diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index 54c5731236..a88798e013 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -42,7 +42,7 @@ jobs:
             mkdir .git  # no git in our image
 
             #FIXME needed for gdk-pixbuf
-            apt --yes install shared-mime-info file
+            apt --yes install shared-mime-info
             ;;
           macos-11)
             # screws up a lot of build scripts
@@ -116,3 +116,12 @@ jobs:
           SLACK_MESSAGE: build job for ${{ inputs.projects }} ${{ needs.build.result == 'success' && 'succeeded' || 'failed' }}
           #FIXME SO UGLY: if one of the matrix fails, it cancels the others and returns `cancelled`
           SLACK_COLOR: ${{ needs.build.result == 'cancelled' && 'failed' || needs.build.result }}
+
+      #FIXME incredibly inefficient
+      - uses: chetan/invalidate-cloudfront-action@v2
+        env:
+          DISTRIBUTION: ${{ secrets.AWS_CF_DISTRIBUTION_ID }}
+          PATHS: "/*"
+          AWS_REGION: "us-east-1"
+          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
+          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index aecab46b69..3af2294f3a 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -1,10 +1,10 @@
 name: ci
 on: pull_request
 
-concurrency:
-  #TODO group: ${{ github.ref }}
-  group: only-one-due-to-versions.txt-generation-requiring-serial-ness
-  cancel-in-progress: true
+# concurrency:
+#   #TODO group: ${{ github.ref }}
+#   group: only-one-due-to-versions.txt-generation-requiring-serial-ness
+#   cancel-in-progress: true
 
 jobs:
   get-diff:
diff --git a/README.md b/README.md
index 5934b77e4b..c536fbd4d6 100644
--- a/README.md
+++ b/README.md
@@ -48,7 +48,7 @@ knowledge. Please keep it tidy.
 
 |   Project   | Version |
 |-------------|---------|
-| deno.land   | ^1.18   |
+| deno.land   | ^1.23   |
 | tea.xyz     | ^0      |
 
 ## Build All
diff --git a/projects/sourceware.org/libffi/package.yml b/projects/sourceware.org/libffi/package.yml
index a5152f3249..d32b6358be 100644
--- a/projects/sourceware.org/libffi/package.yml
+++ b/projects/sourceware.org/libffi/package.yml
@@ -17,5 +17,5 @@ test:
   dependencies:
     tea.xyz/gx/cc: c99
   script: |
-    cc -o closure {{ pkg.pantry-prefix }}/test.c -lffi
+    cc -o closure test.c -lffi
     ./closure
diff --git a/projects/unicode.org/package.yml b/projects/unicode.org/package.yml
index 7019b3b379..f214271203 100644
--- a/projects/unicode.org/package.yml
+++ b/projects/unicode.org/package.yml
@@ -22,5 +22,18 @@ build:
       - --disable-tests
       - --enable-static
       - --with-library-bits=64
+    darwin:
+      LDFLAGS:
+      # changing install names or rpaths can't be redone for
+      - -headerpad_max_install_names
 
-test: true  #FIXME
+test:
+  script: |
+    if test -f /usr/share/dict/words; then
+      gendict --uchars /usr/share/dict/words dict
+    else
+      gendict --uchars $FIXTURE dict
+    fi
+  fixture: |
+    hello
+    world
diff --git a/projects/zlib.net/package.yml b/projects/zlib.net/package.yml
index cff31df0ad..df54db3083 100644
--- a/projects/zlib.net/package.yml
+++ b/projects/zlib.net/package.yml
@@ -19,7 +19,7 @@ test:
   dependencies:
     tea.xyz/gx/cc: c99
   script: |
-    cc {{ pkg.pantry-prefix }}/test.c -lz
+    cc test.c -lz
     OUT=$(echo "$INPUT" | ./a.out | ./a.out -d)
     test "$OUT" = "$INPUT"
   env:
diff --git a/scripts/README.md b/scripts/README.md
new file mode 100644
index 0000000000..7a75afce8b
--- /dev/null
+++ b/scripts/README.md
@@ -0,0 +1,5 @@
+# build all
+
+```sh
+scripts/ls.ts | xargs scripts/sort.ts | xargs scripts/build.ts
+```
diff --git a/scripts/_lib.ts b/scripts/_lib.ts
index 457c0e3e4d..d406550e52 100644
--- a/scripts/_lib.ts
+++ b/scripts/_lib.ts
@@ -1,6 +1,9 @@
 import usePantry from "hooks/usePantry.ts"
 import { PackageRequirement } from "types"
 
+/// this function is poorly named and does too many things
+/// sorry. Refactor is desired.
+
 export function get_build_deps(dry: Set<string>) {
   const pantry = usePantry()
 
@@ -10,7 +13,19 @@ export function get_build_deps(dry: Set<string>) {
       // we hydrate the runtime deps of any build deps since if
       // any of `dry` is a runtime dep of any build dep (obv. from another)
       // pkg in the set we are building then it needs to be sorted first
-      return [...deps.runtime, ...deps.build]
+      const rv = [...deps.runtime, ...deps.build]
+
+      // if we are building a test-dep then we need it to be built before we
+      // build `pkg` or we will not be able to test it before building the whole
+      // graph
+      for (const test_dep of deps.test) {
+        if (dry.has(test_dep.project)) {
+          rv.push(test_dep)
+        }
+      }
+
+      return rv
+
     } else {
       return deps.runtime
     }
diff --git a/scripts/build-all.sh b/scripts/build-all.sh
new file mode 100755
index 0000000000..2b9aa120f4
--- /dev/null
+++ b/scripts/build-all.sh
@@ -0,0 +1,14 @@
+#!/bin/bash
+
+set -eo pipefail
+
+d="$(cd "$(dirname "$0")" && pwd)"
+all=$($d/ls.ts | xargs $d/sort.ts)
+
+for x in $all
+do
+  $d/build.ts $x
+  $d/test.ts $x --magic  #FIXME be precise
+done
+
+# $d/bottle.ts $all
diff --git a/scripts/test-all.sh b/scripts/test-all.sh
new file mode 100755
index 0000000000..d21ab99dfd
--- /dev/null
+++ b/scripts/test-all.sh
@@ -0,0 +1,7 @@
+#!/bin/sh
+
+set -eo pipefail
+
+for x in $(scripts/ls.ts); do
+  scripts/test.ts $x --magic
+done
diff --git a/scripts/test.ts b/scripts/test.ts
index d64188a0d7..3a58ed5789 100755
--- a/scripts/test.ts
+++ b/scripts/test.ts
@@ -19,6 +19,7 @@ import { run, undent, isPlainObject } from "utils"
 import { validatePackageRequirement } from "utils/lvl2.ts"
 import useFlags from "hooks/useFlags.ts"
 import useCellar from "hooks/useCellar.ts"
+import hydrate from "prefab/hydrate.ts"
 
 const { debug } = useFlags()
 
@@ -39,7 +40,7 @@ const self = {
   constraint: new semver.Range(pkg.version.toString())
 }
 const [yml] = await pantry.getYAML(pkg)
-const deps: PackageRequirement[] = [self, ...get_deps()]
+const deps: PackageRequirement[] = [self, ...await get_deps()]
 
 const env = await useShellEnv(deps)
 
@@ -83,11 +84,11 @@ try {
   if (!debug) tmp.rm({ recursive: true })
 }
 
-function get_deps() {
+async function get_deps() {
   const rv: PackageRequirement[] = []
   attempt(yml.dependencies)
   attempt(yml.test.dependencies)
-  return rv
+  return await hydrate(rv)
 
   function attempt(obj: PlainObject) {
     if (isPlainObject(obj))
diff --git a/scripts/upload.ts b/scripts/upload.ts
index 40f2a98aa3..b5f94f045f 100755
--- a/scripts/upload.ts
+++ b/scripts/upload.ts
@@ -14,7 +14,6 @@ args:
 import { S3 } from "s3"
 import { PackageRequirement, Path } from "types"
 import useCache from "hooks/useCache.ts"
-import useCellar from "hooks/useCellar.ts"
 import { Package, parsePackageRequirement, SemVer, semver } from "types"
 import useFlags from "hooks/useFlags.ts"
 
@@ -29,7 +28,6 @@ const s3 = new S3({
 })
 
 const bucket = s3.getBucket(Deno.env.get("AWS_S3")!)
-const cellar = useCellar()
 
 const encode = (() => { const e = new TextEncoder(); return e.encode.bind(e) })()
 
@@ -59,7 +57,10 @@ if (bottles.size !== checksums.size || ![...bottles].every(b => checksums.has(`$
 }
 
 for (const rq of bottles) {
-  const {pkg} = await cellar.resolve(rq)
+  // Packages should be a fixed version, so this should be fine:
+  const version = semver.parse(rq.constraint.raw)
+  if (!version) { throw new Error(`Incomplete package version: ${rq.constraint.raw}`)}
+  const pkg = { project: rq.project, version }
   const key = useCache().s3Key(pkg)
   const bottle = useCache().bottle(pkg)
   const checksum = new Path(`${bottle.string}.sha256sum`)