From 1da0d432e624c1b25e69d3ee2ac04ba9f38cd962 Mon Sep 17 00:00:00 2001
From: Timofey Kirillov <timofey.kirillov@flant.com>
Date: Thu, 7 Oct 2021 19:04:08 +0300
Subject: [PATCH] fix(stapel): rebuild stapel to fix expired certificates
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

```
│ │ x/install  ┌ apt_key 'Add postgres repo key'
│ │ x/install  │ Failed to validate the SSL certificate for www.postgresql.org:443. Make sure your managed systems have a valid CA certificate         ↵
│ │ x/install  │ installed. You can use validate_certs=False if you do not need to confirm the servers identity but this is unsafe and not             ↵
│ │ x/install  │ recommended. Paths checked for this platform: /etc/ssl/certs, /etc/pki/ca-trust/extracted/pem, /etc/pki/tls/certs,                    ↵
│ │ x/install  │ /usr/share/ca-certificates/cacert.org, /etc/ansible. The exception msg was: [SSL: CERTIFICATE_VERIFY_FAILED] certificate verify       ↵
│ │ x/install  │ failed (_ssl.c:581).
│ │ x/install  └ apt_key 'Add postgres repo key' (3.29 seconds) FAILED
│ │ x/install
│ │ x/install
│ │ x/install  Failed task configuration:
│ │ x/install
│ │ x/install      apt_key:
│ │ x/install        url: https://www.postgresql.org/media/keys/ACCC4CF8.asc
│ │ x/install      name: Add postgres repo key
│ │ x/install
```

=>

```
│ │ x/install  ┌ apt_key 'Add postgres repo key'
│ │ x/install  └ apt_key 'Add postgres repo key' (1.98 seconds)
```
---
 pkg/stapel/stapel.go                      |   4 +-
 scripts/stapel/build.sh                   |   4 +-
 scripts/stapel/publish.sh                 |   7 +-
 stapel/Dockerfile                         | 111 ++++++++++----
 stapel/omnibus/Gemfile                    |   3 +-
 stapel/omnibus/Gemfile.lock               | 121 +++++++++-------
 stapel/omnibus/config/software/ansible.rb |   1 +
 stapel/omnibus/config/software/curl.rb    | 104 ++++++++++++++
 stapel/omnibus/config/software/git.rb     |   8 +-
 stapel/omnibus/config/software/gtar.rb    |  17 +--
 stapel/omnibus/config/software/pip.rb     |   2 +-
 stapel/omnibus/config/software/python.rb  |  66 ---------
 stapel/wget-list-after-omnibus            |  10 +-
 stapel/wget-list-after-omnibus.md5sums    |  10 +-
 stapel/wget-list-before-omnibus           | 168 +++++++++++-----------
 stapel/wget-list-before-omnibus.md5sums   | 146 ++++++++++---------
 16 files changed, 447 insertions(+), 335 deletions(-)
 create mode 100644 stapel/omnibus/config/software/curl.rb
 delete mode 100644 stapel/omnibus/config/software/python.rb

diff --git a/pkg/stapel/stapel.go b/pkg/stapel/stapel.go
index 291db73a25..494ac1aff6 100644
--- a/pkg/stapel/stapel.go
+++ b/pkg/stapel/stapel.go
@@ -12,8 +12,8 @@ import (
 	"github.com/werf/werf/pkg/docker"
 )
 
-const VERSION = "0.6.1"
-const IMAGE = "flant/werf-stapel"
+const VERSION = "0.7.0"
+const IMAGE = "ghcr.io/werf/stapel"
 
 func getVersion() string {
 	version := VERSION
diff --git a/scripts/stapel/build.sh b/scripts/stapel/build.sh
index 194afcf504..a58484d0fb 100755
--- a/scripts/stapel/build.sh
+++ b/scripts/stapel/build.sh
@@ -2,5 +2,5 @@
 
 set -e
 
-docker build -t flant/werf-stapel-base:dev --target base --file stapel/Dockerfile .
-docker build -t flant/werf-stapel:dev --target final --file stapel/Dockerfile .
+docker build -t ghcr.io/werf/stapel-base:dev --target base --file stapel/Dockerfile .
+docker build -t ghcr.io/werf/stapel:dev --target final --file stapel/Dockerfile .
diff --git a/scripts/stapel/publish.sh b/scripts/stapel/publish.sh
index 346b9f8065..bc7068872e 100755
--- a/scripts/stapel/publish.sh
+++ b/scripts/stapel/publish.sh
@@ -9,5 +9,8 @@ fi
 
 VERSION=$1
 
-docker tag flant/werf-stapel:dev flant/werf-stapel:$VERSION
-docker push flant/werf-stapel:$VERSION
+#docker tag ghcr.io/werf/stapel-base:dev ghcr.io/werf/stapel-base:$VERSION
+#docker push ghcr.io/werf/stapel-base:$VERSION
+
+docker tag ghcr.io/werf/stapel:dev ghcr.io/werf/stapel:$VERSION
+docker push ghcr.io/werf/stapel:$VERSION
diff --git a/stapel/Dockerfile b/stapel/Dockerfile
index 7c0eb6df4a..730f3d4f3f 100644
--- a/stapel/Dockerfile
+++ b/stapel/Dockerfile
@@ -7,10 +7,12 @@ echo "umask 022" >> /root/.profile
 
 SHELL ["/bin/bash", "-lc"]
 
+ENV DEBIAN_FRONTEND=noninteractive
+
 RUN apt update && apt install -y \
 build-essential wget curl gawk flex bison bzip2 liblzma5 texinfo file \
 gettext python python3 curl git fakeroot gettext gpg ruby ruby-bundler \
-ruby-dev make file m4 xz-utils texlive vim
+ruby-dev make file m4 xz-utils texlive vim rsync
 
 RUN git config --global user.name flant && git config --global user.email 256@flant.com
 
@@ -20,8 +22,8 @@ ENV LFS_TGT=x86_64-lfs-linux-gnu
 
 RUN mkdir -pv $LFS$TOOLS && mkdir -pv $LFS/sources && chmod -v a+wt $LFS/sources
 ADD stapel/wget-list-before-omnibus $LFS/sources/wget-list-before-omnibus
+RUN wget --input-file=$LFS/sources/wget-list-before-omnibus --continue --directory-prefix=$LFS/sources || true
 ADD stapel/wget-list-before-omnibus.md5sums $LFS/sources/wget-list-before-omnibus.md5sums
-RUN wget --input-file=$LFS/sources/wget-list-before-omnibus --continue --directory-prefix=$LFS/sources
 RUN bash -c "pushd $LFS/sources && md5sum -c $LFS/sources/wget-list-before-omnibus.md5sums && popd"
 ADD stapel/version-check.sh $LFS/sources/version-check.sh
 RUN $LFS/sources/version-check.sh
@@ -69,6 +71,7 @@ cd build && \
 --with-sysroot=$LFS \
 --with-newlib \
 --without-headers \
+--enable-initfini-array \
 --with-local-prefix=$TOOLS \
 --with-native-system-header-dir=$TOOLS/include \
 --disable-nls \
@@ -105,18 +108,18 @@ cd build && \
 ../configure \
 --prefix=$TOOLS \
 --host=$LFS_TGT \
---build=$(../scripts/config.guess) \
 --enable-kernel=3.2 \
 --with-headers=$TOOLS/include \
 libc_cv_forced_unwind=yes \
-libc_cv_c_cleanup=yes
+libc_cv_c_cleanup=yes \
+libc_cv_slibdir=$TOOLS/lib
 WORKDIR $LFS/sources/glibc/build
 RUN make
 RUN make install
 RUN mkdir /.werf/stapel/lib/locale
 RUN /.werf/stapel/bin/localedef -i POSIX -f UTF-8 C.UTF-8 || true
 
-RUN echo "Libstdc++" && cd $LFS/sources/ && \
+RUN echo "Libstdc++ pass 1" && cd $LFS/sources/ && \
 rm -rf gcc && \
 mkdir gcc && \
 tar xf gcc-*.tar.* -C gcc --strip-components 1 && \
@@ -135,9 +138,9 @@ cd build && \
 --prefix=$TOOLS \
 --disable-multilib \
 --disable-nls \
---disable-libstdcxx-threads \
 --disable-libstdcxx-pch \
---with-gxx-include-dir=$TOOLS/$LFS_TGT/include/c++/8.2.0
+--disable-libstdcxx-threads \
+--with-gxx-include-dir=$TOOLS/$LFS_TGT/include/c++/11.2.0
 WORKDIR $LFS/sources/gcc/build
 RUN make
 RUN make install
@@ -154,10 +157,12 @@ AR=$LFS_TGT-ar \
 RANLIB=$LFS_TGT-ranlib \
 ../configure \
 --prefix=$TOOLS \
+--host=$LFS_TGT \
 --disable-nls \
+--enable-shared \
 --disable-werror \
---with-lib-path=$TOOLS/lib \
---with-sysroot
+--enable-64-bit-bfd \
+--with-lib-path=$TOOLS/lib
 
 RUN echo "GCC pass 2" && cd $LFS/sources/ && \
 rm -rf gcc && \
@@ -180,25 +185,42 @@ CXX=$LFS_TGT-g++ \
 AR=$LFS_TGT-ar \
 RANLIB=$LFS_TGT-ranlib \
 ../configure \
+--target=$LFS_TGT \
 --prefix=$TOOLS \
+CC_FOR_TARGET=$LFS_TGT-gcc \
+--with-build-sysroot=$LFS \
+--enable-initfini-array \
+--disable-nls \
+--disable-multilib \
+--disable-decimal-float \
+--disable-libatomic \
+--disable-libgomp \
+--disable-libquadmath \
+--disable-libssp \
+--disable-libvtv \
+--disable-libstdcxx \
+--disable-lto \
 --with-local-prefix=$TOOLS \
+--with-sysroot=$LFS \
 --with-native-system-header-dir=$TOOLS/include \
---enable-languages=c,c++ \
---disable-libstdcxx-pch \
---disable-multilib \
---disable-bootstrap \
---disable-libgomp
+--oldincludedir=$TOOLS/include \
+--enable-languages=c,c++
 WORKDIR $LFS/sources/gcc/build
 RUN make
-RUN make install
+RUN make DESTDIR=$LFS install
 RUN ln -sv gcc $TOOLS/bin/cc
 
+ENV PATH=/sbin:/usr/sbin:/usr/local/sbin:/bin:/usr/bin:/usr/local/bin
+RUN apt install -y libssl-dev autoconf automake libffi-dev libgdbm-dev libncurses5-dev libsqlite3-dev libtool libyaml-dev pkg-config sqlite3 zlib1g-dev libreadline-dev libssl-dev
+RUN curl -sSL https://rvm.io/mpapis.asc | gpg --import -
+RUN curl -sSL https://rvm.io/pkuczynski.asc | gpg --import -
+RUN curl -sSL https://get.rvm.io -o /tmp/rvm.sh && cat /tmp/rvm.sh | bash -s stable
+RUN source /etc/profile.d/rvm.sh && rvm install 2.7
+
 ADD stapel/omnibus /omnibus
 WORKDIR /omnibus
 ENV BUNDLE_GEMFILE=/omnibus/Gemfile
-
-ENV PATH=/bin:/usr/bin:/usr/local/bin
-RUN bundle install --without development
+RUN source /etc/profile.d/rvm.sh && bundle install --without development
 
 ENV PATH=$TOOLS/x86_64-lfs-linux-gnu/bin:$TOOLS/bin:$PATH
 
@@ -208,13 +230,18 @@ ENV PATH=$TOOLS/x86_64-lfs-linux-gnu/bin:$TOOLS/bin:$PATH
 # It is needed to remove that binary before omnibus-building.
 RUN mv $(which dpkg-architecture) /tmp/dpkg-architecture
 
-RUN bundle exec omnibus build -o append_timestamp:false werf-stapel
-ENV PKG_CONFIG=/.werf/stapel/embedded/bin/pkg-config
+RUN source /etc/profile.d/rvm.sh && bundle exec omnibus build -o append_timestamp:false werf-stapel
+
+ENV CC=$LFS_TGT-gcc
+ENV CXX=$LFS_TGT-g++
+ENV AR=$LFS_TGT-ar
+ENV RANLIB=$LFS_TGT-ranlib
+ENV CC_FOR_TARGET=$LFS_TGT-gcc
 ENV PKG_CONFIG_PATH="/.werf/stapel/lib/pkgconfig:/.werf/stapel/embedded/lib/pkgconfig"
 
 ADD stapel/wget-list-after-omnibus $LFS/sources/wget-list-after-omnibus
 ADD stapel/wget-list-after-omnibus.md5sums $LFS/sources/wget-list-after-omnibus.md5sums
-RUN wget --input-file=$LFS/sources/wget-list-after-omnibus --continue --directory-prefix=$LFS/sources
+RUN wget --input-file=$LFS/sources/wget-list-after-omnibus --continue --directory-prefix=$LFS/sources || true
 RUN bash -c "pushd $LFS/sources && md5sum -c $LFS/sources/wget-list-after-omnibus.md5sums && popd"
 
 # libgpg-error
@@ -302,7 +329,7 @@ RUN echo "gnupg" && cd $LFS/sources && \
 mkdir gnupg && \
 tar xf gnupg*.tar.* -C gnupg --strip-components 1
 WORKDIR $LFS/sources/gnupg
-RUN ./configure --prefix=$TOOLS --enable-symcryptrun --localstatedir=/.werf/stapel/var
+RUN ./configure --prefix=$TOOLS --enable-symcryptrun --localstatedir=/.werf/stapel/var --sysconfdir=/etc --disable-sqlite
 RUN make
 RUN make install
 
@@ -315,6 +342,15 @@ RUN ./configure --prefix=$TOOLS --without-python --disable-makeinstall-chown --w
 RUN make
 RUN make install
 
+# libffi
+RUN echo "libffi" && cd $LFS/sources && \
+mkdir libffi && \
+tar xf libffi-*.tar.* -C libffi --strip-components 1
+WORKDIR $LFS/sources/libffi
+RUN ./configure --prefix=$TOOLS --disable-static --with-gcc-arch=native
+RUN make
+RUN make install
+
 # glib
 RUN PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin apt update
 RUN PATH=/bin:/usr/bin:/usr/local/bin:/sbin:/usr/sbin:/usr/local/sbin apt install -y python3-pip xsltproc
@@ -323,7 +359,7 @@ RUN echo "glib" && cd $LFS/sources && \
 mkdir glib && \
 tar xf glib-*.tar* -C glib --strip-components 1
 WORKDIR $LFS/sources/glib
-RUN LDFLAGS="-Wl,-rpath-link,$TOOLS/embedded/lib,--library-path,$TOOLS/embedded/lib" meson _build -Diconv=external -Dman=false --prefix=$TOOLS -Dselinux=disabled
+RUN LDFLAGS="-static-libgcc -Wl,-rpath-link,$TOOLS/lib,-rpath-link,$TOOLS/x86_64-lfs-linux-gnu/lib,-rpath-link,$TOOLS/embedded/lib,--library-path,$TOOLS/lib,--library-path,$TOOLS/x86_64-lfs-linux-gnu/lib,--library-path,$TOOLS/embedded/lib" meson _build -Diconv=external -Dman=false --prefix=$TOOLS -Dselinux=disabled
 RUN ninja -C _build
 RUN ninja -C _build install
 
@@ -340,20 +376,24 @@ RUN make install
 ENV PATH=/sbin:/bin:/usr/sbin:/usr/bin:/usr/local/sbin:/usr/local/bin
 
 # Install golang
-RUN wget https://dl.google.com/go/go1.12.linux-amd64.tar.gz -O /tmp/go.tar.gz
+RUN wget https://dl.google.com/go/go1.17.linux-amd64.tar.gz -O /tmp/go.tar.gz
 RUN tar -C /usr/local -xzf /tmp/go.tar.gz
 ENV PATH=$PATH:/usr/local/go/bin
 ENV GO111MODULE=on
 
-WORKDIR /werf
-ADD go.mod /werf/go.mod
-ADD go.sum /werf/go.sum
-RUN bash -ec "echo '142.93.108.123 gonum.org www.gonum.org' >> /etc/hosts && go mod download -json"
+ENV CC=
+ENV CXX=
+ENV AR=
+ENV RANLIB=
+ENV CC_FOR_TARGET=
+ENV PKG_CONFIG_PATH=
+
+RUN go get github.com/werf/logboek@v0.5.4
+RUN cd /root/go/pkg/mod/github.com/werf/logboek@v0.5.4 && \
+go build -o $TOOLS/embedded/lib/python2.7/_logboek.so -buildmode=c-shared github.com/werf/logboek/c_lib && \
+cp logboek.py $TOOLS/embedded/lib/python2.7
 
-ADD cmd /werf/cmd
 ADD pkg /werf/pkg
-RUN go build -o $TOOLS/embedded/lib/python2.7/_logboek.so -buildmode=c-shared github.com/werf/logboek/c_lib
-RUN cp /root/go/pkg/mod/github.com/werf/logboek@*/logboek.py $TOOLS/embedded/lib/python2.7
 RUN cp /werf/pkg/build/builder/ansible/crypt.py $TOOLS/embedded/lib/python2.7
 
 # Ansible tools overlay takes precedence over PATH and library linker path (using LD_LIBRARY_PATH)
@@ -415,6 +455,15 @@ ln -fs $TOOLS/ubuntu_tools/lib/libapt-inst.so.2.0.0 $TOOLS/ansible_tools_overlay
 # TODO: FIXME: https://github.com/werf/werf/issues/1798
 # TODO: FIXME: try set nsswitch.conf file: http://www.linuxfromscratch.org/lfs/view/9.0-systemd-rc1/chapter06/glibc.html
 
+ENV CC=$LFS_TGT-gcc
+ENV CXX=$LFS_TGT-g++
+ENV AR=$LFS_TGT-ar
+ENV RANLIB=$LFS_TGT-ranlib
+ENV CC_FOR_TARGET=$LFS_TGT-gcc
+ENV PKG_CONFIG_PATH="/.werf/stapel/lib/pkgconfig:/.werf/stapel/embedded/lib/pkgconfig"
+
+ENV PATH=$TOOLS/x86_64-lfs-linux-gnu/bin:$TOOLS/bin:$PATH
+
 # yum-utils package needed for ansible yum module to work
 RUN apt update && \
 apt install -y libcurl4-openssl-dev libssl-dev && \
diff --git a/stapel/omnibus/Gemfile b/stapel/omnibus/Gemfile
index 1e164de11c..5aeec677f7 100644
--- a/stapel/omnibus/Gemfile
+++ b/stapel/omnibus/Gemfile
@@ -1,4 +1,5 @@
 source 'https://rubygems.org'
 
 gem 'omnibus'
-gem 'omnibus-software', github: 'chef/omnibus-software'
+gem 'omnibus-software', github: 'chef/omnibus-software', branch: 'main'
+gem 'thor', '~> 0.20.3'
diff --git a/stapel/omnibus/Gemfile.lock b/stapel/omnibus/Gemfile.lock
index 58dda997ee..f8e1e9f931 100644
--- a/stapel/omnibus/Gemfile.lock
+++ b/stapel/omnibus/Gemfile.lock
@@ -1,63 +1,71 @@
 GIT
-  remote: git://github.com/chef/omnibus-software.git
-  revision: b9e06cf4c0f6cbd5e5bd5e9bc41b30262dfe635f
+  remote: https://github.com/chef/omnibus-software.git
+  revision: a2a70e2a57c8061dcd507f2771cea84483d4257a
+  branch: main
   specs:
     omnibus-software (4.0.0)
-      chef-sugar (>= 3.4.0)
-      omnibus (>= 5.6.1)
+      omnibus (>= 8.0.0)
 
 GEM
   remote: https://rubygems.org/
   specs:
     addressable (2.8.0)
       public_suffix (>= 2.0.2, < 5.0)
-    awesome_print (1.8.0)
-    aws-eventstream (1.0.3)
-    aws-partitions (1.212.0)
-    aws-sdk-core (3.67.0)
-      aws-eventstream (~> 1.0, >= 1.0.2)
-      aws-partitions (~> 1.0)
+    awesome_print (1.9.2)
+    aws-eventstream (1.2.0)
+    aws-partitions (1.514.0)
+    aws-sdk-core (3.121.1)
+      aws-eventstream (~> 1, >= 1.0.2)
+      aws-partitions (~> 1, >= 1.239.0)
       aws-sigv4 (~> 1.1)
       jmespath (~> 1.0)
-    aws-sdk-kms (1.24.0)
-      aws-sdk-core (~> 3, >= 3.61.1)
+    aws-sdk-kms (1.49.0)
+      aws-sdk-core (~> 3, >= 3.120.0)
       aws-sigv4 (~> 1.1)
-    aws-sdk-s3 (1.48.0)
-      aws-sdk-core (~> 3, >= 3.61.1)
+    aws-sdk-s3 (1.103.0)
+      aws-sdk-core (~> 3, >= 3.120.0)
       aws-sdk-kms (~> 1)
-      aws-sigv4 (~> 1.1)
-    aws-sigv4 (1.1.0)
-      aws-eventstream (~> 1.0, >= 1.0.2)
-    chef-config (15.3.14)
+      aws-sigv4 (~> 1.4)
+    aws-sigv4 (1.4.0)
+      aws-eventstream (~> 1, >= 1.0.2)
+    chef-cleanroom (1.0.4)
+    chef-config (16.16.13)
       addressable
+      chef-utils (= 16.16.13)
       fuzzyurl
       mixlib-config (>= 2.2.12, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
       tomlrb (~> 1.2)
-    chef-sugar (5.0.1)
+    chef-utils (16.16.13)
     citrus (3.0.2)
-    cleanroom (1.0.0)
-    ffi (1.11.1)
-    ffi-yajl (2.3.1)
-      libyajl2 (~> 1.2)
+    contracts (0.16.1)
+    ffi (1.15.4)
+    ffi-yajl (2.4.0)
+      libyajl2 (>= 1.2)
     fuzzyurl (0.9.0)
     iostruct (0.0.4)
     ipaddress (0.8.3)
     jmespath (1.4.0)
-    libyajl2 (1.2.0)
-    license_scout (1.0.24)
+    json (2.5.1)
+    libyajl2 (2.1.0)
+    license_scout (1.2.13)
       ffi-yajl (~> 2.2)
-      mixlib-shellout (~> 2.2)
-      toml-rb (~> 1.0)
-    mixlib-cli (2.1.1)
-    mixlib-config (3.0.1)
+      mixlib-shellout (>= 2.2, < 4.0)
+      toml-rb (>= 1, < 3)
+    mixlib-cli (2.1.8)
+    mixlib-config (3.0.9)
       tomlrb
-    mixlib-log (3.0.1)
-    mixlib-shellout (2.4.4)
-    mixlib-versioning (1.2.7)
-    multipart-post (2.0.0)
-    ohai (15.3.1)
-      chef-config (>= 12.8, < 16)
+    mixlib-log (3.0.9)
+    mixlib-shellout (3.2.5)
+      chef-utils
+    mixlib-versioning (1.2.12)
+    multipart-post (2.1.1)
+    net-scp (3.0.0)
+      net-ssh (>= 2.6.5, < 7.0.0)
+    net-ssh (6.1.0)
+    ohai (16.13.0)
+      chef-config (>= 12.8, < 17)
+      chef-utils (>= 16.0, < 17)
       ffi (~> 1.9)
       ffi-yajl (~> 2.2)
       ipaddress
@@ -66,36 +74,43 @@ GEM
       mixlib-log (>= 2.0.1, < 4.0)
       mixlib-shellout (>= 2.0, < 4.0)
       plist (~> 3.1)
-      systemu (~> 2.6.4)
+      train-core
       wmi-lite (~> 1.0)
-    omnibus (6.0.30)
+    omnibus (8.2.2)
       aws-sdk-s3 (~> 1)
-      chef-sugar (>= 3.3)
-      cleanroom (~> 1.0)
+      chef-cleanroom (~> 1.0)
+      chef-utils (>= 15.4)
+      contracts (>= 0.16.0, < 0.17.0)
       ffi-yajl (~> 2.2)
       license_scout (~> 1.0)
       mixlib-shellout (>= 2.0, < 4.0)
       mixlib-versioning
-      ohai (>= 13, < 16)
+      ohai (>= 15, < 17)
       pedump
       ruby-progressbar (~> 1.7)
-      thor (~> 0.18)
-    pedump (0.5.2)
+      thor (>= 0.18, < 2.0)
+    pedump (0.6.2)
       awesome_print
       iostruct (>= 0.0.4)
-      multipart-post (~> 2.0.0)
-      progressbar
+      multipart-post (>= 2.0.0)
+      rainbow
       zhexdump (>= 0.0.2)
-    plist (3.5.0)
-    progressbar (1.10.1)
+    plist (3.6.0)
     public_suffix (4.0.6)
-    ruby-progressbar (1.10.1)
-    systemu (2.6.5)
+    rainbow (3.0.0)
+    ruby-progressbar (1.11.0)
     thor (0.20.3)
-    toml-rb (1.1.2)
+    toml-rb (2.0.1)
       citrus (~> 3.0, > 3.0)
-    tomlrb (1.2.8)
-    wmi-lite (1.0.2)
+    tomlrb (1.3.0)
+    train-core (3.8.1)
+      addressable (~> 2.5)
+      ffi (!= 1.13.0)
+      json (>= 1.8, < 3.0)
+      mixlib-shellout (>= 2.0, < 4.0)
+      net-scp (>= 1.2, < 4.0)
+      net-ssh (>= 2.9, < 7.0)
+    wmi-lite (1.0.5)
     zhexdump (0.0.2)
 
 PLATFORMS
@@ -104,6 +119,4 @@ PLATFORMS
 DEPENDENCIES
   omnibus
   omnibus-software!
-
-BUNDLED WITH
-   1.16.1
+  thor (~> 0.20.3)
diff --git a/stapel/omnibus/config/software/ansible.rb b/stapel/omnibus/config/software/ansible.rb
index f6b0648ebd..4de07e30a3 100644
--- a/stapel/omnibus/config/software/ansible.rb
+++ b/stapel/omnibus/config/software/ansible.rb
@@ -2,6 +2,7 @@
 
 ANSIBLE_GIT_TAG = "v2.7.15"
 
+dependency "libyaml"
 dependency "python"
 dependency "pip"
 
diff --git a/stapel/omnibus/config/software/curl.rb b/stapel/omnibus/config/software/curl.rb
new file mode 100644
index 0000000000..05f200113d
--- /dev/null
+++ b/stapel/omnibus/config/software/curl.rb
@@ -0,0 +1,104 @@
+#
+# Copyright:: Chef Software, Inc.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name "curl"
+default_version "7.79.1"
+
+dependency "zlib"
+dependency "openssl"
+dependency "cacerts"
+
+license "MIT"
+license_file "COPYING"
+skip_transitive_dependency_licensing true
+
+# version_list: url=https://curl.se/download/ filter=*.tar.gz
+version("7.79.1") { source sha256: "370b11201349816287fb0ccc995e420277fbfcaf76206e309b3f60f0eda090c2" }
+version("7.79.0") { source sha256: "aff0c7c4a526d7ecc429d2f96263a85fa73e709877054d593d8af3d136858074" }
+version("7.78.0") { source sha256: "ed936c0b02c06d42cf84b39dd12bb14b62d77c7c4e875ade022280df5dcc81d7" }
+version("7.77.0") { source sha256: "b0a3428acb60fa59044c4d0baae4e4fc09ae9af1d8a3aa84b2e3fbcd99841f77" }
+version("7.76.1") { source sha256: "5f85c4d891ccb14d6c3c701da3010c91c6570c3419391d485d95235253d837d7" }
+
+source url: "https://curl.haxx.se/download/curl-#{version}.tar.gz"
+
+relative_path "curl-#{version}"
+
+build do
+  env = with_standard_compiler_flags(with_embedded_path)
+
+  if freebsd?
+    # from freebsd ports - IPv6 Hostcheck patch
+    patch source: "curl-freebsd-hostcheck.patch", plevel: 1, env: env
+  end
+
+  delete "#{project_dir}/src/tool_hugehelp.c"
+
+  if aix?
+    # alpn doesn't appear to work on AIX when connecting to certain sites, most
+    # importantly for us https://www.github.com Since git uses libcurl under
+    # the covers, this functionality breaks the handshake on connection, giving
+    # a cryptic error. This patch essentially forces disabling of ALPN on AIX,
+    # which is not really what we want in a http/2 world, but we're not there
+    # yet.
+    patch_env = env.dup
+    patch_env["PATH"] = "/opt/freeware/bin:#{env["PATH"]}" if aix?
+    patch source: "curl-aix-disable-alpn.patch", plevel: 0, env: patch_env
+
+    # otherwise gawk will die during ./configure with variations on the theme of:
+    # "/opt/omnibus-toolchain/embedded/lib/libiconv.a(shr4.o) could not be loaded"
+    env["LIBPATH"] = "/usr/lib:/lib"
+  elsif solaris2?
+    # Without /usr/gnu/bin first in PATH the libtool fails during make on Solaris
+    env["PATH"] = "/usr/gnu/bin:#{env["PATH"]}"
+  end
+
+  env["LIBS"] ||= ""
+  env["LIBS"] += "-ldl -lz"
+
+  configure_options = [
+    "--prefix=#{install_dir}/embedded",
+    "--disable-option-checking",
+    "--disable-manual",
+    "--disable-debug",
+    "--enable-optimize",
+    "--disable-ldap",
+    "--disable-ldaps",
+    "--disable-rtsp",
+    "--enable-proxy",
+    "--disable-pop3",
+    "--disable-imap",
+    "--disable-smtp",
+    "--disable-gopher",
+    "--disable-dependency-tracking",
+    "--enable-ipv6",
+    "--without-libidn2",
+    "--without-gnutls",
+    "--without-librtmp",
+    "--without-zsh-functions-dir",
+    "--without-fish-functions-dir",
+    "--disable-mqtt",
+    "--with-ssl=#{install_dir}/embedded",
+    #"--without-ssl",
+    "--with-zlib=#{install_dir}/embedded",
+    "--with-ca-bundle=#{install_dir}/embedded/ssl/certs/cacert.pem",
+    "--without-zstd",
+  ]
+
+  configure(*configure_options, env: env)
+
+  make "-j #{workers}", env: env
+  make "install", env: env
+end
diff --git a/stapel/omnibus/config/software/git.rb b/stapel/omnibus/config/software/git.rb
index 6e7c650d38..0ca6c657f8 100644
--- a/stapel/omnibus/config/software/git.rb
+++ b/stapel/omnibus/config/software/git.rb
@@ -9,7 +9,7 @@
 dependency "zlib"
 dependency "openssl"
 dependency "pcre"
-dependency "libiconv" # FIXME: can we figure out how to remove this?
+#dependency "libiconv" # FIXME: can we figure out how to remove this?
 dependency "expat"
 
 relative_path "git-#{version}"
@@ -36,6 +36,9 @@
   env = with_standard_compiler_flags(with_embedded_path)
   env["LDFLAGS"] += " -Wl,-rpath-link,/.werf/stapel/embedded/lib"
 
+  env["EXTLIBS"] ||= ""
+  env["EXTLIBS"] += "-ldl -lz"
+
   make "distclean"
 
   config_hash = {
@@ -46,6 +49,9 @@
     NO_PERL: "YesPlease",
     NO_PYTHON: "YesPlease",
     NO_TCLTK: "YesPlease",
+    NO_OPENSSL: "YesPlease",
+    NO_ICONV: "YesPlease",
+    EXTLIBS: "-ldl -lz"
   }
 
   # Linux things!
diff --git a/stapel/omnibus/config/software/gtar.rb b/stapel/omnibus/config/software/gtar.rb
index 3bb325ac59..e9a9a58484 100644
--- a/stapel/omnibus/config/software/gtar.rb
+++ b/stapel/omnibus/config/software/gtar.rb
@@ -45,19 +45,14 @@
     configure_command << " --without-selinux"
   end
 
-  if nexus? || ios_xr?
-    # ios_xr and nexus don't support posix acls
+  if s390x?
+    # s390x doesn't support posix acls
     configure_command << " --without-posix-acls"
-  elsif osx?
-    # lovingly borrowed from the awesome Homebrew project, thank you!
-    # https://github.com/Homebrew/homebrew-core/blob/de3b1aeec9cc8d36f849b0ae959ee4b7f6610c1f/Formula/gnu-tar.rb
-    patch source: "gnutar-configure-xattrs.patch", env: env
-    env["gl_cv_func_getcwd_abort_bug"] = "no"
-  elsif aix?
-    # AIX has a gross patch that is required since xlc gets confused by too many #ifndefs
+  elsif aix? && version.satisfies?("< 1.32")
+    # xlc doesn't allow duplicate entries in case statements
     patch_env = env.dup
-    patch_env["PATH"] = "/opt/freeware/bin:#{env['PATH']}"
-    patch source: "aix_ifndef.patch", plevel: 0, env: patch_env
+    patch_env["PATH"] = "/opt/freeware/bin:#{env["PATH"]}"
+    patch source: "aix_extra_case.patch", plevel: 0, env: patch_env
   end
 
   command configure_command.join(" "), env: env
diff --git a/stapel/omnibus/config/software/pip.rb b/stapel/omnibus/config/software/pip.rb
index 095355ad01..6e2528fb04 100644
--- a/stapel/omnibus/config/software/pip.rb
+++ b/stapel/omnibus/config/software/pip.rb
@@ -3,5 +3,5 @@
 dependency "python"
 
 build do
-  command "curl https://bootstrap.pypa.io/get-pip.py | #{install_dir}/embedded/bin/python"
+  command "curl https://bootstrap.pypa.io/pip/2.7/get-pip.py | #{install_dir}/embedded/bin/python"
 end
diff --git a/stapel/omnibus/config/software/python.rb b/stapel/omnibus/config/software/python.rb
deleted file mode 100644
index 48da55e4dc..0000000000
--- a/stapel/omnibus/config/software/python.rb
+++ /dev/null
@@ -1,66 +0,0 @@
-#
-# Copyright 2013-2015 Chef Software, Inc.
-#
-# Licensed under the Apache License, Version 2.0 (the "License");
-# you may not use this file except in compliance with the License.
-# You may obtain a copy of the License at
-#
-#     http://www.apache.org/licenses/LICENSE-2.0
-#
-# Unless required by applicable law or agreed to in writing, software
-# distributed under the License is distributed on an "AS IS" BASIS,
-# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
-# See the License for the specific language governing permissions and
-# limitations under the License.
-#
-
-name "python"
-default_version "2.7.9"
-
-license "Python-2.0"
-license_file "LICENSE"
-skip_transitive_dependency_licensing true
-
-dependency "ncurses"
-dependency "zlib"
-dependency "openssl"
-dependency "bzip2"
-dependency "sqlite3"
-
-version("2.7.13") { source md5: "17add4bf0ad0ec2f08e0cae6d205c700" }
-version("2.7.11") { source md5: "6b6076ec9e93f05dd63e47eb9c15728b" }
-version("2.7.9") { source md5: "5eebcaa0030dc4061156d3429657fb83" }
-version("2.7.5") { source md5: "b4f01a1d0ba0b46b05c73b2ac909b1df" }
-
-source url: "https://python.org/ftp/python/#{version}/Python-#{version}.tgz"
-
-relative_path "Python-#{version}"
-
-build do
-  env = with_standard_compiler_flags(with_embedded_path)
-
-  if mac_os_x?
-    os_x_release = ohai["platform_version"].match(/([0-9]+\.[0-9]+).*/).captures[0]
-    env["MACOSX_DEPLOYMENT_TARGET"] = os_x_release
-  end
-
-  command "./configure" \
-          " --prefix=#{install_dir}/embedded" \
-          " --enable-shared" \
-          " --with-dbmliborder=" \
-          " --enable-ipv6" \
-          " --enable-unicode=ucs4" \
-          " --with-dbmliborder=bdb:gdbm" \
-          " --with-system-expat" \
-          " --with-computed-gotos" \
-          , env: env
-
-  make env: env
-  make "install", env: env
-
-  # There exists no configure flag to tell Python to not compile readline
-  delete "#{install_dir}/embedded/lib/python2.7/lib-dynload/readline.*"
-
-  # Remove unused extension which is known to make healthchecks fail on CentOS 6
-  delete "#{install_dir}/embedded/lib/python2.7/lib-dynload/_bsddb.*"
-end
diff --git a/stapel/wget-list-after-omnibus b/stapel/wget-list-after-omnibus
index 89500e1d34..deff7dccef 100644
--- a/stapel/wget-list-after-omnibus
+++ b/stapel/wget-list-after-omnibus
@@ -1,13 +1,11 @@
 ftp://ftp.gnupg.org/gcrypt/libgpg-error/libgpg-error-1.36.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libassuan/libassuan-2.5.3.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libksba/libksba-1.3.5.tar.bz2
-ftp://ftp.gnupg.org/gcrypt/gnupg/gnupg-2.2.17.tar.bz2
+https://www.gnupg.org/ftp/gcrypt/gnupg/gnupg-2.2.29.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/libgcrypt/libgcrypt-1.8.5.tar.bz2
 ftp://ftp.gnupg.org/gcrypt/npth/npth-1.6.tar.bz2
-ftp://ftp.gnu.org/gnu/gmp/gmp-6.1.2.tar.xz
-ftp://ftp.gnu.org/gnu/nettle/nettle-3.5.1.tar.gz
-ftp://ftp.gnupg.org/gcrypt/gnutls/v3.6/gnutls-3.6.9.tar.xz
+https://ftp.gnu.org/gnu/nettle/nettle-3.7.3.tar.gz
+https://www.gnupg.org/ftp/gcrypt/gnutls/v3.7/gnutls-3.7.2.tar.xz
 https://github.com/p11-glue/p11-kit/releases/download/0.23.16.1/p11-kit-0.23.16.1.tar.gz
-http://ftp.gnome.org/pub/gnome/sources/glib/2.62/glib-2.62.3.tar.xz
-https://www.kernel.org/pub/linux/utils/util-linux/v2.33/util-linux-2.33.1.tar.xz
+http://ftp.gnome.org/pub/gnome/sources/glib/2.70/glib-2.70.0.tar.xz
 http://xmlsoft.org/sources/libxml2-2.9.10.tar.gz
diff --git a/stapel/wget-list-after-omnibus.md5sums b/stapel/wget-list-after-omnibus.md5sums
index 9446a95969..fab2e5347c 100644
--- a/stapel/wget-list-after-omnibus.md5sums
+++ b/stapel/wget-list-after-omnibus.md5sums
@@ -1,13 +1,11 @@
 eff437f397e858a9127b76c0d87fa5ed libgpg-error-1.36.tar.bz2
 226c504ea78a232224bf3b6846b3adb9 libassuan-2.5.3.tar.bz2
 8302a3e263a7c630aa7dea7d341f07a2 libksba-1.3.5.tar.bz2
-1ba2d9b70c377f8e967742064c27a19c gnupg-2.2.17.tar.bz2
+5db3334b528cf756b1e583db01319a24 gnupg-2.2.29.tar.bz2
 348cc4601ca34307fc6cd6c945467743 libgcrypt-1.8.5.tar.bz2
 375d1a15ad969f32d25f1a7630929854 npth-1.6.tar.bz2
-f58fa8001d60c4c77595fbbb62b63c1d gmp-6.1.2.tar.xz
-0e5707b418c3826768d41130fbe4ee86 nettle-3.5.1.tar.gz
-a36cb11809d31268b6ddd17cb38b92bb gnutls-3.6.9.tar.xz
+a60273d0fab9c808646fcf5e9edc2e8f nettle-3.7.3.tar.gz
+95c32a1af583ecfcb280648874c0fbd9 gnutls-3.7.2.tar.xz
 090a9cf689efd8d4899600c3093b3735 p11-kit-0.23.16.1.tar.gz
-9766a37736974e636227d62f86bae40e glib-2.62.3.tar.xz
-6fcfea2043b5ac188fd3eed56aeb5d90 util-linux-2.33.1.tar.xz
+4b08228707d28a9f23f7369902f4b166 glib-2.70.0.tar.xz
 10942a1dc23137a8aa07f0639cbfece5 libxml2-2.9.10.tar.gz
diff --git a/stapel/wget-list-before-omnibus b/stapel/wget-list-before-omnibus
index e9bcff3caf..45753073b7 100644
--- a/stapel/wget-list-before-omnibus
+++ b/stapel/wget-list-before-omnibus
@@ -1,86 +1,92 @@
-http://download.savannah.gnu.org/releases/acl/acl-2.2.53.tar.gz
-http://download.savannah.gnu.org/releases/attr/attr-2.4.48.tar.gz
-http://ftp.gnu.org/gnu/autoconf/autoconf-2.69.tar.xz
-http://ftp.gnu.org/gnu/automake/automake-1.16.1.tar.xz
-http://ftp.gnu.org/gnu/bash/bash-5.0.tar.gz
-http://ftp.gnu.org/gnu/bc/bc-1.07.1.tar.gz
-http://ftp.gnu.org/gnu/binutils/binutils-2.32.tar.xz
-http://ftp.gnu.org/gnu/bison/bison-3.3.2.tar.xz
-http://anduin.linuxfromscratch.org/LFS/bzip2-1.0.6.tar.gz
-https://github.com/libcheck/check/releases/download/0.12.0/check-0.12.0.tar.gz
-http://ftp.gnu.org/gnu/coreutils/coreutils-8.30.tar.xz
-https://dbus.freedesktop.org/releases/dbus/dbus-1.12.12.tar.gz
-http://ftp.gnu.org/gnu/dejagnu/dejagnu-1.6.2.tar.gz
-http://ftp.gnu.org/gnu/diffutils/diffutils-3.7.tar.xz
-https://downloads.sourceforge.net/project/e2fsprogs/e2fsprogs/v1.44.5/e2fsprogs-1.44.5.tar.gz
-https://sourceware.org/ftp/elfutils/0.176/elfutils-0.176.tar.bz2
-https://dev.gentoo.org/~blueness/eudev/eudev-3.2.7.tar.gz
-https://prdownloads.sourceforge.net/expat/expat-2.2.6.tar.bz2
+https://download.savannah.gnu.org/releases/acl/acl-2.3.1.tar.xz
+https://download.savannah.gnu.org/releases/attr/attr-2.5.1.tar.gz
+https://ftp.gnu.org/gnu/autoconf/autoconf-2.71.tar.xz
+https://ftp.gnu.org/gnu/automake/automake-1.16.4.tar.xz
+https://ftp.gnu.org/gnu/bash/bash-5.1.8.tar.gz
+https://github.com/gavinhoward/bc/releases/download/5.0.0/bc-5.0.0.tar.xz
+https://ftp.gnu.org/gnu/binutils/binutils-2.37.tar.xz
+https://ftp.gnu.org/gnu/bison/bison-3.7.6.tar.xz
+https://www.sourceware.org/pub/bzip2/bzip2-1.0.8.tar.gz
+https://github.com/libcheck/check/releases/download/0.15.2/check-0.15.2.tar.gz
+https://ftp.gnu.org/gnu/coreutils/coreutils-8.32.tar.xz
+https://dbus.freedesktop.org/releases/dbus/dbus-1.12.20.tar.gz
+https://ftp.gnu.org/gnu/dejagnu/dejagnu-1.6.3.tar.gz
+https://ftp.gnu.org/gnu/diffutils/diffutils-3.8.tar.xz
+https://downloads.sourceforge.net/project/e2fsprogs/e2fsprogs/v1.46.4/e2fsprogs-1.46.4.tar.gz
+https://sourceware.org/ftp/elfutils/0.185/elfutils-0.185.tar.bz2
+https://dev.gentoo.org/~blueness/eudev/eudev-3.2.10.tar.gz
+https://prdownloads.sourceforge.net/expat/expat-2.4.1.tar.xz
 https://prdownloads.sourceforge.net/expect/expect5.45.4.tar.gz
-ftp://ftp.astron.com/pub/file/file-5.36.tar.gz
-http://ftp.gnu.org/gnu/findutils/findutils-4.6.0.tar.gz
+https://astron.com/pub/file/file-5.40.tar.gz
+https://ftp.gnu.org/gnu/findutils/findutils-4.8.0.tar.xz
 https://github.com/westes/flex/releases/download/v2.6.4/flex-2.6.4.tar.gz
-http://ftp.gnu.org/gnu/gawk/gawk-4.2.1.tar.xz
-http://ftp.gnu.org/gnu/gcc/gcc-8.2.0/gcc-8.2.0.tar.xz
-http://ftp.gnu.org/gnu/gdbm/gdbm-1.18.1.tar.gz
-http://ftp.gnu.org/gnu/gettext/gettext-0.19.8.1.tar.xz
-http://ftp.gnu.org/gnu/glibc/glibc-2.29.tar.xz
-http://ftp.gnu.org/gnu/gmp/gmp-6.1.2.tar.xz
-http://ftp.gnu.org/gnu/gperf/gperf-3.1.tar.gz
-http://ftp.gnu.org/gnu/grep/grep-3.3.tar.xz
-http://ftp.gnu.org/gnu/groff/groff-1.22.4.tar.gz
-https://ftp.gnu.org/gnu/grub/grub-2.02.tar.xz
-http://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.xz
-http://anduin.linuxfromscratch.org/LFS/iana-etc-2.30.tar.bz2
-http://ftp.gnu.org/gnu/inetutils/inetutils-1.9.4.tar.xz
+https://ftp.gnu.org/gnu/gawk/gawk-5.1.0.tar.xz
+https://ftp.gnu.org/gnu/gcc/gcc-11.2.0/gcc-11.2.0.tar.xz
+https://ftp.gnu.org/gnu/gdbm/gdbm-1.20.tar.gz
+https://ftp.gnu.org/gnu/gettext/gettext-0.21.tar.xz
+https://ftp.gnu.org/gnu/glibc/glibc-2.34.tar.xz
+https://ftp.gnu.org/gnu/gmp/gmp-6.2.1.tar.xz
+https://ftp.gnu.org/gnu/gperf/gperf-3.1.tar.gz
+https://ftp.gnu.org/gnu/grep/grep-3.7.tar.xz
+https://ftp.gnu.org/gnu/groff/groff-1.22.4.tar.gz
+https://ftp.gnu.org/gnu/grub/grub-2.06.tar.xz
+https://ftp.gnu.org/gnu/gzip/gzip-1.10.tar.xz
+https://github.com/Mic92/iana-etc/releases/download/20210611/iana-etc-20210611.tar.gz
+https://ftp.gnu.org/gnu/inetutils/inetutils-2.1.tar.xz
 https://launchpad.net/intltool/trunk/0.51.0/+download/intltool-0.51.0.tar.gz
-https://www.kernel.org/pub/linux/utils/net/iproute2/iproute2-4.20.0.tar.xz
-https://www.kernel.org/pub/linux/utils/kbd/kbd-2.0.4.tar.xz
-https://www.kernel.org/pub/linux/utils/kernel/kmod/kmod-26.tar.xz
-http://www.greenwoodsoftware.com/less/less-530.tar.gz
-http://www.linuxfromscratch.org/lfs/downloads/8.4/lfs-bootscripts-20180820.tar.bz2
-https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.26.tar.xz
-ftp://sourceware.org/pub/libffi/libffi-3.2.1.tar.gz
-http://download.savannah.gnu.org/releases/libpipeline/libpipeline-1.5.1.tar.gz
-http://ftp.gnu.org/gnu/libtool/libtool-2.4.6.tar.xz
-https://www.kernel.org/pub/linux/kernel/v4.x/linux-4.20.12.tar.xz
-http://ftp.gnu.org/gnu/m4/m4-1.4.18.tar.xz
-http://ftp.gnu.org/gnu/make/make-4.2.1.tar.bz2
-http://download.savannah.gnu.org/releases/man-db/man-db-2.8.5.tar.xz
-https://www.kernel.org/pub/linux/docs/man-pages/man-pages-4.16.tar.xz
-https://github.com/mesonbuild/meson/releases/download/0.49.2/meson-0.49.2.tar.gz
-https://ftp.gnu.org/gnu/mpc/mpc-1.1.0.tar.gz
-http://www.mpfr.org/mpfr-4.0.2/mpfr-4.0.2.tar.xz
-https://github.com/ninja-build/ninja/archive/v1.9.0/ninja-1.9.0.tar.gz
-http://ftp.gnu.org/gnu/ncurses/ncurses-6.1.tar.gz
-https://openssl.org/source/openssl-1.1.1a.tar.gz
-http://ftp.gnu.org/gnu/patch/patch-2.7.6.tar.xz
-https://www.cpan.org/src/5.0/perl-5.28.1.tar.xz
+https://www.kernel.org/pub/linux/utils/net/iproute2/iproute2-5.13.0.tar.xz
+https://files.pythonhosted.org/packages/source/J/Jinja2/Jinja2-3.0.1.tar.gz
+https://www.kernel.org/pub/linux/utils/kbd/kbd-2.4.0.tar.xz
+https://www.kernel.org/pub/linux/utils/kernel/kmod/kmod-29.tar.xz
+https://www.greenwoodsoftware.com/less/less-590.tar.gz
+https://www.linuxfromscratch.org/lfs/downloads/11.0/lfs-bootscripts-20210608.tar.xz
+https://www.kernel.org/pub/linux/libs/security/linux-privs/libcap2/libcap-2.53.tar.xz
+https://github.com/libffi/libffi/releases/download/v3.4.2/libffi-3.4.2.tar.gz
+https://download.savannah.gnu.org/releases/libpipeline/libpipeline-1.5.3.tar.gz
+https://ftp.gnu.org/gnu/libtool/libtool-2.4.6.tar.xz
+https://www.kernel.org/pub/linux/kernel/v5.x/linux-5.13.12.tar.xz
+https://ftp.gnu.org/gnu/m4/m4-1.4.19.tar.xz
+https://ftp.gnu.org/gnu/make/make-4.3.tar.gz
+https://download.savannah.gnu.org/releases/man-db/man-db-2.9.4.tar.xz
+https://www.kernel.org/pub/linux/docs/man-pages/man-pages-5.13.tar.xz
+https://files.pythonhosted.org/packages/source/M/MarkupSafe/MarkupSafe-2.0.1.tar.gz
+https://github.com/mesonbuild/meson/releases/download/0.59.1/meson-0.59.1.tar.gz
+https://ftp.gnu.org/gnu/mpc/mpc-1.2.1.tar.gz
+https://www.mpfr.org/mpfr-4.1.0/mpfr-4.1.0.tar.xz
+https://ftp.gnu.org/gnu/ncurses/ncurses-6.2.tar.gz
+https://github.com/ninja-build/ninja/archive/v1.10.2/ninja-1.10.2.tar.gz
+https://www.openssl.org/source/openssl-1.1.1l.tar.gz
+https://ftp.gnu.org/gnu/patch/patch-2.7.6.tar.xz
+https://www.cpan.org/src/5.0/perl-5.34.0.tar.xz
 https://pkg-config.freedesktop.org/releases/pkg-config-0.29.2.tar.gz
-https://sourceforge.net/projects/procps-ng/files/Production/procps-ng-3.3.15.tar.xz
-https://sourceforge.net/projects/psmisc/files/psmisc/psmisc-23.2.tar.xz
-https://www.python.org/ftp/python/3.7.2/Python-3.7.2.tar.xz
-https://docs.python.org/ftp/python/doc/3.7.2/python-3.7.2-docs-html.tar.bz2
-http://ftp.gnu.org/gnu/readline/readline-8.0.tar.gz
-http://ftp.gnu.org/gnu/sed/sed-4.7.tar.xz
-https://github.com/shadow-maint/shadow/releases/download/4.6/shadow-4.6.tar.xz
-http://www.infodrom.org/projects/sysklogd/download/sysklogd-1.5.1.tar.gz
-https://github.com/systemd/systemd/archive/v240/systemd-240.tar.gz
-http://anduin.linuxfromscratch.org/LFS/systemd-man-pages-240.tar.xz
-http://download.savannah.gnu.org/releases/sysvinit/sysvinit-2.93.tar.xz
-http://ftp.gnu.org/gnu/tar/tar-1.31.tar.xz
-https://downloads.sourceforge.net/tcl/tcl8.6.9-src.tar.gz
-http://ftp.gnu.org/gnu/texinfo/texinfo-6.5.tar.xz
-https://www.iana.org/time-zones/repository/releases/tzdata2018i.tar.gz
-http://anduin.linuxfromscratch.org/LFS/udev-lfs-20171102.tar.bz2
-https://www.kernel.org/pub/linux/utils/util-linux/v2.33/util-linux-2.33.1.tar.xz
-ftp://ftp.vim.org/pub/vim/unix/vim-8.1.tar.bz2
-https://cpan.metacpan.org/authors/id/T/TO/TODDR/XML-Parser-2.44.tar.gz
-https://tukaani.org/xz/xz-5.2.4.tar.xz
+https://sourceforge.net/projects/procps-ng/files/Production/procps-ng-3.3.17.tar.xz
+https://sourceforge.net/projects/psmisc/files/psmisc/psmisc-23.4.tar.xz
+https://www.python.org/ftp/python/3.9.6/Python-3.9.6.tar.xz
+https://www.python.org/ftp/python/doc/3.9.6/python-3.9.6-docs-html.tar.bz2
+https://ftp.gnu.org/gnu/readline/readline-8.1.tar.gz
+https://ftp.gnu.org/gnu/sed/sed-4.8.tar.xz
+https://github.com/shadow-maint/shadow/releases/download/v4.9/shadow-4.9.tar.xz
+https://www.infodrom.org/projects/sysklogd/download/sysklogd-1.5.1.tar.gz
+https://github.com/systemd/systemd/archive/v249/systemd-249.tar.gz
+https://anduin.linuxfromscratch.org/LFS/systemd-man-pages-249.tar.xz
+https://download.savannah.gnu.org/releases/sysvinit/sysvinit-2.99.tar.xz
+https://ftp.gnu.org/gnu/tar/tar-1.34.tar.xz
+https://downloads.sourceforge.net/tcl/tcl8.6.11-src.tar.gz
+https://downloads.sourceforge.net/tcl/tcl8.6.11-html.tar.gz
+https://ftp.gnu.org/gnu/texinfo/texinfo-6.8.tar.xz
+https://www.iana.org/time-zones/repository/releases/tzdata2021a.tar.gz
+https://anduin.linuxfromscratch.org/LFS/udev-lfs-20171102.tar.xz
+https://www.kernel.org/pub/linux/utils/util-linux/v2.37/util-linux-2.37.2.tar.xz
+https://anduin.linuxfromscratch.org/LFS/vim-8.2.3337.tar.gz
+https://cpan.metacpan.org/authors/id/T/TO/TODDR/XML-Parser-2.46.tar.gz
+https://tukaani.org/xz/xz-5.2.5.tar.xz
 https://zlib.net/zlib-1.2.11.tar.xz
-http://www.linuxfromscratch.org/patches/lfs/8.4/bzip2-1.0.6-install_docs-1.patch
-http://www.linuxfromscratch.org/patches/lfs/8.4/coreutils-8.30-i18n-1.patch
-http://www.linuxfromscratch.org/patches/lfs/8.4/glibc-2.29-fhs-1.patch
-http://www.linuxfromscratch.org/patches/lfs/8.4/kbd-2.0.4-backspace-1.patch
-http://www.linuxfromscratch.org/patches/lfs/8.4/sysvinit-2.93-consolidated-1.patch
-http://www.linuxfromscratch.org/patches/lfs/8.4/systemd-240-security_fixes-2.patch
+https://github.com/facebook/zstd/releases/download/v1.5.0/zstd-1.5.0.tar.gz
+https://www.linuxfromscratch.org/patches/lfs/11.0/binutils-2.37-upstream_fix-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/bzip2-1.0.8-install_docs-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/coreutils-8.32-i18n-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/glibc-2.34-fhs-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/kbd-2.4.0-backspace-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/perl-5.34.0-upstream_fixes-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/sysvinit-2.99-consolidated-1.patch
+https://www.linuxfromscratch.org/patches/lfs/11.0/systemd-249-upstream_fixes-1.patch
diff --git a/stapel/wget-list-before-omnibus.md5sums b/stapel/wget-list-before-omnibus.md5sums
index 707b56e060..39e39e57d0 100644
--- a/stapel/wget-list-before-omnibus.md5sums
+++ b/stapel/wget-list-before-omnibus.md5sums
@@ -1,82 +1,86 @@
-007aabf1dbb550bcddde52a244cd1070  acl-2.2.53.tar.gz
-bc1e5cb5c96d99b24886f1f527d3bb3d  attr-2.4.48.tar.gz
-50f97f4159805e374639a73e2636f22e  autoconf-2.69.tar.xz
-53f38e7591fa57c3d2cee682be668e5b  automake-1.16.1.tar.xz
-2b44b47b905be16f45709648f671820b  bash-5.0.tar.gz
-cda93857418655ea43590736fc3ca9fc  bc-1.07.1.tar.gz
-0d174cdaf85721c5723bf52355be41e6  binutils-2.32.tar.xz
-c9b552dee234b2f6b66e56b27e5234c9  bison-3.3.2.tar.xz
-00b516f4704d4a7cb50a1d97e6e8e15b  bzip2-1.0.6.tar.gz
-31b17c6075820a434119592941186f70  check-0.12.0.tar.gz
-ab06d68949758971fe744db66b572816  coreutils-8.30.tar.xz
-e1b07516533f351b3aba3423fafeffd6  dejagnu-1.6.2.tar.gz
-4824adc0e95dbbf11dfbdfaad6a1e461  diffutils-3.7.tar.xz
-8d78b11d04d26c0b2dd149529441fa80  e2fsprogs-1.44.5.tar.gz
-077e4f49320cad82bf17a997068b1db9  elfutils-0.176.tar.bz2
-c75d99910c1791dd9430d26ab76059c0  eudev-3.2.7.tar.gz
-ca047ae951b40020ac831c28859161b2  expat-2.2.6.tar.bz2
+95ce715fe09acca7c12d3306d0f076b2  acl-2.3.1.tar.xz
+ac1c5a7a084f0f83b8cace34211f64d8  attr-2.5.1.tar.gz
+12cfa1687ffa2606337efe1a64416106  autoconf-2.71.tar.xz
+86e8e682bd74e6390a016c4d9c11267c  automake-1.16.4.tar.xz
+23eee6195b47318b9fd878e590ccb38c  bash-5.1.8.tar.gz
+8345bb81c576ddfc8c27e0842370603c  bc-5.0.0.tar.xz
+e78d9ff2976b745a348f4c1f27c77cb1  binutils-2.37.tar.xz
+d61aa92e3562cb7292b004ce96173cf7  bison-3.7.6.tar.xz
+67e051268d0c475ea773822f7500d0e5  bzip2-1.0.8.tar.gz
+50fcafcecde5a380415b12e9c574e0b2  check-0.15.2.tar.gz
+022042695b7d5bcf1a93559a9735e668  coreutils-8.32.tar.xz
+68c5208c58236eba447d7d6d1326b821  dejagnu-1.6.3.tar.gz
+6a6b0fdc72acfe3f2829aab477876fbc  diffutils-3.8.tar.xz
+128f5b0f0746b28d1e3ca7e263c57094  e2fsprogs-1.46.4.tar.gz
+2b6e94c2eebc1f2194173e31bca9396e  elfutils-0.185.tar.bz2
+60b135a189523f333cea5f71a3345c8d  eudev-3.2.10.tar.gz
+a4fb91a9441bcaec576d4c4a56fa3aa6  expat-2.4.1.tar.xz
 00fce8de158422f5ccd2666512329bd2  expect5.45.4.tar.gz
-9af0eb3f5db4ae00fffc37f7b861575c  file-5.36.tar.gz
-9936aa8009438ce185bea2694a997fc1  findutils-4.6.0.tar.gz
+72540ea1cc8c6e1dee35d6100ec66589  file-5.40.tar.gz
+eeefe2e6380931a77dfa6d9350b43186  findutils-4.8.0.tar.xz
 2882e3179748cc9f9c23ec593d6adc8d  flex-2.6.4.tar.gz
-95cf553f50ec9f386b5dfcd67f30180a  gawk-4.2.1.tar.xz
-4ab282f414676496483b3e1793d07862  gcc-8.2.0.tar.xz
-988dc82182121c7570e0cb8b4fcd5415  gdbm-1.18.1.tar.gz
-df3f5690eaa30fd228537b00cb7b7590  gettext-0.19.8.1.tar.xz
-e6c279d5b2f0736f740216f152acf974  glibc-2.29.tar.xz
-f58fa8001d60c4c77595fbbb62b63c1d  gmp-6.1.2.tar.xz
+8470c34eeecc41c1aa0c5d89e630df50  gawk-5.1.0.tar.xz
+31c86f2ced76acac66992eeedce2fce2  gcc-11.2.0.tar.xz
+006c19b8b60828fd6916a16f3496bd3c  gdbm-1.20.tar.gz
+40996bbaf7d1356d3c22e33a8b255b31  gettext-0.21.tar.xz
+31998b53fb39cb946e96abc310af1c89  glibc-2.34.tar.xz
+0b82665c4a92fd2ade7440c13fcaa42b  gmp-6.2.1.tar.xz
 9e251c0a618ad0824b51117d5d9db87e  gperf-3.1.tar.gz
-05d0718a1b7cc706a4bdf8115363f1ed  grep-3.3.tar.xz
+7c9cca97fa18670a21e72638c3e1dabf  grep-3.7.tar.xz
 08fb04335e2f5e73f23ea4c3adbf0c5f  groff-1.22.4.tar.gz
-8a4a2a95aac551fb0fba860ceabfa1d3  grub-2.02.tar.xz
+cf0fd928b1e5479c8108ee52cb114363  grub-2.06.tar.xz
 691b1221694c3394f1c537df4eee39d3  gzip-1.10.tar.xz
-3ba3afb1d1b261383d247f46cb135ee8  iana-etc-2.30.tar.bz2
-87fef1fa3f603aef11c41dcc097af75e  inetutils-1.9.4.tar.xz
+f2854be57fe281e3ffc7364984467d2f  iana-etc-20210611.tar.gz
+4e7676d1980e57c7df665e5c5c3c1047  inetutils-2.1.tar.xz
 12e517cac2b57a0121cda351570f1e63  intltool-0.51.0.tar.gz
-f3dab4c812812bbb5873cb90f471bcbf  iproute2-4.20.0.tar.xz
-c1635a5a83b63aca7f97a3eab39ebaa6  kbd-2.0.4.tar.xz
-1129c243199bdd7db01b55a61aa19601  kmod-26.tar.xz
-6a39bccf420c946b0fd7ffc64961315b  less-530.tar.gz
-e08811a18356eeef524b2ed333e8cb86  lfs-bootscripts-20180820.tar.bz2
-968ac4d42a1a71754313527be2ab5df3  libcap-2.26.tar.xz
-83b89587607e3eb65c70d361f13bab43  libffi-3.2.1.tar.gz
-4c8fe6cd85422baafd6e060f896c61bc  libpipeline-1.5.1.tar.gz
+15fc3786303a173a14e180afe4cd2ecd  iproute2-5.13.0.tar.xz
+3cac5be0096fcf7b32dcbd3c53831380  kbd-2.4.0.tar.xz
+e81e63acd80697d001c8d85c1acb38a0  kmod-29.tar.xz
+f029087448357812fba450091a1172ab  less-590.tar.gz
+6efd60044ad31a603a2c31c68919a988  lfs-bootscripts-20210608.tar.xz
+094994d4554c6689cf98ae4f717b8e19  libcap-2.53.tar.xz
+294b921e6cf9ab0fbaea4b639f8fdbe8  libffi-3.4.2.tar.gz
+dad443d0911cf9f0f1bd90a334bc9004  libpipeline-1.5.3.tar.gz
 1bfb9b923f2c1339b4d2ce1807064aa5  libtool-2.4.6.tar.xz
-edd3015435d60598b99cf6aaf223710e  linux-4.20.12.tar.xz
-730bb15d96fffe47e148d1e09235af82  m4-1.4.18.tar.xz
-15b012617e7c44c0ed482721629577ac  make-4.2.1.tar.bz2
-c5c6c3434be14a5527d43b5ad0f09a13  man-db-2.8.5.tar.xz
-ad9f1ff81276fe8d90d077484d6d4b5e  man-pages-4.16.tar.xz
-0267b0871266056184c484792572c682  meson-0.49.2.tar.gz
-4125404e41e482ec68282a2e687f6c73  mpc-1.1.0.tar.gz
-320fbc4463d4c8cb1e566929d8adc4f8  mpfr-4.0.2.tar.xz
-f340be768a76724b83e6daab69009902  ninja-1.9.0.tar.gz
-98c889aaf8d23910d2b92d65be2e737a  ncurses-6.1.tar.gz
-963deb2272d6be7d4c2458afd2517b73  openssl-1.1.1a.tar.gz
+6e1728b2021ca19cc9273f080e6c44c7  linux-5.13.12.tar.xz
+0d90823e1426f1da2fd872df0311298d  m4-1.4.19.tar.xz
+fc7a67ea86ace13195b0bce683fd4469  make-4.3.tar.gz
+6e233a555f7b9ae91ce7cd0faa322bce  man-db-2.9.4.tar.xz
+3ac24e8c6fae26b801cb87ceb63c0a30  man-pages-5.13.tar.xz
+9c8135ecde820094be2f42f457fb6535  meson-0.59.1.tar.gz
+9f16c976c25bb0f76b50be749cd7a3a8  mpc-1.2.1.tar.gz
+bdd3d5efba9c17da8d83a35ec552baef  mpfr-4.1.0.tar.xz
+e812da327b1c2214ac1aed440ea3ae8d  ncurses-6.2.tar.gz
+639f75bc2e3b19ab893eaf2c810d4eb4  ninja-1.10.2.tar.gz
+ac0d4387f3ba0ad741b0580dd45f6ff3  openssl-1.1.1l.tar.gz
 78ad9937e4caadcba1526ef1853730d5  patch-2.7.6.tar.xz
-fbb590c305f2f88578f448581b8cf9c4  perl-5.28.1.tar.xz
+df7ecb0653440b26dc951ad9dbfab517  perl-5.34.0.tar.xz
 f6e931e319531b736fadc017f470e68a  pkg-config-0.29.2.tar.gz
-2b0717a7cb474b3d6dfdeedfbad2eccc  procps-ng-3.3.15.tar.xz
-0524258861f00be1a02d27d39d8e5e62  psmisc-23.2.tar.xz
-df6ec36011808205beda239c72f947cb  Python-3.7.2.tar.xz
-107ade7bb17efd104a22b2d457f4cb67  python-3.7.2-docs-html.tar.bz2
-7e6c1f16aee3244a69aba6e438295ca3  readline-8.0.tar.gz
-777ddfd9d71dd06711fe91f0925e1573  sed-4.7.tar.xz
-b491fecbf1232632c32ff8f1437fd60e  shadow-4.6.tar.xz
+d60613e88c2f442ebd462b5a75313d56  procps-ng-3.3.17.tar.xz
+8114cd4489b95308efe2509c3a406bbf  psmisc-23.4.tar.xz
+ecc29a7688f86e550d29dba2ee66cf80  Python-3.9.6.tar.xz
+0dae29e4c38af1b6b1a86b35c9e48923  python-3.9.6-docs-html.tar.bz2
+e9557dd5b1409f5d7b37ef717c64518e  readline-8.1.tar.gz
+6d906edfdb3202304059233f51f9a71d  sed-4.8.tar.xz
+126924090caf72f3de7e9261fd4e10ac  shadow-4.9.tar.xz
 c70599ab0d037fde724f7210c2c8d7f8  sysklogd-1.5.1.tar.gz
-041dbe36a5dd80b2108aff305bc10620  sysvinit-2.93.tar.xz
-bc9a89da1185ceb2210de12552c43ce2  tar-1.31.tar.xz
-aa0a121d95a0e7b73a036f26028538d4  tcl8.6.9-src.tar.gz
-3715197e62e0e07f85860b3d7aab55ed  texinfo-6.5.tar.xz
-b3f0a1a789480a036e58466cd0702477  tzdata2018i.tar.gz
-d92afb0c6e8e616792068ee4737b0d24  udev-lfs-20171102.tar.bz2
-6fcfea2043b5ac188fd3eed56aeb5d90  util-linux-2.33.1.tar.xz
-1739a1df312305155285f0cfa6118294  vim-8.1.tar.bz2
-af4813fe3952362451201ced6fbce379  XML-Parser-2.44.tar.gz
-003e4d0b1b1899fc6e3000b24feddf7c  xz-5.2.4.tar.xz
+6abc0ea61b8dd4a41b4e931a43b1bb90  sysvinit-2.99.tar.xz
+9a08d29a9ac4727130b5708347c0f5cf  tar-1.34.tar.xz
+8a4c004f48984a03a7747e9ba06e4da4  tcl8.6.11-src.tar.gz
+e358a9140c3a171e42f18c8a7f6a36ea  tcl8.6.11-html.tar.gz
+a91b404e30561a5df803e6eb3a53be71  texinfo-6.8.tar.xz
+20eae7d1da671c6eac56339c8df85bbd  tzdata2021a.tar.gz
+27cd82f9a61422e186b9d6759ddf1634  udev-lfs-20171102.tar.xz
+d659bf7cd417d93dc609872f6334b019  util-linux-2.37.2.tar.xz
+e0325a4988b1b99b9c2e46fa853c1980  vim-8.2.3337.tar.gz
+80bb18a8e6240fcf7ec2f7b57601c170  XML-Parser-2.46.tar.gz
+aa1621ec7013a19abab52a8aff04fe5b  xz-5.2.5.tar.xz
 85adef240c5f370b308da8c938951a68  zlib-1.2.11.tar.xz
-6a5ac7e89b791aae556de0f745916f7f  bzip2-1.0.6-install_docs-1.patch
-a9404fb575dfd5514f3c8f4120f9ca7d  coreutils-8.30-i18n-1.patch
-9a5997c3452909b1769918c759eff8a2  glibc-2.29-fhs-1.patch
-f75cca16a38da6caa7d52151f7136895  kbd-2.0.4-backspace-1.patch
-aaa84675e717504d7d3da452c8c2eaf1  sysvinit-2.93-consolidated-1.patch
+a6eb7fb1f2c21fa80030a47993853e92  zstd-1.5.0.tar.gz
+3518fa864fe8d7ef65be4960f380b03b  binutils-2.37-upstream_fix-1.patch
+6a5ac7e89b791aae556de0f745916f7f  bzip2-1.0.8-install_docs-1.patch
+cd8ebed2a67fff2e231026df91af6776  coreutils-8.32-i18n-1.patch
+9a5997c3452909b1769918c759eff8a2  glibc-2.34-fhs-1.patch
+f75cca16a38da6caa7d52151f7136895  kbd-2.4.0-backspace-1.patch
+fb42558b59ed95ee00eb9f1c1c9b8056  perl-5.34.0-upstream_fixes-1.patch
+4900322141d493e74020c9cf437b2cdc  sysvinit-2.99-consolidated-1.patch