basename.find(".so.") != -1:
-            symlink = ctx.actions.declare_file(paths.join(ctx.attr.outputdir, f.basename))
-        else:
-            symlink = ctx.actions.declare_file(paths.join(ctx.attr.outputdir, "lib%s.so" % f.basename))
-        output_files.append(symlink)
-        ctx.actions.run_shell(
-            inputs = depset([f]),
-            outputs = [symlink],
-            mnemonic = "Symlink",
-            command = """
-            set -eo pipefail
-            mkdir -p {out_dir}
-            ln -s $(realpath {target}) {link}
-            """.format(
-                target = f.path,
-                link = symlink.path,
-                out_dir = symlink.dirname,
-            ),
-        )
-
-    return DefaultInfo(files = depset(output_files))
-
-_rename_as_solib = rule(
-    _rename_as_solib_impl,
-    attrs = {
-        "deps": attr.label_list(),
-        "outputdir": attr.string(
-          doc = "Where the outputs are placed.",
-          mandatory = True,
-        ),
-    },
-	doc = """
-Renames files as shared libraries to make them suitable for linking with `cc_binary`.
-
-This is useful for linking executables built with `-pie`.
+load("@bazel_tools//tools/cpp:toolchain_utils.bzl", "find_cpp_toolchain")
+load("@bazel_tools//tools/build_defs/cc:action_names.bzl", "ACTION_NAMES")
 
-Example:
+def remove_library_flags(flags):
+    return [f for f in flags if not f.startswith("-l")]
 
-  ```bzl
-  _rename_as_solib(
-      name = "some_binary"
-      dep = [":lib"]
-      outputdir = "dir"
-  )
-  ```
-
-  If some_binary has files `a.so` and `b`, the outputs are `dir/a.so`
-  and `dir/b.so`. The outputs need to be placed in a new directory or
-  bazel will complain of conflicts with the rules that initially
-  created the runfiles.
-
-  Note: Runfiles are not propagated.
+def quote_list(xs):
+    if [] == xs:
+        return ""
+    else:
+        return "'" + "' '".join(xs) + "'"
 
-""",
-)
+def _library_closure_impl(ctx):
+    if ctx.attr.executable:
+        action_name = ACTION_NAMES.cpp_link_executable
+    else:
+        action_name = ACTION_NAMES.cpp_link_nodeps_dynamic_library
+    cc_toolchain = find_cpp_toolchain(ctx)
+    feature_configuration = cc_common.configure_features(
+        ctx = ctx,
+        cc_toolchain = cc_toolchain,
+        unsupported_features = ctx.disabled_features,
+    )
+    compiler = cc_common.get_tool_for_action(
+        feature_configuration = feature_configuration,
+        action_name = action_name,
+    )
+    compiler_variables = cc_common.create_compile_variables(
+        feature_configuration = feature_configuration,
+        cc_toolchain = cc_toolchain,
+    )
+    compiler_options = remove_library_flags(cc_common.get_memory_inefficient_command_line(
+        feature_configuration = feature_configuration,
+        action_name = action_name,
+        variables = compiler_variables,
+    ))
+    compiler_env = cc_common.get_environment_variables(
+        feature_configuration = feature_configuration,
+        action_name = action_name,
+        variables = compiler_variables,
+    )
 
-def _shared_lib_paths_impl(ctx):
-    """Collects the list of shared library paths of an executable or library."""
-    libs_file = ctx.actions.declare_file(ctx.label.name + ".txt")
-    files = depset()
-    runfiles = depset()
-    for src in ctx.attr.srcs:
-        files = depset(transitive = [src.files, files])
-        runfiles = depset(transitive = [src.default_runfiles.files, runfiles])
+    output_file = ctx.actions.declare_file(ctx.label.name + ".zip")
+    cc_tools = ctx.attr._cc_toolchain.files
+    files = depset(ctx.files.srcs)
+    runfiles = depset(transitive = [src.default_runfiles.files for src in ctx.attr.srcs])
 
     # find tools
     bash = ctx.actions.declare_file("bash")
@@ -86,85 +61,113 @@ def _shared_lib_paths_impl(ctx):
         ln -s $(command -v ldd) {ldd}
         ln -s $(command -v grep) {grep}
         ln -s $(command -v scanelf) {scanelf}
-        """.format(ldd = ldd.path, bash=bash.path, grep = grep.path, scanelf = scanelf.path),
+        """.format(ldd = ldd.path, bash = bash.path, grep = grep.path, scanelf = scanelf.path),
     )
 
-    if [] == ctx.attr.excludes:
-        excludes = ""
-    else:
-        excludes = "'" + "' '".join(ctx.attr.excludes) + "'"
+    excludes = quote_list(ctx.attr.excludes)
 
     args = ctx.actions.args()
     args.add_joined(files, join_with = " ")
-    args.add(libs_file)
+    args.add(output_file)
     ctx.actions.run_shell(
-        outputs = [libs_file],
+        outputs = [output_file],
         inputs = depset([bash, grep, ldd, scanelf], transitive = [runfiles, files]),
-        tools = [ctx.executable._deps_tool],
+        tools = [ctx.executable._deps_tool] + cc_tools.to_list(),
         arguments = [args],
+        env = compiler_env,
         command = """
-        set -eo pipefail
-        tops="$1"
-        libs_file="$2"
 
-        # find the list of libraries with ldd
-        PATH={tools}:$PATH {deps} $tops -- {excludes} > $libs_file
+        set -euo pipefail
+        srclibs="$1"
+        output_file="$2"
+        executable={executable}
+        tmpdir=$(mktemp -d -p $PWD)
+
+        PATH={tools}:$PATH {deps} $srclibs -- {excludes} > libs.txt
+        for lib in $srclibs
+        do
+          echo $lib >> libs.txt
+        done
+        cp $(cat libs.txt) $tmpdir
+
+        # Build the wrapper library that links directly to all dependencies.
+        # Loading the wrapper ensures that the transitive dependencies are found
+        # in the final closure no matter how the runpaths of the direct
+        # dependencies were set.
+        cat libs.txt \
+          | sort | uniq \
+          | sed "s/.*\\/\\(.*\\)/-l:\\1/" \
+          > params
+        echo \
+          -L$tmpdir \
+          "{compiler_options}" \
+          >> params
+        echo '-Wl,-rpath=$ORIGIN' >> params
+        if [ $executable == False ]
+        then
+          echo -o $tmpdir/libclodl-top.so >> params
+        else
+          echo -o $tmpdir/clodl-exe-top >> params
+        fi
+        {compiler} @params
+
+        # zip all the libraries
+        zip -X -qjr $output_file $tmpdir
+        rm -rf $tmpdir
+
+        # Check that the excluded libraries have been really excluded.
+
+        # Check first that there are files to exclude.
+        [ '{excludes}' ] || exit 0
+
+        # Produce a file with regexes to exclude libs from the zip.
+        tmpx_file=$(mktemp tmpexcludes_file.XXXXXX -p $PWD)
+        # Note: quotes are important in shell expansion to preserve newlines.
+        echo '{n_excludes}' > $tmpx_file
+
+        # Check that excluded libraries don't appear in the zip file.
+        if unzip -t $@ \
+            | grep -e '^[ ]*testing: ' \
+            | sed "s/^[ ]*testing: \\([^ ]*\\).*/\\1/" \
+            | grep -Ef $tmpx_file
+        then
+            echo "library_closure: lint: Some files were not excluded."
+            exit 1
+        fi
+
+        rm -rf $tmpx_file
         """.format(
-            deps = ctx.executable._deps_tool.path,
+            executable = ctx.attr.executable,
             excludes = excludes,
+            n_excludes = "\n".join(ctx.attr.excludes),
+            deps = ctx.executable._deps_tool.path,
             tools = ldd.dirname,
+            compiler = compiler,
+            compiler_options = quote_list(compiler_options),
         ),
     )
 
-    return DefaultInfo(files = depset([libs_file]))
+    return DefaultInfo(files = depset([output_file]))
 
-_shared_lib_paths = rule(
-    _shared_lib_paths_impl,
+library_closure = rule(
+    _library_closure_impl,
     attrs = {
         "srcs": attr.label_list(),
         "excludes": attr.string_list(),
+        "executable": attr.bool(),
         "_deps_tool": attr.label(
             executable = True,
             cfg = "host",
             allow_files = True,
             default = Label("//:deps"),
         ),
+        "_cc_toolchain": attr.label(default = Label("@bazel_tools//tools/cpp:current_cc_toolchain")),
     },
+    toolchains = ["@bazel_tools//tools/cpp:toolchain_type"],
+    fragments = ["cpp"],
     doc = """
-Collects the list of shared library paths of an executable or library.
-
-Produces a txt file containing the paths.
-
-Example:
-
-  ```bzl
-  _shared_lib_paths = (
-      name = "shared-libs"
-      srcs = [":lib", ":exe"]
-  )
-  ```
-
-  The output is shared-libs.txt.
-
-""",
-)
-
-def _mangle_dir(name):
-    """Creates a unique directory name from the repo name and package
-      name of the package being evaluated, and a given name.
-
-    """
-    components = [native.repository_name(), native.package_name(), name]
-    components = [c.replace("@", "") for c in components]
-    components = [c for c in components if c]
-    return "/".join(components).replace("_", "_U").replace("/", "_S")
-
-def library_closure(name, srcs, outzip = "", excludes = [], executable = False, **kwargs):
-    """
-    Produce a closure of the given shared libraries.
-
     Produces a zip file containing a closure of all the shared
-    libraries needed to load the given shared libraries.
+    libraries needed to load the given shared libraries or executables.
 
     Example:
 
@@ -172,189 +175,31 @@ def library_closure(name, srcs, outzip = "", excludes = [], executable = False,
       library_closure(
           name = "closure"
           srcs = [":lib1", ":lib2"]
-          excludes = ["libexclude_this\.so", "libthis_too\.so"]
-          outzip = "file.zip"
+          excludes = ["libexclude_this\\.so", "libthis_too\\.so"]
           ...
       )
       ```
 
-      The zip file `<generated_dir>/file.zip` is created, with all the
+      The zip file `closure.zip` is created, with all the
       shared libraries required by `:lib1` and `:lib2` except those in
-      excludes. `<generated_dir>` is a name which depends on `name`.
+      excludes.
 
     Args:
       name: A unique name for this rule.
 
       srcs: Libraries whose dependencies need to be included.
 
-      outzip: The name of the zip file to produce. If omitted, the
-              file is named as the rule with a `.zip` file extension.
-              If present, the file is created inside a directory with
-              a name generated from the rule name.
-
       excludes: Patterns matching the names of libraries that should
                 be excluded from the closure. Extended regular
                 expresions as provided by grep can be used here.
 
       executable: Includes a wrapper in the zip file capable of executing the
-                  closure (`<name>_wrapper`). If executable is False, the wrapper
-                  is just a shared library `lib<name>_wrapper.so` that depends on
+                  closure (`clodl-exe-top`). If executable is False, the wrapper
+                  is just a shared library `libclodl-top.so` that depends on
                   all the other libraries in the closure.
 
-    """
-    libs_file = "%s-libs" % name
-    srclibs = "%s-as-libs" % name
-    param_file = "%s-params.ld" % name
-    dirs_file = "%s-search_dirs.ld" % name
-    if executable:
-        wrapper_lib = "%s_wrapper" % name
-    else:
-        wrapper_lib = "lib%s_wrapper.so" % name
-    solibdir = _mangle_dir(name + "_solib")
-    solibdir_renamed = solibdir + "_renamed"
-    if outzip == "":
-        outputdir = "."
-        outzip = "%s.zip" % name
-    else:
-        outputdir = _mangle_dir(name)
-        outzip = paths.join(outputdir, outzip)
-
-    # Rename the inputs to solibs as expected by cc_binary.
-    _rename_as_solib(
-        name = srclibs,
-        deps = srcs,
-        outputdir = solibdir_renamed,
-        **kwargs
-    )
-
-    # Get the paths of srcs dependencies.
-    # It would be simpler if we could give the shared libraries
-    # as outputs. Unfortunately, that information is currently
-    # discovered when running the actions and isn't available when
-    # wiring them.
-    _shared_lib_paths(
-        name = libs_file,
-        srcs = srcs,
-        excludes = excludes,
-        **kwargs
-    )
-
-    # Produce the arguments for linking the wrapper library
-    #
-    # cc_binary links any libraries passed to it in srcs. But
-    # we need these extra arguments to link all of the dependencies
-    # that may reside outside the sandbox.
-    #
-    # We produce two files:
-    # * params_file contains the dependencies names, and
-    # * dirs_file contains the paths in which to look for dependencies.
-    #
-    # The linker fails with an obscure error if the contents of both files
-    # are put into one.
-    native.genrule(
-        name = "%s_params_file" % name,
-        srcs = [libs_file],
-        cmd = """
-        libs_file=$(SRCS)
-        param_file=$(location %s)
-        dirs_file=$(location %s)
-        cat $$libs_file \
-          | cut -f 2 \
-          | sed "s/\\(.*\\)\\/.*/SEARCH_DIR(\\1)/" \
-          | sort | uniq \
-          > $$dirs_file
-        echo "INPUT(" > $$param_file
-        cat $$libs_file \
-          | cut -f 2 \
-          | sed "s/.*\\/\\(.*\\)/\\1/" \
-          | sort | uniq \
-          >> $$param_file
-        echo ")" >> $$param_file
-        """ % (param_file, dirs_file),
-        outs = [param_file, dirs_file],
-        **kwargs
-    )
-
-    # Build the wrapper library that links directly to all dependencies.
-    # Loading the wrapper ensures that the transitive dependencies are found
-    # in the final closure no matter how the runpaths of the direct
-    # dependencies were set.
-    native.cc_binary(
-        name = wrapper_lib,
-        linkshared = not executable,
-        linkopts = [
-            "-Wl,-rpath=$$ORIGIN",
-            "$(location %s)" % param_file,
-            "-T$(location %s)" % dirs_file,
-        ],
-        srcs = [srclibs],
-        deps = [param_file, dirs_file],
-        **kwargs
-    )
-
-    # Copy the libraries to a folder and zip them
-    native.genrule(
-        name = name,
-        srcs = [libs_file, wrapper_lib, srclibs],
-        cmd = """
-        set -euo pipefail
-        libs_file="$(location %s)"
-        outputdir="%s"
-        excludes="%s"
-        srclibs="$(locations %s)"
-        wrapper_lib="$(location %s)"
-        tmpdir=$$(mktemp -d)
-
-        # Put srclibs and the wrapper_lib names in an associative array
-        declare -A srcnames
-        for i in $${wrapper_lib} $${srclibs}
-        do
-            srcnames["$${i##*/}"]=1
-        done
-        # Keep the libraries which are not in SRCS
-        declare -a libs=()
-        while read i
-        do
-            if [ ! $${srcnames["$${i##*/}"]+defined} ]
-            then
-                echo "$$i" | {
-                    read -r -d $$'\t' name
-                    read -r path
-                    cp "$$path" "$$tmpdir/$$name"
-                }
-            fi
-        done < <(cat $$libs_file)
-        cp "$${wrapper_lib}" $${srclibs} $$tmpdir
-
-        mkdir -p "$$outputdir"
-        zip -X -qjr $@ $$tmpdir
-        rm -rf $$tmpdir
-
-        # Check that the excluded libraries have been really excluded.
-
-        # Check first that there are files to exclude.
-        [ "$$excludes" ] || exit 0
-
-        # Produce a file with regexes to exclude libs from the zip.
-        tmpx_file=$$(mktemp tmpexcludes_file.XXXXXX)
-        # Note: quotes are important in shell expansion to preserve newlines.
-        echo "$$excludes" > $$tmpx_file
-
-        # Check that excluded libraries don't appear in the zip file.
-        if unzip -t $@ \
-            | grep -e '^[ ]*testing: ' \
-            | sed "s/^[ ]*testing: \\([^ ]*\\).*/\\1/" \
-            | grep -Ef $$tmpx_file
-        then
-            echo "library_closure: lint: Some files were not excluded."
-            exit 1
-        fi
-
-        rm -rf $$tmpx_file
-        """ % (libs_file, outputdir, "\n".join(excludes), srclibs, wrapper_lib),
-        outs = [outzip],
-        **kwargs
-    )
+    """,
+)
 
 def binary_closure(name, src, excludes = [], **kwargs):
     """
@@ -377,7 +222,7 @@ def binary_closure(name, src, excludes = [], **kwargs):
       binary_closure(
           name = "closure"
           src = "hello-cc"
-          excludes = ["libexclude_this\.so", "libthis_too\.so"]
+          excludes = ["libexclude_this\\.so", "libthis_too\\.so"]
           ...
       )
       ```
@@ -405,21 +250,20 @@ def binary_closure(name, src, excludes = [], **kwargs):
         srcs = [zip_name],
         cmd = """
     set -eu
-    zip_name="{zip_name}"
     zip_file_path="$(SRCS)"
 
     cat - "$$zip_file_path" > $@ <<END
     #!/usr/bin/env bash
     set -eu
-    tmpdir=\$$(mktemp -d)
-    trap "rm -rf '\$$tmpdir'" EXIT
-    unzip -q "\$$0" -d "\$$tmpdir" 2> /dev/null || true
-    "\$$tmpdir/{zip_name}_wrapper"
+    tmpdir=\\$$(mktemp -d)
+    trap "rm -rf '\\$$tmpdir'" EXIT
+    unzip -q "\\$$0" -d "\\$$tmpdir" 2> /dev/null || true
+    "\\$$tmpdir/clodl-exe-top"
     exit 0
 END
     chmod +x $@
 
-    """.format(zip_name = zip_name),
+    """,
         executable = True,
         outs = [name + ".sh"],
         **kwargs
diff --git a/docs/BUILD b/docs/BUILD
index c652dbe..79f2f07 100644
--- a/docs/BUILD
+++ b/docs/BUILD
@@ -1,8 +1,17 @@
 load("@io_bazel_stardoc//stardoc:stardoc.bzl", "stardoc")
+load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
 
 stardoc(
     name = "docs",
-    input = "//clodl:clodl.bzl",
     out = "doc.md",
-    deps = ["@bazel_skylib//lib:paths"],
+    input = "//clodl:clodl.bzl",
+    deps = [
+        ":refs",
+        "@bazel_skylib//lib:paths",
+    ],
+)
+
+bzl_library(
+    name = "refs",
+    srcs = ["@bazel_tools//tools:bzl_srcs"],
 )
diff --git a/shell.nix b/shell.nix
index f41d260..b19652a 100644
--- a/shell.nix
+++ b/shell.nix
@@ -15,5 +15,7 @@ mkShell {
     unzip
     which
     zip
+    # convenience dependencies
+    less
   ];
 }
diff --git a/src/main/bash/deps.sh b/src/main/bash/deps.sh
index bc72d40..a46a6fb 100755
--- a/src/main/bash/deps.sh
+++ b/src/main/bash/deps.sh
@@ -106,7 +106,7 @@ traverse_deps() {
     do
         if [ ! ${dont_print["$lib"]+defined} ]
         then
-           echo -en "$lib\t"; realpath ${paths["$lib"]}
+           echo ${paths["$lib"]}
            dont_print["$lib"]=1
            traverse_deps "${paths["$lib"]}"
         fi