diff --git a/.gitignore b/.gitignore
index 2219ff4..de83a4a 100644
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1,5 @@
+out
 build.log
 graph.svg
 *.tgz
+TODO
diff --git a/Makefile b/Makefile
index 2afb6d1..a1d5d65 100644
--- a/Makefile
+++ b/Makefile
@@ -1,365 +1,17 @@
 export REGISTRY := local
 export PLATFORM := linux/amd64
 export BUILDER := $(shell which docker)
-export SOURCE_DATE_EPOCH = 1
 clean_logs := $(shell rm *.log 2>&1 >/dev/null || :)
 
+include src/macros.mk
+include src/bootstrap/build.mk
+include src/core/build.mk
+include src/libs/build.mk
+include src/tools/build.mk
+
 DEFAULT_GOAL := default
 .PHONY: default
-default: all
-.PHONY: all
-all: \
-	python.tgz \
-	rust.tgz \
-	go.tgz
+default: bootstrap core
 
-graph.svg: Makefile
+out/graph.svg: Makefile
 	$(MAKE) -Bnd | make2graph | dot -Tsvg -o graph.svg
-
-bootstrap.tgz:
-	$(call build,bootstrap)
-
-musl.tgz: bootstrap.tgz
-	$(call build,musl)
-
-busybox.tgz: bootstrap.tgz
-	$(call build,busybox)
-
-binutils.tgz: bootstrap.tgz
-	$(call build,binutils)
-
-gcc.tgz: \
-	bootstrap.tgz \
-	musl.tgz
-	$(call build,gcc)
-
-make.tgz: bootstrap.tgz
-	$(call build,make)
-
-ca-certificates.tgz:
-	$(call build,ca-certificates)
-
-bash.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz
-	$(call build,bash)
-
-m4.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz
-	$(call build,m4)
-
-perl.tgz: \
-	gcc.tgz \
-	binutils.tgz \
-	busybox.tgz \
-	make.tgz \
-	musl.tgz
-	$(call build,perl)
-
-autoconf.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	perl.tgz \
-	m4.tgz
-	$(call build,autoconf,,fetch)
-	$(call build,autoconf)
-
-automake.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	perl.tgz \
-	autoconf.tgz \
-	m4.tgz
-	$(call build,automake)
-
-sed.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz
-	$(call build,sed)
-
-libtool.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	bash.tgz \
-	sed.tgz \
-	m4.tgz
-	$(call build,libtool)
-
-pkgconf.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	libtool.tgz
-	$(call build,pkgconf)
-
-libxml2.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	bash.tgz \
-	python.tgz \
-	sed.tgz \
-	m4.tgz \
-	autoconf.tgz \
-	automake.tgz \
-	pkgconf.tgz \
-	libtool.tgz
-	$(call build,libxml2)
-
-libunwind.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	bash.tgz \
-	autoconf.tgz \
-	automake.tgz \
-	libtool.tgz
-	$(call build,libunwind)
-
-linux-headers.tgz:
-	$(call build,linux-headers)
-
-openssl.tgz: \
-	gcc.tgz \
-	binutils.tgz \
-	busybox.tgz \
-	linux-headers.tgz \
-	musl.tgz
-	$(call build,openssl)
-
-go.tgz: \
-	gcc.tgz \
-	binutils.tgz \
-	busybox.tgz \
-	bash.tgz \
-	musl.tgz
-	$(call build,go)
-
-curl.tgz: \
-	gcc.tgz \
-	musl.tgz \
-	busybox.tgz \
-	make.tgz \
-	binutils.tgz \
-	openssl.tgz \
-	ca-certificates.tgz
-	$(call build,curl)
-
-python.tgz: \
-	gcc.tgz \
-	perl.tgz \
-	binutils.tgz \
-	busybox.tgz \
-	openssl.tgz \
-	make.tgz \
-	musl.tgz
-	$(call build,python)
-
-ninja.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz \
-	openssl.tgz \
-	python.tgz
-	$(call build,ninja)
-
-cmake.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	ninja.tgz \
-	musl.tgz \
-	make.tgz \
-	linux-headers.tgz
-	$(call build,cmake)
-
-py-setuptools.tgz: \
-	busybox.tgz \
-	python.tgz
-	$(call build,py-setuptools)
-
-zlib.tgz: \
-	busybox.tgz \
-	gcc.tgz \
-	binutils.tgz \
-	musl.tgz \
-	make.tgz
-	$(call build,zlib)
-
-llvm13.tgz: \
-	gcc.tgz \
-	python.tgz \
-	py-setuptools.tgz \
-	perl.tgz \
-	binutils.tgz \
-	cmake.tgz \
-	ninja.tgz \
-	curl.tgz \
-	busybox.tgz \
-	musl.tgz
-	$(call build,llvm,13.0.1)
-
-llvm.tgz: \
-	gcc.tgz \
-	python.tgz \
-	py-setuptools.tgz \
-	perl.tgz \
-	binutils.tgz \
-	cmake.tgz \
-	ninja.tgz \
-	curl.tgz \
-	busybox.tgz \
-	musl.tgz
-	$(call build,llvm)
-	$(BUILDER) tag $(REGISTRY)/llvm $(REGISTRY)/llvm:16
-	$(BUILDER) tag $(REGISTRY)/llvm $(REGISTRY)/llvm:16.0.6
-
-rust1.54.tgz: \
-	gcc.tgz \
-	bash.tgz \
-	zlib.tgz \
-	python.tgz \
-	py-setuptools.tgz \
-	curl.tgz \
-	perl.tgz \
-	libunwind.tgz \
-	pkgconf.tgz \
-	llvm13.tgz \
-	binutils.tgz \
-	cmake.tgz \
-	make.tgz \
-	busybox.tgz \
-	musl.tgz
-	$(call build,rust,1.54.0,bootstrap-package)
-
-rust1.55.tgz: rust1.54.tgz
-	$(call build,rust,1.55.0,package,--build-arg BUILD_VERSION=1.54.0)
-
-rust1.56.tgz: rust1.55.tgz
-	$(call build,rust,1.56.0,package,--build-arg BUILD_VERSION=1.55.0)
-
-rust1.57.tgz: rust1.56.tgz
-	$(call build,rust,1.57.0,package,--build-arg BUILD_VERSION=1.56.0)
-
-rust1.58.tgz: rust1.57.tgz
-	$(call build,rust,1.58.0,package,--build-arg BUILD_VERSION=1.57.0)
-
-rust1.59.tgz: rust1.58.tgz
-	$(call build,rust,1.59.0,package,--build-arg BUILD_VERSION=1.58.0)
-
-rust1.60.tgz: rust1.59.tgz
-	$(call build,rust,1.60.0,package,--build-arg BUILD_VERSION=1.59.0)
-
-rust1.61.tgz: rust1.60.tgz
-	$(call build,rust,1.61.0,package,--build-arg BUILD_VERSION=1.60.0)
-
-rust1.62.tgz: rust1.61.tgz
-	$(call build,rust,1.62.0,package,--build-arg BUILD_VERSION=1.61.0)
-
-rust1.63.tgz: rust1.62.tgz
-	$(call build,rust,1.63.0,package,--build-arg BUILD_VERSION=1.62.0)
-
-rust1.64.tgz: rust1.63.tgz
-	$(call build,rust,1.64.0,package,--build-arg BUILD_VERSION=1.63.0)
-
-rust1.65.tgz: rust1.64.tgz
-	$(call build,rust,1.65.0,package,--build-arg BUILD_VERSION=1.64.0)
-
-rust1.66.tgz: rust1.65.tgz
-	$(call build,rust,1.66.0,package,--build-arg BUILD_VERSION=1.65.0)
-
-rust1.67.tgz: rust1.66.tgz
-	$(call build,rust,1.67.0,package,--build-arg BUILD_VERSION=1.66.0)
-
-rust1.68.tgz: rust1.67.tgz
-	$(call build,rust,1.68.0,package,--build-arg BUILD_VERSION=1.67.0)
-
-rust1.69.tgz: rust1.68.tgz llvm.tgz
-	$(call build,rust,1.69.0,package,--build-arg BUILD_VERSION=1.68.0 --build-arg LLVM_VERSION=16)
-
-rust1.70.tgz: rust1.69.tgz
-	$(call build,rust,1.70.0,package,--build-arg BUILD_VERSION=1.69.0 --build-arg LLVM_VERSION=16)
-
-rust1.71.tgz: rust1.70.tgz
-	$(call build,rust,1.71.0,package,--build-arg BUILD_VERSION=1.70.0 --build-arg LLVM_VERSION=16)
-
-rust1.72.tgz: rust1.71.tgz
-	$(call build,rust,1.72.0,package,--build-arg BUILD_VERSION=1.71.0 --build-arg LLVM_VERSION=16)
-
-rust1.73.tgz: rust1.72.tgz
-	$(call build,rust,1.73.0,package,--build-arg BUILD_VERSION=1.72.0 --build-arg LLVM_VERSION=16)
-
-rust.tgz: rust1.73.tgz
-	$(call build,rust,1.74.0,package,--build-arg BUILD_VERSION=1.73.0 --build-arg LLVM_VERSION=16)
-
-# Build package with chosen $(BUILDER)
-# Supported BUILDERs: docker
-# Usage: $(call build,$(NAME),$(VERSION),$(TARGET),$(EXTRA_ARGS))
-# Notes:
-# - Packages are expected to use the following layer names in order:
-#   - "fetch": [optional] obtain any artifacts from the internet.
-#   - "build": [optional] do any required build work
-#   - "package": [required] scratch layer exporting artifacts for distribution
-#   - "test": [optional] define any tests
-# - Packages may prefix layer names with "text-" if more than one is desired
-# - VERSION will be set as a build-arg if defined, otherwise it is "latest"
-# - TARGET defaults to "package"
-# - EXTRA_ARGS will be blindly injected
-# - packages may also define a "test" layer
-#  TODO:
-# - try to disable networking on fetch layers with something like:
-#   $(if $(filter fetch,$(lastword $(subst -, ,$(TARGET)))),,--network=none)
-# - actually output OCI files for each build (vs plain tar)
-# - output manifest.txt of all tar/digest hashes for an easy git diff
-# - support buildah and podman
-define build
-	$(eval NAME := $(1))
-	$(eval VERSION := $(if $(2),$(2),latest))
-	$(eval TARGET := $(if $(3),$(3),package))
-	$(eval EXTRA_ARGS := $(if $(4),$(4),))
-	$(eval BUILD_CMD := \
-		DOCKER_BUILDKIT=1 \
-		SOURCE_DATE_EPOCH=1 \
-		$(BUILDER) \
-			build \
-			-t $(REGISTRY)/$(NAME):$(VERSION) \
-			--build-arg REGISTRY=$(REGISTRY) \
-			--platform $(PLATFORM) \
-			--progress=plain \
-			$(if $(filter latest,$(VERSION)),,--build-arg VERSION=$(VERSION)) \
-			--target $(TARGET) \
-			$(EXTRA_ARGS) \
-			$(NAME) \
-	)
-	$(eval TIMESTAMP := $(shell TZ=GMT date +"%Y-%m-%dT%H:%M:%SZ"))
-	echo $(TIMESTAMP) $(BUILD_CMD) >> build.log
-	$(BUILD_CMD)
-	$(if $(filter package,$(TARGET)),$(BUILDER) save $(REGISTRY)/$(NAME):$(VERSION) -o $@,)
-endef
diff --git a/binutils/Dockerfile b/src/bootstrap/binutils/Dockerfile
similarity index 100%
rename from binutils/Dockerfile
rename to src/bootstrap/binutils/Dockerfile
diff --git a/bootstrap/Dockerfile b/src/bootstrap/bootstrap/Dockerfile
similarity index 100%
rename from bootstrap/Dockerfile
rename to src/bootstrap/bootstrap/Dockerfile
diff --git a/src/bootstrap/build.mk b/src/bootstrap/build.mk
new file mode 100644
index 0000000..dfb7d7e
--- /dev/null
+++ b/src/bootstrap/build.mk
@@ -0,0 +1,25 @@
+.PHONY: bootstrap
+core: \
+	out/gcc.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/binutils.tgz \
+	out/busybox.tgz
+
+out/bootstrap.tgz:
+	$(call build,bootstrap,bootstrap)
+
+out/musl.tgz: out/bootstrap.tgz
+	$(call build,bootstrap,musl)
+
+out/busybox.tgz: out/bootstrap.tgz
+	$(call build,bootstrap,busybox)
+
+out/binutils.tgz: out/bootstrap.tgz
+	$(call build,bootstrap,binutils)
+
+out/gcc.tgz: out/bootstrap.tgz out/musl.tgz
+	$(call build,bootstrap,gcc)
+
+out/make.tgz: out/bootstrap.tgz
+	$(call build,bootstrap,make)
diff --git a/busybox/Dockerfile b/src/bootstrap/busybox/Dockerfile
similarity index 93%
rename from busybox/Dockerfile
rename to src/bootstrap/busybox/Dockerfile
index 9fd738b..d5e8840 100644
--- a/busybox/Dockerfile
+++ b/src/bootstrap/busybox/Dockerfile
@@ -10,7 +10,7 @@ ENV KCONFIG_NOTIMESTAMP=1
 
 FROM base as fetch
 RUN set -eux; \
-    wget ${SRC_SITE}/${SRC_FILE}
+    wget ${SRC_SITE}/${SRC_FILE}; \
     echo "${SRC_HASH}  ${SRC_FILE}" | sha256sum -c
 
 FROM fetch as build
@@ -61,13 +61,14 @@ USER 0:0
 RUN set -eux; \
     mkdir -p /rootfs/bin; \
     cp busybox /rootfs/bin; \
+    cp busybox /bin; \
     cd /rootfs; \
     mkdir -p home/user var/tmp etc tmp lib bin; \
     /bin/busybox --install -s bin; \
     echo "user:x:1000:" > etc/group; \
     echo "user:x:1000:1000::/home/user:/bin/sh" > etc/passwd; \
     ln -sT /lib lib64; \
-    chown -R 1000:1000 /rootfs/home/user /tmp /var/tmp; \
+    chown -R 1000:1000 /rootfs/home/user /rootfs/tmp /rootfs/var/tmp; \
     find . -exec touch -hcd "@0" "{}" +
 
 FROM scratch as package
diff --git a/gcc/Dockerfile b/src/bootstrap/gcc/Dockerfile
similarity index 97%
rename from gcc/Dockerfile
rename to src/bootstrap/gcc/Dockerfile
index c2f1108..9970621 100644
--- a/gcc/Dockerfile
+++ b/src/bootstrap/gcc/Dockerfile
@@ -62,21 +62,21 @@ RUN set -eux; \
 FROM build as install
 USER 0:0
 RUN set -eux; \
-    make DESTDIR=/rootfs/ install-strip; \
+    make DESTDIR=/rootfs install-strip; \
     ln -s gcc /rootfs/usr/bin/cc
 COPY --from=musl /lib/* /rootfs/lib/
 RUN find /rootfs -exec touch -hcd "@0" "{}" +
 
 FROM busybox as test
+COPY --from=install /rootfs /
 COPY --from=binutils . /
 COPY --from=musl . /
-COPY --from=install /rootfs /
 ADD test.c .
 RUN set -eux; \
     gcc test.c -static -o main; \
     ./main | grep "Success"
 
 FROM scratch as package
-COPY --from=build /rootfs /
+COPY --from=install /rootfs /
 ENTRYPOINT ["/usr/bin/gcc"]
 CMD ["--version"]
diff --git a/gcc/test.c b/src/bootstrap/gcc/test.c
similarity index 100%
rename from gcc/test.c
rename to src/bootstrap/gcc/test.c
diff --git a/make/Dockerfile b/src/bootstrap/make/Dockerfile
similarity index 100%
rename from make/Dockerfile
rename to src/bootstrap/make/Dockerfile
diff --git a/musl/Dockerfile b/src/bootstrap/musl/Dockerfile
similarity index 100%
rename from musl/Dockerfile
rename to src/bootstrap/musl/Dockerfile
diff --git a/musl/lfs64-2.patch b/src/bootstrap/musl/lfs64-2.patch
similarity index 100%
rename from musl/lfs64-2.patch
rename to src/bootstrap/musl/lfs64-2.patch
diff --git a/musl/lfs64.patch b/src/bootstrap/musl/lfs64.patch
similarity index 100%
rename from musl/lfs64.patch
rename to src/bootstrap/musl/lfs64.patch
diff --git a/tests/go/Dockerfile b/src/core/_tests/go/Dockerfile
similarity index 100%
rename from tests/go/Dockerfile
rename to src/core/_tests/go/Dockerfile
diff --git a/tests/go/main.go b/src/core/_tests/go/main.go
similarity index 100%
rename from tests/go/main.go
rename to src/core/_tests/go/main.go
diff --git a/tests/perl/Dockerfile b/src/core/_tests/perl/Dockerfile
similarity index 100%
rename from tests/perl/Dockerfile
rename to src/core/_tests/perl/Dockerfile
diff --git a/tests/perl/main.pl b/src/core/_tests/perl/main.pl
similarity index 100%
rename from tests/perl/main.pl
rename to src/core/_tests/perl/main.pl
diff --git a/tests/python/Dockerfile b/src/core/_tests/python/Dockerfile
similarity index 100%
rename from tests/python/Dockerfile
rename to src/core/_tests/python/Dockerfile
diff --git a/tests/python/main.py b/src/core/_tests/python/main.py
similarity index 100%
rename from tests/python/main.py
rename to src/core/_tests/python/main.py
diff --git a/tests/rust/Cargo.lock b/src/core/_tests/rust/Cargo.lock
similarity index 100%
rename from tests/rust/Cargo.lock
rename to src/core/_tests/rust/Cargo.lock
diff --git a/tests/rust/Cargo.toml b/src/core/_tests/rust/Cargo.toml
similarity index 100%
rename from tests/rust/Cargo.toml
rename to src/core/_tests/rust/Cargo.toml
diff --git a/tests/rust/Dockerfile b/src/core/_tests/rust/Dockerfile
similarity index 100%
rename from tests/rust/Dockerfile
rename to src/core/_tests/rust/Dockerfile
diff --git a/tests/rust/main.rs b/src/core/_tests/rust/main.rs
similarity index 100%
rename from tests/rust/main.rs
rename to src/core/_tests/rust/main.rs
diff --git a/autoconf/Dockerfile b/src/core/autoconf/Dockerfile
similarity index 100%
rename from autoconf/Dockerfile
rename to src/core/autoconf/Dockerfile
diff --git a/automake/Dockerfile b/src/core/automake/Dockerfile
similarity index 100%
rename from automake/Dockerfile
rename to src/core/automake/Dockerfile
diff --git a/bash/Dockerfile b/src/core/bash/Dockerfile
similarity index 100%
rename from bash/Dockerfile
rename to src/core/bash/Dockerfile
diff --git a/src/core/build.mk b/src/core/build.mk
new file mode 100644
index 0000000..d0d5fcb
--- /dev/null
+++ b/src/core/build.mk
@@ -0,0 +1,258 @@
+.PHONY: core
+core: \
+	out/rust.tgz \
+	out/python.tgz \
+	out/perl.tgz \
+	out/gcc.tgz \
+	out/llvm.tgz
+
+out/bash.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz
+	$(call build,core,bash)
+
+out/m4.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz
+	$(call build,core,m4)
+
+out/perl.tgz: \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/busybox.tgz \
+	out/make.tgz \
+	out/musl.tgz
+	$(call build,core,perl)
+
+out/autoconf.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/perl.tgz \
+	out/m4.tgz
+	$(call build,core,autoconf,,fetch)
+	$(call build,core,autoconf)
+
+out/automake.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/perl.tgz \
+	out/autoconf.tgz \
+	out/m4.tgz
+	$(call build,core,automake)
+
+out/sed.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz
+	$(call build,core,sed)
+
+out/libtool.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/bash.tgz \
+	out/sed.tgz \
+	out/m4.tgz
+	$(call build,core,libtool)
+
+out/pkgconf.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/libtool.tgz
+	$(call build,core,pkgconf)
+
+out/libunwind.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/bash.tgz \
+	out/autoconf.tgz \
+	out/automake.tgz \
+	out/libtool.tgz
+	$(call build,core,libunwind)
+
+out/linux-headers.tgz:
+	$(call build,core,linux-headers)
+
+out/openssl.tgz: \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/busybox.tgz \
+	out/linux-headers.tgz \
+	out/musl.tgz
+	$(call build,core,openssl)
+
+out/go.tgz: \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/busybox.tgz \
+	out/bash.tgz \
+	out/musl.tgz
+	$(call build,core,go)
+
+out/python.tgz: \
+	out/gcc.tgz \
+	out/perl.tgz \
+	out/binutils.tgz \
+	out/busybox.tgz \
+	out/openssl.tgz \
+	out/make.tgz \
+	out/musl.tgz
+	$(call build,core,python)
+
+out/ninja.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/openssl.tgz \
+	out/python.tgz
+	$(call build,core,ninja)
+
+out/cmake.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/ninja.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/linux-headers.tgz
+	$(call build,core,cmake)
+
+out/py-setuptools.tgz: \
+	out/busybox.tgz \
+	out/python.tgz
+	$(call build,core,py-setuptools)
+
+out/zlib.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz
+	$(call build,core,zlib)
+
+out/llvm13.tgz: \
+	out/gcc.tgz \
+	out/python.tgz \
+	out/py-setuptools.tgz \
+	out/perl.tgz \
+	out/binutils.tgz \
+	out/cmake.tgz \
+	out/ninja.tgz \
+	out/busybox.tgz \
+	out/musl.tgz
+	$(call build,core,llvm,13.0.1)
+
+out/llvm.tgz: \
+	out/gcc.tgz \
+	out/python.tgz \
+	out/py-setuptools.tgz \
+	out/perl.tgz \
+	out/binutils.tgz \
+	out/cmake.tgz \
+	out/ninja.tgz \
+	out/busybox.tgz \
+	out/musl.tgz
+	$(call build,core,llvm)
+	$(BUILDER) tag $(REGISTRY)/llvm $(REGISTRY)/llvm:16
+	$(BUILDER) tag $(REGISTRY)/llvm $(REGISTRY)/llvm:16.0.6
+
+out/rust1.54.tgz: \
+	out/gcc.tgz \
+	out/bash.tgz \
+	out/zlib.tgz \
+	out/python.tgz \
+	out/py-setuptools.tgz \
+	out/perl.tgz \
+	out/libunwind.tgz \
+	out/pkgconf.tgz \
+	out/llvm13.tgz \
+	out/binutils.tgz \
+	out/cmake.tgz \
+	out/make.tgz \
+	out/busybox.tgz \
+	out/musl.tgz
+	$(call build,core,rust,1.54.0,bootstrap-package)
+
+out/rust1.55.tgz: out/rust1.54.tgz
+	$(call build,core,rust,1.55.0,package,--build-arg BUILD_VERSION=1.54.0)
+
+out/rust1.56.tgz: out/rust1.55.tgz
+	$(call build,core,rust,1.56.0,package,--build-arg BUILD_VERSION=1.55.0)
+
+out/rust1.57.tgz: out/rust1.56.tgz
+	$(call build,core,rust,1.57.0,package,--build-arg BUILD_VERSION=1.56.0)
+
+out/rust1.58.tgz: out/rust1.57.tgz
+	$(call build,core,rust,1.58.0,package,--build-arg BUILD_VERSION=1.57.0)
+
+out/rust1.59.tgz: out/rust1.58.tgz
+	$(call build,core,rust,1.59.0,package,--build-arg BUILD_VERSION=1.58.0)
+
+out/rust1.60.tgz: out/rust1.59.tgz
+	$(call build,core,rust,1.60.0,package,--build-arg BUILD_VERSION=1.59.0)
+
+out/rust1.61.tgz: out/rust1.60.tgz
+	$(call build,core,rust,1.61.0,package,--build-arg BUILD_VERSION=1.60.0)
+
+out/rust1.62.tgz: out/rust1.61.tgz
+	$(call build,core,rust,1.62.0,package,--build-arg BUILD_VERSION=1.61.0)
+
+out/rust1.63.tgz: out/rust1.62.tgz
+	$(call build,core,rust,1.63.0,package,--build-arg BUILD_VERSION=1.62.0)
+
+out/rust1.64.tgz: out/rust1.63.tgz
+	$(call build,core,rust,1.64.0,package,--build-arg BUILD_VERSION=1.63.0)
+
+out/rust1.65.tgz: out/rust1.64.tgz
+	$(call build,core,rust,1.65.0,package,--build-arg BUILD_VERSION=1.64.0)
+
+out/rust1.66.tgz: out/rust1.65.tgz
+	$(call build,core,rust,1.66.0,package,--build-arg BUILD_VERSION=1.65.0)
+
+out/rust1.67.tgz: out/rust1.66.tgz
+	$(call build,core,rust,1.67.0,package,--build-arg BUILD_VERSION=1.66.0)
+
+out/rust1.68.tgz: out/rust1.67.tgz
+	$(call build,core,rust,1.68.0,package,--build-arg BUILD_VERSION=1.67.0)
+
+out/rust1.69.tgz: out/rust1.68.tgz llvm.tgz
+	$(call build,core,rust,1.69.0,package,--build-arg BUILD_VERSION=1.68.0 --build-arg LLVM_VERSION=16)
+
+out/rust1.70.tgz: out/rust1.69.tgz
+	$(call build,core,rust,1.70.0,package,--build-arg BUILD_VERSION=1.69.0 --build-arg LLVM_VERSION=16)
+
+out/rust1.71.tgz: out/rust1.70.tgz
+	$(call build,core,rust,1.71.0,package,--build-arg BUILD_VERSION=1.70.0 --build-arg LLVM_VERSION=16)
+
+out/rust1.72.tgz: out/rust1.71.tgz
+	$(call build,core,rust,1.72.0,package,--build-arg BUILD_VERSION=1.71.0 --build-arg LLVM_VERSION=16)
+
+out/rust1.73.tgz: out/rust1.72.tgz
+	$(call build,core,rust,1.73.0,package,--build-arg BUILD_VERSION=1.72.0 --build-arg LLVM_VERSION=16)
+
+out/rust.tgz: out/rust1.73.tgz
+	$(call build,core,rust,1.74.0,package,--build-arg BUILD_VERSION=1.73.0 --build-arg LLVM_VERSION=16)
diff --git a/ca-certificates/Dockerfile b/src/core/ca-certificates/Dockerfile
similarity index 92%
rename from ca-certificates/Dockerfile
rename to src/core/ca-certificates/Dockerfile
index 907839a..c3e70ad 100644
--- a/ca-certificates/Dockerfile
+++ b/src/core/ca-certificates/Dockerfile
@@ -1,3 +1,4 @@
+ARG REGISTRY=local
 FROM ${REGISTRY}/busybox:latest as base
 
 FROM base as install
diff --git a/ca-certificates/cacert.pem b/src/core/ca-certificates/cacert.pem
similarity index 100%
rename from ca-certificates/cacert.pem
rename to src/core/ca-certificates/cacert.pem
diff --git a/cmake/Dockerfile b/src/core/cmake/Dockerfile
similarity index 91%
rename from cmake/Dockerfile
rename to src/core/cmake/Dockerfile
index b2a6a5b..9d20904 100644
--- a/cmake/Dockerfile
+++ b/src/core/cmake/Dockerfile
@@ -6,6 +6,7 @@ FROM ${REGISTRY}/curl:latest as curl
 FROM ${REGISTRY}/ninja:latest as ninja
 FROM ${REGISTRY}/openssl:latest as openssl
 FROM ${REGISTRY}/linux-headers:latest as linux-headers
+FROM ${REGISTRY}/openssl:latest as openssl
 FROM ${REGISTRY}/make:latest as make
 FROM ${REGISTRY}/busybox:latest as busybox
 
@@ -13,16 +14,16 @@ FROM busybox as base
 ENV SRC_SITE=https://cmake.org/files
 ENV SRC_VERSION=3.27.8
 ENV SRC_HASH=fece24563f697870fbb982ea8bf17482c9d5f855d8c9bf0b82463d76c9e8d0cc
-COPY --from=curl . /
 COPY --from=binutils . /
 COPY --from=ninja . /
 COPY --from=musl . /
 COPY --from=make . /
 COPY --from=linux-headers . /
 COPY --from=gcc . /
+COPY --from=openssl . /
 
 FROM base as fetch
-RUN curl -O ${SRC_SITE}/v3.27/cmake-${SRC_VERSION}.tar.gz
+RUN wget --no-check-certificate ${SRC_SITE}/v3.27/cmake-${SRC_VERSION}.tar.gz
 RUN echo "${SRC_HASH}  cmake-${SRC_VERSION}.tar.gz" | sha256sum -c
 
 FROM fetch as build
diff --git a/go/Dockerfile b/src/core/go/Dockerfile
similarity index 100%
rename from go/Dockerfile
rename to src/core/go/Dockerfile
diff --git a/go/test.go b/src/core/go/test.go
similarity index 100%
rename from go/test.go
rename to src/core/go/test.go
diff --git a/libtool/Dockerfile b/src/core/libtool/Dockerfile
similarity index 100%
rename from libtool/Dockerfile
rename to src/core/libtool/Dockerfile
diff --git a/libunwind/Dockerfile b/src/core/libunwind/Dockerfile
similarity index 100%
rename from libunwind/Dockerfile
rename to src/core/libunwind/Dockerfile
diff --git a/linux-headers/Dockerfile b/src/core/linux-headers/Dockerfile
similarity index 100%
rename from linux-headers/Dockerfile
rename to src/core/linux-headers/Dockerfile
diff --git a/llvm/Dockerfile b/src/core/llvm/Dockerfile
similarity index 95%
rename from llvm/Dockerfile
rename to src/core/llvm/Dockerfile
index bead6ac..1b5761e 100644
--- a/llvm/Dockerfile
+++ b/src/core/llvm/Dockerfile
@@ -8,7 +8,6 @@ FROM ${REGISTRY}/python as python
 FROM ${REGISTRY}/py-setuptools as py-setuptools
 FROM ${REGISTRY}/cmake as cmake
 FROM ${REGISTRY}/ninja as ninja
-FROM ${REGISTRY}/curl as curl
 FROM ${REGISTRY}/busybox as busybox
 
 FROM busybox as base
@@ -25,10 +24,9 @@ COPY --from=musl . /
 COPY --from=gcc . /
 COPY --from=python . /
 COPY --from=py-setuptools . /
-COPY --from=curl . /
 
 FROM base as fetch
-RUN curl -LOJ ${SRC_SITE}/llvmorg-${SRC_VERSION}/llvm-project-${SRC_VERSION}.src.tar.xz
+RUN wget ${SRC_SITE}/llvmorg-${SRC_VERSION}/llvm-project-${SRC_VERSION}.src.tar.xz
 RUN echo "$(printenv SRC_HASH_${VERSION//./_})  llvm-project-${SRC_VERSION}.src.tar.xz" | sha256sum -c
 
 FROM fetch as build
diff --git a/llvm/rust-feature-tables.patch b/src/core/llvm/rust-feature-tables.patch
similarity index 100%
rename from llvm/rust-feature-tables.patch
rename to src/core/llvm/rust-feature-tables.patch
diff --git a/m4/Dockerfile b/src/core/m4/Dockerfile
similarity index 100%
rename from m4/Dockerfile
rename to src/core/m4/Dockerfile
diff --git a/ninja/Dockerfile b/src/core/ninja/Dockerfile
similarity index 97%
rename from ninja/Dockerfile
rename to src/core/ninja/Dockerfile
index d2e94bd..459a513 100644
--- a/ninja/Dockerfile
+++ b/src/core/ninja/Dockerfile
@@ -1,10 +1,9 @@
 ARG REGISTRY=local
-FROM ${REGISTRY}/gcc:latest as gcc
 FROM ${REGISTRY}/binutils:latest as binutils
-FROM ${REGISTRY}/musl:latest as musl
 FROM ${REGISTRY}/make:latest as make
-FROM ${REGISTRY}/openssl:latest as openssl
 FROM ${REGISTRY}/python:latest as python
+FROM ${REGISTRY}/musl:latest as musl
+FROM ${REGISTRY}/gcc:latest as gcc
 FROM ${REGISTRY}/busybox:latest as busybox
 
 FROM busybox as base
diff --git a/ninja/fix-musl.patch b/src/core/ninja/fix-musl.patch
similarity index 100%
rename from ninja/fix-musl.patch
rename to src/core/ninja/fix-musl.patch
diff --git a/openssl/Dockerfile b/src/core/openssl/Dockerfile
similarity index 100%
rename from openssl/Dockerfile
rename to src/core/openssl/Dockerfile
diff --git a/perl/Dockerfile b/src/core/perl/Dockerfile
similarity index 100%
rename from perl/Dockerfile
rename to src/core/perl/Dockerfile
diff --git a/pkgconf/Dockerfile b/src/core/pkgconf/Dockerfile
similarity index 98%
rename from pkgconf/Dockerfile
rename to src/core/pkgconf/Dockerfile
index c50f0f3..29a6500 100644
--- a/pkgconf/Dockerfile
+++ b/src/core/pkgconf/Dockerfile
@@ -17,6 +17,8 @@ COPY --from=musl . /
 FROM base as fetch
 RUN wget ${SRC_SITE}/pkgconf-${SRC_VERSION}.tar.xz
 RUN echo "${SRC_HASH}  pkgconf-${SRC_VERSION}.tar.xz" | sha256sum -c
+
+FROM fetch as build
 RUN tar -xf pkgconf-${SRC_VERSION}.tar.xz
 WORKDIR pkgconf-${SRC_VERSION}
 RUN set -eux; \
diff --git a/py-setuptools/Dockerfile b/src/core/py-setuptools/Dockerfile
similarity index 100%
rename from py-setuptools/Dockerfile
rename to src/core/py-setuptools/Dockerfile
diff --git a/python/Dockerfile b/src/core/python/Dockerfile
similarity index 100%
rename from python/Dockerfile
rename to src/core/python/Dockerfile
index 1e4b2df..23b7011 100644
--- a/python/Dockerfile
+++ b/src/core/python/Dockerfile
@@ -10,11 +10,6 @@ FROM busybox as base
 ENV SRC_SITE=https://www.python.org/ftp/python
 ENV SRC_VERSION=3.12.0
 ENV SRC_HASH=795c34f44df45a0e9b9710c8c71c15c671871524cd412ca14def212e8ccb155d
-COPY --from=gcc . /
-COPY --from=binutils . /
-COPY --from=make . /
-COPY --from=musl . /
-COPY --from=openssl . /
 
 FROM base as fetch
 RUN wget ${SRC_SITE}/${SRC_VERSION}/Python-${SRC_VERSION}.tar.xz
@@ -23,6 +18,11 @@ RUN echo "${SRC_HASH}  Python-${SRC_VERSION}.tar.xz" | sha256sum -c
 FROM fetch as build
 RUN tar -xf Python-${SRC_VERSION}.tar.xz
 WORKDIR Python-${SRC_VERSION}
+COPY --from=gcc . /
+COPY --from=binutils . /
+COPY --from=make . /
+COPY --from=musl . /
+COPY --from=openssl . /
 RUN set -eux; \
     ./configure \
 		--build="x86_64-linux-musl" \
diff --git a/rust/Dockerfile b/src/core/rust/Dockerfile
similarity index 95%
rename from rust/Dockerfile
rename to src/core/rust/Dockerfile
index 11a3ad5..1f280b9 100644
--- a/rust/Dockerfile
+++ b/src/core/rust/Dockerfile
@@ -9,7 +9,6 @@ FROM ${REGISTRY}/bash as bash
 FROM ${REGISTRY}/make as make
 FROM ${REGISTRY}/cmake as cmake
 FROM ${REGISTRY}/perl as perl
-FROM ${REGISTRY}/curl as curl
 FROM ${REGISTRY}/libunwind as libunwind
 FROM ${REGISTRY}/python as python
 FROM ${REGISTRY}/py-setuptools as py-setuptools
@@ -68,15 +67,12 @@ COPY --from=perl . /
 COPY --from=gcc . /
 COPY --from=libunwind . /
 COPY --from=musl . /
-COPY --from=gcc . /
-COPY --from=musl . /
 
 FROM base as bootstrap-fetch
-COPY --from=curl . /
 RUN set -eux; \
-    curl ${MRUSTC_SITE}/${MRUSTC_VERSION} -o mrustc.tar.gz; \
+    wget --no-check-certificate ${MRUSTC_SITE}/${MRUSTC_VERSION} -O mrustc.tar.gz; \
     echo "${MRUSTC_HASH}  mrustc.tar.gz" | sha256sum -c; \
-    curl -OJ ${SRC_SITE}/rustc-${BOOTSTRAP_VERSION}-src.tar.gz; \
+    wget --no-check-certificate ${SRC_SITE}/rustc-${BOOTSTRAP_VERSION}-src.tar.gz; \
     echo "$(printenv SRC_HASH_${BOOTSTRAP_VERSION//./_})  rustc-${BOOTSTRAP_VERSION}-src.tar.gz" | sha256sum -c
 
 FROM bootstrap-fetch as bootstrap-build
@@ -120,9 +116,7 @@ ENTRYPOINT ["/usr/bin/rustc"]
 CMD ["--version"]
 
 FROM base as fetch
-COPY --from=curl . /
-RUN curl -OJ ${SRC_SITE}/rustc-${VERSION}-src.tar.gz
-RUN env
+RUN wget --no-check-certificate ${SRC_SITE}/rustc-${VERSION}-src.tar.gz
 RUN echo "$(printenv SRC_HASH_${VERSION//./_})  rustc-${VERSION}-src.tar.gz"
 RUN echo "$(printenv SRC_HASH_${VERSION//./_})  rustc-${VERSION}-src.tar.gz" | sha256sum -c
 
diff --git a/sed/Dockerfile b/src/core/sed/Dockerfile
similarity index 100%
rename from sed/Dockerfile
rename to src/core/sed/Dockerfile
diff --git a/zlib/Dockerfile b/src/core/zlib/Dockerfile
similarity index 100%
rename from zlib/Dockerfile
rename to src/core/zlib/Dockerfile
diff --git a/src/libs/build.mk b/src/libs/build.mk
new file mode 100644
index 0000000..3f8ffe4
--- /dev/null
+++ b/src/libs/build.mk
@@ -0,0 +1,18 @@
+out/libxml2.tgz: \
+	out/busybox.tgz \
+	out/gcc.tgz \
+	out/binutils.tgz \
+	out/musl.tgz \
+	out/make.tgz \
+	out/bash.tgz \
+	out/python.tgz \
+	out/sed.tgz \
+	out/m4.tgz \
+	out/autoconf.tgz \
+	out/automake.tgz \
+	out/pkgconf.tgz \
+	out/libtool.tgz
+	$(call build,libs,libxml2)
+
+out/ca-certificates.tgz:
+	$(call build,libs,ca-certificates)
diff --git a/libxml2/Dockerfile b/src/libs/libxml2/Dockerfile
similarity index 100%
rename from libxml2/Dockerfile
rename to src/libs/libxml2/Dockerfile
diff --git a/src/macros.mk b/src/macros.mk
new file mode 100644
index 0000000..3de9adc
--- /dev/null
+++ b/src/macros.mk
@@ -0,0 +1,46 @@
+# Build package with chosen $(BUILDER)
+# Supported BUILDERs: docker
+# Usage: $(call build,core/$(NAME),$(VERSION),$(TARGET),$(EXTRA_ARGS))
+# Notes:
+# - Packages are expected to use the following layer names in order:
+#   - "fetch": [optional] obtain any artifacts from the internet.
+#   - "build": [optional] do any required build work
+#   - "package": [required] scratch layer exporting artifacts for distribution
+#   - "test": [optional] define any tests
+# - Packages may prefix layer names with "text-" if more than one is desired
+# - VERSION will be set as a build-arg if defined, otherwise it is "latest"
+# - TARGET defaults to "package"
+# - EXTRA_ARGS will be blindly injected
+# - packages may also define a "test" layer
+#  TODO:
+# - try to disable networking on fetch layers with something like:
+#   $(if $(filter fetch,$(lastword $(subst -, ,$(TARGET)))),,--network=none)
+# - actually output OCI files for each build (vs plain tar)
+# - output manifest.txt of all tar/digest hashes for an easy git diff
+# - support buildah and podman
+define build
+	$(eval CATEGORY := $(1))
+	$(eval NAME := $(2))
+	$(eval VERSION := $(if $(3),$(3),latest))
+	$(eval TARGET := $(if $(4),$(4),package))
+	$(eval EXTRA_ARGS := $(if $(5),$(5),))
+	$(eval BUILD_CMD := \
+		DOCKER_BUILDKIT=1 \
+		SOURCE_DATE_EPOCH=1 \
+		$(BUILDER) \
+			build \
+			-t $(REGISTRY)/$(NAME):$(VERSION) \
+			--build-arg REGISTRY=$(REGISTRY) \
+			--platform $(PLATFORM) \
+			--progress=plain \
+			$(if $(filter latest,$(VERSION)),,--build-arg VERSION=$(VERSION)) \
+			--target $(TARGET) \
+			$(EXTRA_ARGS) \
+			src/$(CATEGORY)/$(NAME) \
+	)
+	$(eval TIMESTAMP := $(shell TZ=GMT date +"%Y-%m-%dT%H:%M:%SZ"))
+	mkdir -p out/
+	echo $(TIMESTAMP) $(BUILD_CMD) >> out/build.log
+	$(BUILD_CMD)
+	$(if $(filter package,$(TARGET)),$(BUILDER) save $(REGISTRY)/$(NAME):$(VERSION) -o $@,)
+endef
diff --git a/src/tools/build.mk b/src/tools/build.mk
new file mode 100644
index 0000000..73496e9
--- /dev/null
+++ b/src/tools/build.mk
@@ -0,0 +1,9 @@
+out/curl.tgz: \
+	out/gcc.tgz \
+	out/musl.tgz \
+	out/busybox.tgz \
+	out/make.tgz \
+	out/binutils.tgz \
+	out/openssl.tgz \
+	out/ca-certificates.tgz
+	$(call build,tools,curl)
diff --git a/curl/Dockerfile b/src/tools/curl/Dockerfile
similarity index 100%
rename from curl/Dockerfile
rename to src/tools/curl/Dockerfile