diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index ebc72822..c75c625c 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -43,10 +43,12 @@ jobs:
             rm -rf /opt/tea.xyz/var/pantry
             ln -s $GITHUB_WORKSPACE/pantry /opt/tea.xyz/var/pantry
             mkdir .git  # no git in our image
-            echo "--insecure" >> ~/.curlrc  # our curl is broke somehow for rust bootstrap
-            apt-get --yes install ca-certificates
             ;;
           macos-11)
+            # screws up a lot of build scripts
+            # TODO stop using GHA images or chroot or something
+            sudo rm -rf /usr/local/*
+
             sudo mkdir -p /opt/tea.xyz/var
             sudo chown -R $(whoami):staff /opt
             ln -s $GITHUB_WORKSPACE/pantry /opt/tea.xyz/var/pantry
diff --git a/projects/freedesktop.org/fontconfig/package.yml b/projects/freedesktop.org/fontconfig/package.yml
new file mode 100644
index 00000000..f07d0ead
--- /dev/null
+++ b/projects/freedesktop.org/fontconfig/package.yml
@@ -0,0 +1,35 @@
+distributable:
+  url: https://www.freedesktop.org/software/fontconfig/release/fontconfig-{{ version }}.tar.xz
+  strip-components: 1
+
+versions:
+  github: freedesktop/fontconfig/tags
+
+dependencies:
+  sourceware.org/bzip2: 1
+  freetype.org: 2
+  zlib.net: 1
+  gnome.org/libxml2: 2
+  libexpat.github.io: 2
+
+build:
+  dependencies:
+    tea.xyz/gx/cc: c99
+    tea.xyz/gx/make: '*'
+    freedesktop.org/pkg-config: ^0.29
+    gnu.org/gperf: 3
+    python.org: 3
+  script: |
+    ./configure --prefix={{ prefix }}
+    make --jobs {{ hw.concurrency }} install RUN_FC_CACHE_TEST=false
+
+test:
+  fc-list
+
+#TODO
+# font_dirs = %w[
+#   /System/Library/Fonts
+#   /Library/Fonts
+#   ~/Library/Fonts
+# ]
+# font_dirs << Dir["/System/Library/Assets{,V2}/com_apple_MobileAsset_Font*"].max if MacOS.version >= :sierra
diff --git a/projects/freetype.org/package.yml b/projects/freetype.org/package.yml
new file mode 100644
index 00000000..ddeb79c8
--- /dev/null
+++ b/projects/freetype.org/package.yml
@@ -0,0 +1,40 @@
+distributable:
+  url: https://download.savannah.gnu.org/releases/freetype/freetype-{{ version }}.tar.xz
+  #FIXME our linux docker image TLS doesn’t like this URL
+  # url: https://downloads.sourceforge.net/project/freetype/freetype{{ version.major }}/{{ version }}/freetype-{{ version }}.tar.xz
+  strip-components: 1
+
+versions:
+  - 2.12.1
+
+dependencies:
+  libpng.org: 1
+  zlib.net: 1
+  sourceware.org/bzip2: 1
+
+#FIXME the freetype-config script contains fullpaths to libpng
+# not sure of a portable way to fix that, probs best is using png-config
+
+build:
+  dependencies:
+    tea.xyz/gx/cc: c99
+    tea.xyz/gx/make: '*'
+    freedesktop.org/pkg-config: ^0.29
+    #NOTE cmake ∵ autoconf failed on Linux due to not creating the .so files
+    cmake.org: '*'
+  working-directory: build
+  script: |
+    cmake .. $ARGS
+    make --jobs {{ hw.concurrency }} install
+  env:
+    ARGS:
+      - -DBUILD_SHARED_LIBS=true
+      - -DCMAKE_INSTALL_PREFIX="{{ prefix }}"
+      - -DCMAKE_BUILD_TYPE=Release
+    # CC: clang
+    # CFLAGS: -fuse-ld=lld
+    # VERBOSE: 1
+    # CMAKE_PREFIX_PATH: /opt/libpng.org/v1:/opt/sourceware.org/bzip2/v1:/opt/zlib.net/v1
+
+#FIXME
+test: true
diff --git a/scripts/test.ts b/scripts/test.ts
index 38e43230..186e06b9 100755
--- a/scripts/test.ts
+++ b/scripts/test.ts
@@ -72,11 +72,10 @@ function get_deps() {
   return rv
 
   function attempt(obj: PlainObject) {
-    if (isPlainObject(obj)) {
-      for (const [project, constraint] of Object.entries(obj)) {
-        const pkg = validatePackageRequirement({ project, constraint })
-        if (pkg) rv.push(pkg)
-      }
+    if (isPlainObject(obj))
+    for (const [project, constraint] of Object.entries(obj)) {
+      const pkg = validatePackageRequirement({ project, constraint })
+      if (pkg) rv.push(pkg)
     }
   }
 }