27 files changed, 200 insertions, 247 deletions
diff --git a/build.sh b/build.sh
index f285634a..9caaeae6 100755
--- a/build.sh
+++ b/build.sh
@@ -3,21 +3,15 @@
 #
 
 #
-# Source subroutine scripts.
-# Process command line arguments.
+#
 #
 for __ in subr/*.subr; do
 	. ./${__};
 done;
-if [ -z "${BUILD_CPUS}" ]	\
-&& [ -e /proc/cpuinfo ]; then
-	BUILD_CPUS=$(awk '/^processor/{cpus++} END{print cpus}' /proc/cpuinfo);
-fi;
 while [ ${#} -gt 0 ]; do
 case ${1} in
 -c)	ARG_CLEAN=1; ;;
 -C)	ARG_CHECK_UPDATES=1; ;;
--n)	ARG_DRYRUN=1 ARG_VERBOSE=1; ;;
 -N)	ARG_OFFLINE=1; ;;
 -i)	ARG_IGNORE_SHA256SUMS=1; ;;
 -t*)	ARG_TARBALL=1; [ "${1#-t.}" != "${1}" ] && TARBALL_SUFFIX=${1#-t.}; ;;
@@ -43,15 +37,12 @@ esac; shift;
 done;
 
 #
-# Source the build variables file and its local overrides, if any.
-# Clear environment.
-# Check whether the pathnames in build.vars contain non-empty valid values.
-# Check whether all prerequisite command names resolve.
-# Check whether all prerequisite pathnames resolve.
-# Check whether all prerequisite Perl modules exist.
-# Clean ${PREFIX} if requested.
-# Create directory hierarchy and usr -> . symlinks.
 #
+#
+if [ -z "${BUILD_CPUS}" ]\
+&& [ -e /proc/cpuinfo ]; then
+	BUILD_CPUS=$(awk '/^processor/{cpus++} END{print cpus}' /proc/cpuinfo);
+fi;
 for __ in ${HOME}/midipix_build.vars ../midipix_build.vars ./vars/build.vars; do
 	[ -e ${__} ] && . ${__};
 done;
@@ -60,32 +51,38 @@ for __ in $(export | sed -e 's/^export //' -e 's/=.*$//'); do
 		unset "${__}";
 	fi;
 done;
-if [ -z "${BUILD_TARGETS_META}" ]; then
-	BUILD_TARGETS_META="invariants world";
-else
-	BUILD_TARGETS_META="invariants ${BUILD_TARGETS_META}";
-fi;
+
+#
+#
+#
 pre_prereqs;
 pre_subdirs;
 if [ -e ${BUILD_LOG_FNAME} ]; then
 	mv -- ${BUILD_LOG_FNAME} ${BUILD_LOG_LAST_FNAME};
 fi;
 touch ${BUILD_STATUS_IN_PROGRESS_FNAME};
-
-{(
 BUILD_DATE_START="$(date %Y-%m-%d-%H-%M-%S)";
 BUILD_NFINI=${BUILD_NSKIP:=${BUILD_NFAIL:=${BUILD_NBUILT:=0}}};
 BUILD_TIMES_SECS=$(command date +%s);
+
+#
+#
+#
+{(
 if [ ${ARG_CHECK_UPDATES:-0} -eq 0 ]; then
 	log_msg info "Build started by ${BUILD_USER:=${USER}}@${BUILD_HNAME:=$(hostname)} at ${BUILD_DATE_START}.";
 	log_env_vars "build (global)" ${LOG_ENV_VARS};
 else
 	log_msg info "Version check run started by ${BUILD_USER:=${USER}}@${BUILD_HNAME:=$(hostname)} at ${BUILD_DATE_START}.";
 fi;
-for BUILD_TARGET_LC in $(subst_tgts ${BUILD_TARGETS_META}); do
+for BUILD_TARGET_LC in $(subst_tgts invariants ${BUILD_TARGETS_META:-world}); do
 	BUILD_TARGET=$(echo ${BUILD_TARGET_LC} | tr a-z A-Z);
 	for BUILD_PACKAGE_LC in $(get_var_unsafe ${BUILD_TARGET}_PACKAGES); do
 		BUILD_PACKAGE=$(echo ${BUILD_PACKAGE_LC} | tr a-z A-Z);
+
+		#
+		#
+		#
 		if [ "${BUILD_TARGET}" != "INVARIANTS" ]\
 		&& [ -n "${ARG_RESTART}" ]; then
 			if [ "${ARG_RESTART}" != "ALL" ] &&\
@@ -96,17 +93,10 @@ for BUILD_TARGET_LC in $(subst_tgts ${BUILD_TARGETS_META}); do
 		fi;
 		if [ ${ARG_CHECK_UPDATES:-0} -eq 1 ]\
 		&& [ "${BUILD_PACKAGE#*.*}" = "${BUILD_PACKAGE}" ]; then
-			if [ ${ARG_DRYRUN:-0} -eq 1 ]; then
-				echo mode_check_pkg_updates "${BUILD_PACKAGE_LC}"		\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_VERSION)"	\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL)"		\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL_TYPE)";
-			else
-				mode_check_pkg_updates "${BUILD_PACKAGE_LC}"			\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_VERSION)"	\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL)"		\
-					"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL_TYPE)";
-			fi;
+			mode_check_pkg_updates "${BUILD_PACKAGE_LC}"			\
+				"$(get_var_unsafe PKG_${BUILD_PACKAGE}_VERSION)"	\
+				"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL)"		\
+				"$(get_var_unsafe PKG_${BUILD_PACKAGE}_URL_TYPE)";
 			continue;
 		fi;
 		if [ "${BUILD_TARGET}" != "INVARIANTS" ]\
@@ -114,50 +104,34 @@ for BUILD_TARGET_LC in $(subst_tgts ${BUILD_TARGETS_META}); do
 		&& is_build_script_done finish "${BUILD_PACKAGE_LC}"; then
 			log_msg vnfo "Skipped \`${BUILD_PACKAGE_LC}' (already built.)";
 			: $((BUILD_NSKIP+=1)); BUILD_SCRIPT_RC=0; continue;
-		fi;
-		if [ -n "${ARG_RESTART}" ]; then
+		elif [ -n "${ARG_RESTART}" ]; then
 			log_msg vnfo "Forcing package \`${BUILD_PACKAGE_LC}'.";
 		fi;
+
+		#
+		#
+		#
 		(set -o errexit -o noglob;
-		MIDIPIX_BUILD_PWD=$(pwd);
-		PKG_BUILD=${BUILD};
 		PKG_PREFIX=$(get_vars_unsafe ${BUILD_TARGET}_PREFIX PKG_${BUILD_PACKAGE%%.*}_PREFIX);				
-		PKG_TARGET=${TARGET};
-		cd ${WORKDIR};
-		for SCRIPT_SOURCE in vars/${BUILD_PACKAGE_LC%.*}.vars; do
-			if [ -f ${MIDIPIX_BUILD_PWD}/${SCRIPT_SOURCE} ]; then
-				if [ ${ARG_DRYRUN:-0} -eq 1 ]; then
-					echo . ${MIDIPIX_BUILD_PWD}/${SCRIPT_SOURCE};
-				else
-					. ${MIDIPIX_BUILD_PWD}/${SCRIPT_SOURCE};
-				fi;
-			fi;
-		done;
 		parse_with_pkg_name ${BUILD_PACKAGE_LC%.*};
-		for __ in all disabled fetch extract build_dir patch_pre autoconf patch		\
-				setup_env distclean configure clean build install; do
-			case ${__} in
-			all)
-				if test_cmd pkg_${PKG_NAME}_all; then
-					pkg_${PKG_NAME}_all; exit 0;
-				fi;
-				;;
-			disabled|build_dir|setup)
-				pkg_${__};
-				;;
-			*)	if ! is_build_script_done ${__}; then
-					if test_cmd pkg_${PKG_NAME}_${__}; then
-						pkg_${PKG_NAME}_${__};
+		for __ in ${BUILD_STEPS}; do
+			case ${__#*:} in
+			abstract)
+				if test_cmd pkg_${PKG_NAME}_${__%:*}; then
+					pkg_${PKG_NAME}_${__%:*}; exit 0;
+				fi; ;;
+			always)	pkg_${__%:*}; ;;
+			main)	if ! is_build_script_done ${__%:*}; then
+					if test_cmd pkg_${PKG_NAME}_${__%:*}; then
+						pkg_${PKG_NAME}_${__%:*};
 					else
-						pkg_${__};
+						pkg_${__%:*};
 					fi;
-				fi;
-				;;
+				fi; ;;
 			esac;
 		done;
-		set_build_script_done finish;
-		);
-		BUILD_SCRIPT_RC=${?}; case ${BUILD_SCRIPT_RC} in
+		set_build_script_done finish); BUILD_SCRIPT_RC=${?};
+		case ${BUILD_SCRIPT_RC} in
 		0) log_msg succ "Finished \`${BUILD_PACKAGE_LC}' build.";
 			: $((BUILD_NFINI+=1)); continue; ;;
 		*) log_msg fail "Build failed in \`${BUILD_PACKAGE_LC}' (last return code ${BUILD_SCRIPT_RC}.).";
@@ -168,9 +142,7 @@ for BUILD_TARGET_LC in $(subst_tgts ${BUILD_TARGETS_META}); do
 		break;
 	fi;
 done;
-for __ in copy_etc strip tarballs; do
-	post_${__};
-done;
+post_copy_etc; post_strip; post_tarballs;
 : $((BUILD_TIMES_SECS=$(command date +%s)-${BUILD_TIMES_SECS}));
 : $((BUILD_TIMES_HOURS=${BUILD_TIMES_SECS}/3600));
 : $((BUILD_TIMES_MINUTES=(${BUILD_TIMES_SECS}%3600)/60));
@@ -178,9 +150,13 @@ done;
 log_msg info "${BUILD_NFINI} finished, ${BUILD_NSKIP} skipped, and ${BUILD_NFAIL} failed builds in ${BUILD_NBUILT} build script(s).";
 log_msg info "Build time: ${BUILD_TIMES_HOURS} hour(s), ${BUILD_TIMES_MINUTES} minute(s), and ${BUILD_TIMES_SECS} second(s).";
 if [ -f "${BUILD_STATUS_IN_PROGRESS_FNAME}" ]; then
-	secure_rm ${BUILD_STATUS_IN_PROGRESS_FNAME};
+	build_fileop rm ${BUILD_STATUS_IN_PROGRESS_FNAME};
 fi;
 exit ${BUILD_SCRIPT_RC})} 2>&1 | tee ${BUILD_LOG_FNAME} &
+
+#
+#
+#
 TEE_PID=${!};
 trap "rm -f ${BUILD_STATUS_IN_PROGRESS_FNAME};	\
 	log_msg fail \"Build aborted.\";	\
diff --git a/etc/build.usage b/etc/build.usage
index a2bc2b1e..7f2d7376 100644
--- a/etc/build.usage
+++ b/etc/build.usage
@@ -1,5 +1,5 @@
 usage: ./build.sh [-x] [-a nt32|nt64] [-b debug|release] [-c] [-C] [-h]
-                  [-i] [-n] [-N] [-r package[,...][:step]] [-t[.gz|.bz2|.xz]
+                  [-i] [-N] [-r package[,...][:step]] [-t[.gz|.bz2|.xz]
                   [-v] [<target>[ ...]]
         -x                      Set the xtrace sh(1)ell option for debugging purposes.
         -a nt32|nt64            Selects 32-bit or 64-bit architecture; defaults to nt64.
@@ -9,7 +9,6 @@ usage: ./build.sh [-x] [-a nt32|nt64] [-b debug|release] [-c] [-C] [-h]
         -C                      Check package(s) for updates upstream.
         -h                      Show this screen.
         -i                      Ignore SHA256 hash mismatches when downloading files.
-        -n                      Perform dry run.
         -N                      Offline mode: no {wget,git-{clone,pull}}(1) calls.
         -r package[,...][:step] Restart the specified comma-separated build(s) completely or at
                                 the optionally specified step. Currently defined steps are:
@@ -20,7 +19,7 @@ usage: ./build.sh [-x] [-a nt32|nt64] [-b debug|release] [-c] [-C] [-h]
                                 level regular files at the end of a build with zero failures. The
                                 tarballs will be compressed with either gzip, bzip2, or xz and signed
                                 with GPG; the default compression is xz.
-        -v                      Be verbose; this currently only affects secure_{cd,rm}() and insecure_mkdir().
+        -v                      Be verbose.
         <target>[ ...]          One of:
                                 host_toolchain, native_toolchain, runtime, lib_packages,
                                 leaf_packages, world, or devroot.
diff --git a/subr/rtl.subr b/subr/build.subr
index 4779af8c..a1009c2b 100644
--- a/subr/rtl.subr
+++ b/subr/build.subr
@@ -22,6 +22,13 @@ get_vars_unsafe() {
 	unset _gvu_vval _gvu_vval_;
 };
 
+set_env_vars_with_sep() {
+	_sevws_sep=${1}; shift; push_IFS ${_sevws_sep}; set -- ${1};
+	while [ ${#} -gt 0 ]; do
+		export "${1}"; shift;
+	done; unset _sevws_sep; pop_IFS;
+};
+
 log_msg() {
 	_lm_lvl=${1}; shift;
 	if [ "${_lm_lvl#v}" != "${_lm_lvl}" ]\
@@ -44,21 +51,10 @@ log_msg() {
 	fi; [ ${_lm_lvl} = failexit ] && exit 1 || unset _lm_lvl;
 };
 
-insecure_mkdir() {
-	while [ ${#} -gt 0 ]; do
-		if [ -z "${1}" ]; then
-			return 1;
-		elif [ ! -e "${1}" ]; then
-			log_msg varn "Making directory \`${1}'.";
-			mkdir -p -- "${1}";
-		fi; shift;
-	done;
-};
-
 install_files() {
 	if [ "${1}" = "-v" ]; then
 		_if_verbose="${1}"; shift;
-	fi;
+	fi; _if_prefix="${1}"; shift;
 	while [ ${#} -gt 0 ]; do
 	case "${1}" in
 	@*=*)
@@ -67,32 +63,23 @@ install_files() {
 		__ln_fname="${1#*=}";
 		if [ -e ${__ln_fname} ]; then
 			if [ ${_if_verbose:-0} -eq 1 ]; then
-				echo secure_rm ${__ln_fname};
+				echo build_fileop rm ${__ln_fname};
 			fi;
-			secure_rm ${__ln_fname};
-		fi;
-		if [ ${_if_verbose:-0} -eq 1 ]; then
-			echo ln -sf -- ${__ln_target} ${PKG_PREFIX:+${PKG_PREFIX}/}${__ln_fname};
+			build_fileop rm ${__ln_fname};
 		fi;
-		ln -sf -- ${__ln_target} ${PKG_PREFIX:+${PKG_PREFIX}/}${__ln_fname};
+		build_fileop ln_symbolic ${__ln_target} ${_if_prefix:+${_if_prefix}/}${__ln_fname};
 		;;
 	/=*)
 		__mkdir_fname="${1#/=}";
-		if [ ${_if_verbose:-0} -eq 1 ]; then
-			echo insecure_mkdir ${PKG_PREFIX:+${PKG_PREFIX}/}${__mkdir_fname};
-		fi;
-		insecure_mkdir ${PKG_PREFIX:+${PKG_PREFIX}/}${__mkdir_fname};
+		build_fileop mkdir ${_if_prefix:+${_if_prefix}/}${__mkdir_fname};
 		;;
 	*)
 		__file_fname_src="${1%=*}";
 		__file_fname_dst="${1#*=}";
-		if [ ${_if_verbose:-0} -eq 1 ]; then
-			echo cp -pP -- ${__file_fname_src} ${PKG_PREFIX:+${PKG_PREFIX}/}${__file_fname_dst};
-		fi;
-		cp -pP -- ${__file_fname_src} ${PKG_PREFIX:+${PKG_PREFIX}/}${__file_fname_dst};
+		build_fileop cp ${__file_fname_src} ${_if_prefix:+${_if_prefix}/}${__file_fname_dst};
 		;;
 	esac; shift;
-	done; unset _if_verbose;
+	done; unset _if_verbose _if_prefix;
 };
 
 match_list() {
@@ -104,45 +91,37 @@ match_list() {
 	done; unset _ml_cmp; return 1;
 };
 
-secure_cd() {
-	if [ \( -z "${1}" \) -o \( ! -e "${1}" \) ]; then
-		return 1;
-	else
-		(cd "${1}"; [ "${PWD#${PREFIX_ROOT}}" = "${PWD}" ] &&\
-			return 1 || return 0);
-		if [ ${?} -eq 0 ]; then
-			log_msg varn "Changing working directory to \`${1}'.";
-			cd -- "${1}";
-		else
-			log_msg failexit "secure_cd() called with pathname \`${1}' not below \${PREFIX_ROOT} (${PREFIX_ROOT}). This is a bug.";
-		fi;
-	fi;
-};
-
-secure_rm() {
-	while [ ${#} -gt 0 ]; do
-		if [ -z "${1}" ]; then
-			return 1;
-		elif [ -e "${1}" ]; then
-			if [ -d "${1}" ]; then
-				_sr_pname_check="${1}";
-			else
-				_sr_pname_check="$(dirname "${1}")";
-			fi;
-			(cd "${_sr_pname_check}"; [ "${PWD#${PREFIX_ROOT}}" = "${PWD}" ] &&\
-				return 1 || return 0);
-			if [ ${?} -eq 0 ]; then
-				unset _sr_pname_check;
+build_fileop() {
+	_bf_op=${1}; shift;
+	if [ "${_bf_op}" = cd ]; then
+		log_msg varn "Changing working directory to \`${1}'.";
+		[ \( -n "${1}" \) -a \( -e "${1}" \) ] && cd -- ${1};
+	elif [ "${_bf_op}" = cp ]; then
+		log_msg varn "Copying \`${1}' to \`${2}' w/ -pPR.";
+		[ ${#} -ge 2 ] && cp -pPR -- "${@}";
+	elif [ "${_bf_op}" = ln_symbolic ]; then
+		log_msg varn "Linking \`${1}' to \`${2}' w/ -fs";
+		[ \( -n "${1}" \) -a \( -n "${2}" \) ] && ln -fs -- ${1} ${2};
+	elif [ "${_bf_op}" = mkdir ]\
+	||   [ "${_bf_op}" = rm ]; then
+		while [ ${#} -gt 0 ]; do
+			if [ -z "${1}" ]; then
+				return 1;
+			elif [ "${_bf_op}" = mkdir ]\
+			&&   [ ! -e "${1}" ]; then
+				log_msg varn "Making directory \`${1}'.";
+				mkdir -p -- "${1}";
+			elif [ "${_bf_op}" = rm ]\
+			&&   [ -e "${1}" ]; then
 				log_msg varn "Removing directory or file \`${1}'.";
 				rm -rf -- "${1}";
-			else
-				log_msg failexit "secure_rm() called with pathname \`${1}' not below \${PREFIX_ROOT} (${PREFIX_ROOT}). This is a bug.";
-			fi;
-		fi; shift;
-	done;
+			fi; shift;
+		done;
+	else
+		log_msg failexit "Error: build_fileop() called w/ invalid parameter(s) \`${@}'.";
+	fi;
 };
 
-
 is_build_script_done() {
 	if [ "${1}" = "clean" ]\
 	|| [ "${1}" = distclean ]; then
@@ -174,6 +153,19 @@ is_build_script_done() {
 	fi;
 };
 
+set_build_script_done() {
+	_sbsd_script_fname=${BUILD_PACKAGE_LC};
+	_sbsd_done_fname=${WORKDIR}/.${_sbsd_script_fname};
+	while [ $# -ge 1 ]; do
+		if [ "${1#-}" != "${1}" ]; then
+			build_fileop rm ${_sbsd_done_fname}.${1#-};
+		else
+			touch ${_sbsd_done_fname}.${1};
+			log_msg info "Finished build step ${1} of \`${_sbsd_script_fname}'.";
+		fi; shift;
+	done; unset _sbsd_script_fname _sbsd_done_fname;
+};
+
 log_env_vars() {
 	log_msg info "Variables for this ${1:-build}:"; shift;
 	while [ ${_lev_nvar:=0} -lt ${#} ]; do
@@ -192,7 +184,11 @@ log_env_vars() {
 };
 
 parse_with_pkg_name() {
-	PKG_NAME=${1}; shift;
+	PKG_NAME=${1}; shift; PKG_TARGET=${TARGET};
+	MIDIPIX_BUILD_PWD=$(pwd); build_fileop cd ${WORKDIR};
+	for __ in vars/${PKG_NAME}.vars; do
+		[ -e ${MIDIPIX_BUILD_PWD}/${__} ] && . ${MIDIPIX_BUILD_PWD}/${__};
+	done;
 	_pwpn_pkg_name_uc=$(echo ${PKG_NAME} | tr a-z A-Z);
 	if [ -z "$(get_var_unsafe PKG_${_pwpn_pkg_name_uc}_URL)" ]\
 	&& [ -z "$(get_var_unsafe PKG_${_pwpn_pkg_name_uc}_URLS_GIT)" ]\
@@ -242,26 +238,6 @@ run_cmd_unsplit() {
 	unset _rcu_cmd _rcu_cmdline; return ${_rcu_rc};
 };
 
-set_build_script_done() {
-	_sbsd_script_fname=${BUILD_PACKAGE_LC};
-	_sbsd_done_fname=${WORKDIR}/.${_sbsd_script_fname};
-	while [ $# -ge 1 ]; do
-		if [ "${1#-}" != "${1}" ]; then
-			secure_rm ${_sbsd_done_fname}.${1#-};
-		else
-			touch ${_sbsd_done_fname}.${1};
-			log_msg info "Finished build step ${1} of \`${_sbsd_script_fname}'.";
-		fi; shift;
-	done; unset _sbsd_script_fname _sbsd_done_fname;
-};
-
-set_env_vars_with_sep() {
-	_sevws_sep=${1}; shift; push_IFS ${_sevws_sep}; set -- ${1};
-	while [ ${#} -gt 0 ]; do
-		export "${1}"; shift;
-	done; unset _sevws_sep; pop_IFS;
-};
-
 subst_tgts() {
 	while [ ${#} -ge 1 ]; do
 	case "${1}" in
diff --git a/subr/pkg_autoconf.subr b/subr/pkg_autoconf.subr
index 1896fc1c..6390dc97 100644
--- a/subr/pkg_autoconf.subr
+++ b/subr/pkg_autoconf.subr
@@ -27,14 +27,13 @@ pkg_autoconf() {
 						break;
 					fi;
 				done;
-				(cd ${PKG_SUBDIR} && ${SHELL} ./autogen.sh) || exit 1;
+				(build_fileop cd ${PKG_SUBDIR} && ${SHELL} ./autogen.sh) || exit 1;
 			else
-				(cd ${PKG_SUBDIR} && autoconf) || exit 1;
+				(build_fileop cd ${PKG_SUBDIR} && autoconf) || exit 1;
 			fi;
 		fi;
 		for __ in ${PKG_BUILD_DIR} ${PKG_CONFIG_CACHE_EXTRA}; do
-			echo cp -- ${MIDIPIX_BUILD_PWD}/etc/config.cache ${__}/;
-			cp -- ${MIDIPIX_BUILD_PWD}/etc/config.cache ${__}/;
+			build_fileop cp ${MIDIPIX_BUILD_PWD}/etc/config.cache ${__}/;
 		done;
 	fi;
 	set_build_script_done autoconf -patch;
diff --git a/subr/pkg_build_dir.subr b/subr/pkg_build_dir.subr
index abb852f9..7d500758 100644
--- a/subr/pkg_build_dir.subr
+++ b/subr/pkg_build_dir.subr
@@ -8,7 +8,7 @@ pkg_build_dir() {
 		set_build_dir ${PKG_SUBDIR} ${PKG_BUILD_TYPE:-native};
 	fi;
 	if [ ! -d "${PKG_BUILD_DIR}" ]; then
-		insecure_mkdir ${PKG_BUILD_DIR};
+		build_fileop mkdir ${PKG_BUILD_DIR};
 	fi;
 	set_build_script_done build_dir -patch_pre;
 };
diff --git a/subr/pkg_configure.subr b/subr/pkg_configure.subr
index 501ad710..598c2366 100644
--- a/subr/pkg_configure.subr
+++ b/subr/pkg_configure.subr
@@ -10,7 +10,7 @@ pkg_configure() {
 		fi;
 		CFLAGS="${PKG_CFLAGS_CONFIGURE}${PKG_CFLAGS_CONFIGURE_EXTRA:+ ${PKG_CFLAGS_CONFIGURE_EXTRA}}"\
 		LDFLAGS="${PKG_LDFLAGS_CONFIGURE}${PKG_LDFLAGS_CONFIGURE_EXTRA:+ ${PKG_LDFLAGS_CONFIGURE_EXTRA}}"\
-		${PKG_CONFIGURE}								\
+		${PKG_CONFIGURE}										\
 			${PKG_CONFIGURE_ARGS} ${PKG_CONFIGURE_ARGS_EXTRA} ${PKG_CONFIGURE_ARGS_EXTRA_DEBUG};
 	fi;
 	set_build_script_done configure clean -build;
diff --git a/subr/pkg_distclean.subr b/subr/pkg_distclean.subr
index aae22162..ed380727 100644
--- a/subr/pkg_distclean.subr
+++ b/subr/pkg_distclean.subr
@@ -5,8 +5,8 @@
 
 pkg_distclean() {
 	if [ "${PKG_SUBDIR}" != "${PKG_BUILD_DIR}" ]; then
-		secure_rm ${PKG_BUILD_DIR};
-		insecure_mkdir ${PKG_BUILD_DIR};
+		build_fileop rm ${PKG_BUILD_DIR};
+		build_fileop mkdir ${PKG_BUILD_DIR};
 	fi;
 	set_build_script_done distclean -configure;
 };
diff --git a/subr/pkg_extract.subr b/subr/pkg_extract.subr
index 2b7d4fd4..f63cefa0 100644
--- a/subr/pkg_extract.subr
+++ b/subr/pkg_extract.subr
@@ -6,9 +6,9 @@
 pkg_extract() {
 	if [ -n "${PKG_URL}" ]\
 	&& [ "${PKG_URL_TYPE:-wget}" = wget ]; then
-		secure_rm ${PKG_SUBDIR};
+		build_fileop rm ${PKG_SUBDIR};
 		if [ ${PKG_SUBDIR_CREATE:-0} -eq 1 ]; then
-			insecure_mkdir ${PKG_SUBDIR};
+			build_fileop mkdir ${PKG_SUBDIR};
 		fi;
 		if [ "${PKG_FNAME##*.tar.}" = "bz2" ]; then
 			bunzip2 -d < ${DLCACHEDIR}/${PKG_FNAME} | tar ${PKG_SUBDIR_CREATE:+-C ${PKG_SUBDIR}} -xf -;
diff --git a/subr/pkg_fetch.subr b/subr/pkg_fetch.subr
index beb76e60..f7da99fe 100644
--- a/subr/pkg_fetch.subr
+++ b/subr/pkg_fetch.subr
@@ -32,20 +32,22 @@ pkgp_fetch_git() {
 	_fg_subdir="${1}"; _fg_url="${2}"; _fg_branch="${3}";
 	if [ ${ARG_OFFLINE:-0} -eq 0 ]; then
 		if [ -e "${DLCACHEDIR}/${_fg_subdir}" ]; then
-			cd ${DLCACHEDIR}/${_fg_subdir} &&\
-				git pull origin ${_fg_branch:-main} && cd ${OLDPWD};
+			build_fileop cd ${DLCACHEDIR}/${_fg_subdir} &&\
+				git pull origin ${_fg_branch:-main} &&\
+					build_fileop cd ${OLDPWD};
 		else
 			git clone ${_fg_url} ${DLCACHEDIR}/${_fg_subdir};
 			if [ -n "${_fg_branch}" -a		\
 			     \( -z "${_fg_branch#main}" \) -a	\
 			     \( -z "${_fg_branch#master}" \) ]; then
-				cd ${DLCACHEDIR}/${_fg_subdir} &&\
-					git checkout -b ${_fg_branch} && cd ${OLDPWD};
+				build_fileop cd ${DLCACHEDIR}/${_fg_subdir}	&&\
+					git checkout -b ${_fg_branch}		&&\	
+						build_fileop cd ${OLDPWD};
 			fi;
 		fi;
 	fi;
-	secure_rm ${_fg_subdir};
-	cp -pr ${DLCACHEDIR}/${_fg_subdir} .;
+	build_fileop rm ${_fg_subdir};
+	build_fileop cp ${DLCACHEDIR}/${_fg_subdir} .;
 };
 
 pkgp_fetch_urls_git() {
diff --git a/subr/pkg_install.subr b/subr/pkg_install.subr
index 73898337..ad451e80 100644
--- a/subr/pkg_install.subr
+++ b/subr/pkg_install.subr
@@ -6,7 +6,7 @@
 pkgp_install_clean_lib() {
 	if [ -d ${PKG_PREFIX}/lib ]; then
 		for __ in $(find ${PKG_PREFIX}/lib -type f -name \*.la); do
-			secure_rm ${__};
+			build_fileop rm ${__};
 		done;
 	fi;
 };
@@ -33,8 +33,7 @@ pkgp_install_dlltool() {
 					-D ${__so_fname} -d ${__so_fname%.so}.def;
 				${PKG_TARGET}-dlltool -l ${__so_fname%.so}.lib.a	\
 					-D ${__so_fname} -d ${__so_fname%.so}.def;
-				echo cp -- ${__so_fname%.so}.lib.a "${PKG_PREFIX}/lib";
-				cp -- ${__so_fname%.so}.lib.a "${PKG_PREFIX}/lib";
+				build_fileop cp ${__so_fname%.so}.lib.a "${PKG_PREFIX}/lib";
 			fi;
 		done;
 	fi;
@@ -71,7 +70,7 @@ pkg_install() {
 	fi;
 	pkgp_install_clean_lib;
 	if [ -n "${PKG_INSTALL_FILES}" ]; then
-		(install_files -v ${PKG_INSTALL_FILES});
+		(install_files -v ${PKG_PREFIX} ${PKG_INSTALL_FILES});
 	fi;
 	pkgp_install_dlltool;
 	set_build_script_done install -finish;
diff --git a/subr/pkg_setup_env.subr b/subr/pkg_setup_env.subr
index de304328..9faf3875 100644
--- a/subr/pkg_setup_env.subr
+++ b/subr/pkg_setup_env.subr
@@ -29,7 +29,7 @@ pkg_setup_env() {
 	if [ "${PKG_SLIBTOOL}" != "default" ]; then
 		export MAKE="make LIBTOOL=${PKG_SLIBTOOL:-slibtool}";
 	fi;
-	cd ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	set_build_script_done setup distclean -configure;
 };
 
diff --git a/subr/post_tarballs.subr b/subr/post_tarballs.subr
index 739acdd9..d55d2a41 100644
--- a/subr/post_tarballs.subr
+++ b/subr/post_tarballs.subr
@@ -84,7 +84,7 @@ post_tarballs() {
 			TARBALL_COMPRESS_ARGS="-T0"; ;;
 		*)	log_msg failexit "Unknown tarball suffix \`.${TARBALL_SUFFIX}'.";
 		esac;
-		cd ${PREFIX}; PREFIX_BASENAME=${PREFIX_NATIVE##*/};
+		build_fileop cd ${PREFIX}; PREFIX_BASENAME=${PREFIX_NATIVE##*/};
 		postp_tarball_dist; postp_tarball_toolchain; postp_tarball_minipix;
 		if [ "${BUILD}" = "debug" ]; then
 			postp_tarball_src;
diff --git a/subr/pre_subdirs.subr b/subr/pre_subdirs.subr
index 81b89d06..383ab55a 100644
--- a/subr/pre_subdirs.subr
+++ b/subr/pre_subdirs.subr
@@ -2,31 +2,32 @@
 # . ./build.vars and set -o errexit -o noglob are assumed.
 #
 
-post_subdirs() {
+pre_subdirs() {
 	if [ ${ARG_CLEAN:-0} -eq 1 ]; then
 		log_msg info "-c specified, cleaning prefix...";
 		for __ in ${CLEAR_PREFIX_DIRS}; do
 			if [ -e ${PREFIX}/${__} ]; then
-				secure_rm ${PREFIX}/${__};
+				build_rm ${PREFIX}/${__};
 			fi;
 		done;
 	fi;
-	install_files 											\
-		/=${DLCACHEDIR}										\
-		/=${WORKDIR}										\
-		/=${PREFIX}										\
-		/=${PREFIX}/x86_64-w64-mingw32/mingw/include						\
-		/=${PREFIX_CROSS}									\
-		/=${PREFIX_MINIPIX}/bin									\
-		/=${PREFIX_NATIVE}									\
-		/=${PREFIX_TARGET}/lib									\
-		@.=${PREFIX}/usr									\
-		@.=${PREFIX}/x86_64-w64-mingw32/mingw							\
-		@.=${PREFIX_NATIVE}/usr									\
-		@bin=${PREFIX_MINIPIX}/lib								\
-		@bin=${PREFIX_MINIPIX}/libexec								\
-		@bin=${PREFIX_MINIPIX}/share								\
-		@share/man=${PREFIX}/man								\
+	install_files ""					\
+		/=${DLCACHEDIR}					\
+		/=${WORKDIR}					\
+		/=${PREFIX}					\
+		/=${PREFIX}/x86_64-w64-mingw32			\
+		/=${PREFIX_CROSS}				\
+		/=${PREFIX_MINIPIX}/bin				\
+		/=${PREFIX_NATIVE}				\
+		/=${PREFIX_TARGET}/lib				\
+		@.=${PREFIX}/usr				\
+		@.=${PREFIX}/x86_64-w64-mingw32/mingw		\
+		/=${PREFIX}/x86_64-w64-mingw32/mingw/include	\
+		@.=${PREFIX_NATIVE}/usr				\
+		@bin=${PREFIX_MINIPIX}/lib			\
+		@bin=${PREFIX_MINIPIX}/libexec			\
+		@bin=${PREFIX_MINIPIX}/share			\
+		@share/man=${PREFIX}/man			\
 		@share/man=${PREFIX_NATIVE}/man;
 };
 
diff --git a/vars/apr_util.vars b/vars/apr_util.vars
index 296ae712..f6681b83 100644
--- a/vars/apr_util.vars
+++ b/vars/apr_util.vars
@@ -3,7 +3,8 @@
 #
 
 pkg_apr_util_install_post() {
-	cp -p	${PKG_PREFIX}/bin/apu-1-config	\
+	build_fileop cp					\
+		${PKG_PREFIX}/bin/apu-1-config		\
 		${PREFIX}/bin/${PKG_TARGET}-apu-1-config;
 };
 
diff --git a/vars/build.vars b/vars/build.vars
index 4d8dab83..50503899 100644
--- a/vars/build.vars
+++ b/vars/build.vars
@@ -40,6 +40,7 @@ fi;
 : ${BUILD_LOG_FNAME:=${PREFIX}/build.log};
 : ${BUILD_LOG_LAST_FNAME:=${PREFIX}/build.log.last};
 : ${BUILD_STATUS_IN_PROGRESS_FNAME:=${PREFIX}/BUILD_IN_PROGRESS};
+: ${BUILD_STEPS:="all:abstract disabled:always fetch:main extract:main build_dir:always patch_pre:main autoconf:main patch:main setup_env:always distclean:main configure:main clean:main build:main install:main"};
 : ${CHECK_PREREQ_CMDS:="aclocal autoconf autopoint awk basename bunzip2 find flex gcc git groff gunzip install ld libtool lzma make makeinfo msgfmt nl nroff openssl paste patch python sed sha256sum sort tar tee tic tr uname wget xz"};
 : ${CHECK_PREREQ_FILES:="/usr/include/gmpxx.h /usr/include/mpc.h /usr/include/mpfr.h"};
 : ${CHECK_PREREQ_FILES_DYNAMIC:='/usr/share/groff/$(groff -v 2>/dev/null | awk '\''/^GNU groff version /{print $NF}'\'')/tmac/e.tmac'};
diff --git a/vars/clang_host.vars b/vars/clang_host.vars
index 861dab03..199a8633 100644
--- a/vars/clang_host.vars
+++ b/vars/clang_host.vars
@@ -3,13 +3,13 @@
 #
 
 pkg_clang_host_configure_pre() {
-	secure_rm ${WORKDIR}/Makefile;
+	build_fileop rm ${WORKDIR}/Makefile;
 };
 
 pkg_clang_host_configure() {
-	secure_rm ../cfe-${PKG_VERSION}-host;
-	insecure_mkdir ../cfe-${PKG_VERSION}-host;
-	cd ../cfe-${PKG_VERSION}-host;
+	build_fileop rm ../cfe-${PKG_VERSION}-host;
+	build_fileop mkdir ../cfe-${PKG_VERSION}-host;
+	build_fileop cd ../cfe-${PKG_VERSION}-host;
 	log_msg info "Bootstrapping clang_host...";
 	(${PREFIX}/bin/cmake ../cfe-${PKG_VERSION}.src	\
 		-DCLANG_BUILD_EXAMPLES:BOOL=OFF		\
diff --git a/vars/cmake.vars b/vars/cmake.vars
index ee60c82f..160c8fcb 100644
--- a/vars/cmake.vars
+++ b/vars/cmake.vars
@@ -3,11 +3,11 @@
 #
 
 pkg_cmake_configure() {
-	cp -p ../cmake-${PKG_VERSION}/Modules/Platform/BSDOS.cmake \
+	build_fileop cp ../cmake-${PKG_VERSION}/Modules/Platform/BSDOS.cmake \
 		../cmake-${PKG_VERSION}/Modules/Platform/Midipix.cmake;
-	secure_rm ../cmake-${PKG_VERSION}-host;
-	insecure_mkdir ../cmake-${PKG_VERSION}-host;
-	cd ../cmake-${PKG_VERSION}-host;
+	build_fileop rm ../cmake-${PKG_VERSION}-host;
+	build_fileop mkdir ../cmake-${PKG_VERSION}-host;
+	build_fileop cd ../cmake-${PKG_VERSION}-host;
 	log_msg info "Bootstrapping cmake...";
 	(unset AR CC CXX RANLIB;
 	 ../cmake-${PKG_VERSION}/configure ${PKG_CONFIGURE_ARGS};
@@ -17,9 +17,9 @@ pkg_cmake_configure() {
 };
 
 pkg_cmake_build() {
-	secure_rm ../cmake-${PKG_VERSION}-native-${PKG_TARGET};
-	insecure_mkdir ../cmake-${PKG_VERSION}-native-${PKG_TARGET};
-	cd ${WORKDIR}/cmake-${PKG_VERSION}-native-${PKG_TARGET};
+	build_fileop rm ../cmake-${PKG_VERSION}-native-${PKG_TARGET};
+	build_fileop mkdir ../cmake-${PKG_VERSION}-native-${PKG_TARGET};
+	build_fileop cd ${WORKDIR}/cmake-${PKG_VERSION}-native-${PKG_TARGET};
 	rm -f config.cache;
 	log_msg info "Calling cmake...";
 	_pcb_prefix=${PREFIX};
diff --git a/vars/cparser.vars b/vars/cparser.vars
index 1977745b..ad4559a2 100644
--- a/vars/cparser.vars
+++ b/vars/cparser.vars
@@ -3,7 +3,7 @@
 #
 
 pkg_cparser_configure_pre() {
-	insecure_mkdir cparser+libfirm/sysroot cparser+libfirm/build/cparser;
+	build_fileop mkdir cparser+libfirm/sysroot cparser+libfirm/build/cparser;
 	export CFLAGS_PATH="-I../../sysroot/include";
 	export LDFLAGS_PATH="-L../../sysroot/lib";
 };
diff --git a/vars/gcc.vars b/vars/gcc.vars
index 217c2b25..9d5f82b9 100644
--- a/vars/gcc.vars
+++ b/vars/gcc.vars
@@ -38,9 +38,9 @@ pkgp_gcc_setup_env() {
 };
 
 pkgp_gcc_configure() {
-	secure_rm ${PKG_BUILD_DIR};
-	insecure_mkdir ${PKG_BUILD_DIR};
-	secure_cd ${PKG_BUILD_DIR};
+	build_fileop rm ${PKG_BUILD_DIR};
+	build_fileop mkdir ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	../cbb-gcc-${PKG_GCC_VERSION}/configure "${@}"	\
 		--disable-bootstrap			\
 		--disable-libmudflap			\
@@ -96,9 +96,9 @@ pkg_gcc_stage1_all() {
 	fi;
 	pkgp_gcc_setup_env ${PKG_GCC_VERSION};
 	if ! is_build_script_done configure; then
-		insecure_mkdir ${PKG_PREFIX}/include;
+		build_fileop mkdir ${PKG_PREFIX}/include;
 		[ \! -d ${PKG_PREFIX}/usr ] &&			\
-			ln -s -- . ${PKG_PREFIX}/usr;
+			build_fileop ln_symbolic . ${PKG_PREFIX}/usr;
 		case ${PKG_NAME} in
 		gcc_stage1)
 			pkgp_gcc_configure				\
@@ -126,7 +126,7 @@ pkg_gcc_stage1_all() {
 				--without-headers; ;;
 		esac;
 	else
-		cd ${PKG_BUILD_DIR};
+		build_fileop cd ${PKG_BUILD_DIR};
 	fi;
 	if ! is_build_script_done clean; then
 		make ${MAKEFLAGS} clean;
@@ -147,8 +147,8 @@ pkg_gcc_stage1_all() {
 		esac;
 		__="$(uname -s)";
 		if [ "${__#*CYGWIN*}" != "${__}" ]; then
-			ln -s -- ${PREFIX}/libexec/gcc/${PKG_TARGET}/${PKG_GCC_VERSION}/liblto_plugin.dll.a	\
-				ln -s -- ${PREFIX}/libexec/gcc/${PKG_TARGET}/${PKG_GCC_VERSION}/liblto_plugin.so;
+			build_fileop ln_symbolic ${PREFIX}/libexec/gcc/${PKG_TARGET}/${PKG_GCC_VERSION}/liblto_plugin.dll.a	\
+				build_fileop ln_symbolic ${PREFIX}/libexec/gcc/${PKG_TARGET}/${PKG_GCC_VERSION}/liblto_plugin.so;
 		fi;
 		set_build_script_done install finish;
 	fi;
@@ -157,7 +157,7 @@ pkg_gcc_stage1_all() {
 pkg_gcc_runtime_all() {
 	export MAKE="make LIBTOOL=slibtool";
 	set_build_dir cbb-gcc-${PKG_GCC_RUNTIME_VERSION} cross;
-	cd ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	# GCC, compiler runtime.
 	if ! is_build_script_done build; then
 		make ${MAKEFLAGS} all-target-libgcc;
@@ -172,7 +172,7 @@ pkg_gcc_runtime_all() {
 pkg_gcc_libstdcpp_v3_all() {
 	export MAKE="make LIBTOOL=slibtool";
 	set_build_dir cbb-gcc-${PKG_GCC_LIBSTDCPP_V3_VERSION} cross;
-	cd ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	# GCC, libstdc++-v3.
 	if ! is_build_script_done build; then
 		make ${MAKEFLAGS} all-target-libstdc++-v3;
@@ -187,7 +187,7 @@ pkg_gcc_libstdcpp_v3_all() {
 pkg_gcc_full_all() {
 	export MAKE="make LIBTOOL=slibtool";
 	set_build_dir cbb-gcc-${PKG_GCC_FULL_VERSION} cross;
-	cd ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	# GCC, everything else.
 	if ! is_build_script_done build; then
 		make ${MAKEFLAGS};
@@ -206,9 +206,9 @@ pkg_gcc_native_all() {
 	set_build_dir cbb-gcc-${PKG_GCC_VERSION} native;
 	pkgp_gcc_setup_env ${PKG_GCC_VERSION};
 	if ! is_build_script_done configure; then
-		insecure_mkdir ${PKG_PREFIX}/${PKG_TARGET};
+		build_fileop mkdir ${PKG_PREFIX}/${PKG_TARGET};
 		if [ \! -d ${PKG_PREFIX}/${PKG_TARGET}/usr ]; then
-			ln -s -- . ${PKG_PREFIX}/${PKG_TARGET}/usr;
+			build_fileop ln_symbolic . ${PKG_PREFIX}/${PKG_TARGET}/usr;
 		fi;
 		if [ "${ARCH}" = nt32 ]; then
 			_pgna_host="i686-nt32-midipix";
@@ -225,7 +225,7 @@ pkg_gcc_native_all() {
 			--with-mpfr=${PKG_PREFIX}		\
 			--with-sysroot=;
 	else
-		cd ${PKG_BUILD_DIR};
+		build_fileop cd ${PKG_BUILD_DIR};
 	fi;
 	if ! is_build_script_done clean; then
 		make ${MAKEFLAGS} clean;
diff --git a/vars/libfirm.vars b/vars/libfirm.vars
index 1d579108..b41a53d2 100644
--- a/vars/libfirm.vars
+++ b/vars/libfirm.vars
@@ -3,7 +3,7 @@
 #
 
 pkg_libfirm_configure_pre() {
-	insecure_mkdir cparser+libfirm/sysroot cparser+libfirm/build/libfirm;
+	build_fileop mkdir cparser+libfirm/sysroot cparser+libfirm/build/libfirm;
 };
 
 # vim:filetype=sh
diff --git a/vars/llvm_host.vars b/vars/llvm_host.vars
index 57b581fa..87341150 100644
--- a/vars/llvm_host.vars
+++ b/vars/llvm_host.vars
@@ -3,9 +3,9 @@
 #
 
 pkg_llvm_host_configure() {
-	secure_rm ../llvm-${PKG_VERSION}-host;
-	insecure_mkdir ../llvm-${PKG_VERSION}-host;
-	cd ../llvm-${PKG_VERSION}-host;
+	build_fileop rm ../llvm-${PKG_VERSION}-host;
+	build_fileop mkdir ../llvm-${PKG_VERSION}-host;
+	build_fileop cd ../llvm-${PKG_VERSION}-host;
 	log_msg info "Bootstrapping llvm_host...";
 	(${PREFIX}/bin/cmake ../llvm-${PKG_VERSION}.src			\
 		-DCMAKE_BUILD_TYPE=Release				\
diff --git a/vars/musl.vars b/vars/musl.vars
index 8d0e53bc..ed7444f4 100644
--- a/vars/musl.vars
+++ b/vars/musl.vars
@@ -4,9 +4,9 @@
 #
 
 pkgp_musl_configure() {
-	secure_rm ${PKG_BUILD_DIR};
-	insecure_mkdir ${PKG_BUILD_DIR};
-	secure_cd ${PKG_BUILD_DIR};
+	build_fileop rm ${PKG_BUILD_DIR};
+	build_fileop mkdir ${PKG_BUILD_DIR};
+	build_fileop cd ${PKG_BUILD_DIR};
 	env	lz_cflags_cmdline=""		\
 		lz_debug="yes"			\
 	../lazy/lazy				\
@@ -30,21 +30,21 @@ pkg_musl_no_complex_all() {
 	if ! is_build_script_done fetch; then
 		pkg_fetch http://www.musl-libc.org/releases/musl-${PKG_MUSL_VERSION}.tar.gz	\
 			${PKG_MUSL_NO_COMPLEX_SHA256SUM};
-		secure_rm mmglue;
+		build_fileop rm mmglue;
 		pkg_fetch -git "mmglue=${GITROOT}/mmglue";
 		set_build_script_done fetch -extract;
 	fi;
 	if ! is_build_script_done extract; then
-		secure_rm musl-${PKG_MUSL_VERSION};
+		build_fileop rm musl-${PKG_MUSL_VERSION};
 		tar -xf ${DLCACHEDIR}/musl-${PKG_MUSL_VERSION}.tar.gz;
-		set +o noglob; cp -R -- mmglue/* musl-${PKG_MUSL_VERSION}/; set -o noglob;
+		set +o noglob; build_fileop cp mmglue/* musl-${PKG_MUSL_VERSION}/; set -o noglob;
 		set_build_script_done extract -configure;
 	fi;
 	if ! is_build_script_done configure; then
 		pkgp_musl_configure;
 		set_build_script_done configure clean -build;
 	else
-		cd ${PKG_BUILD_DIR};
+		build_fileop cd ${PKG_BUILD_DIR};
 	fi;
 	if ! is_build_script_done clean; then
 		make ${MAKEFLAGS} clean;
@@ -69,7 +69,7 @@ pkg_musl_native_all() {
 		pkgp_musl_configure;
 		set_build_script_done configure clean -build;
 	else
-		cd ${PKG_BUILD_DIR};
+		build_fileop cd ${PKG_BUILD_DIR};
 	fi;
 	if ! is_build_script_done clean; then
 		make ${MAKEFLAGS} clean;
@@ -78,7 +78,7 @@ pkg_musl_native_all() {
 	if ! is_build_script_done build; then
 		./lazy	-e ${_install}			\
 			-x build;
-		ln -sf -- ../lib/libc.so ${PKG_PREFIX}/bin/ldd;
+		build_fileop ln_symbolic ../lib/libc.so ${PKG_PREFIX}/bin/ldd;
 		set_build_script_done build finish;
 	fi;
 };
@@ -95,7 +95,7 @@ pkg_musl_full_all() {
 		pkgp_musl_configure;
 		set_build_script_done configure clean -build;
 	else
-		cd ${PKG_BUILD_DIR};
+		build_fileop cd ${PKG_BUILD_DIR};
 	fi;
 	if ! is_build_script_done clean; then
 		make ${MAKEFLAGS} clean;
diff --git a/vars/ncursesw.vars b/vars/ncursesw.vars
index 50024dec..03118da0 100644
--- a/vars/ncursesw.vars
+++ b/vars/ncursesw.vars
@@ -9,8 +9,7 @@ pkg_ncursesw_install_post() {
 			lib/libformw* lib/libmenuw* lib/libncursesw* lib/libpanelw*		\
 			share/man share/tabset share/terminfo; do
 		set +o noglob;
-		echo cp -pr ${PKG_PREFIX}/${__} ${PREFIX_MINIPIX}/${__%%/*};
-		cp -pr ${PKG_PREFIX}/${__} ${PREFIX_MINIPIX}/${__%%/*};
+		build_fileop cp ${PKG_PREFIX}/${__} ${PREFIX_MINIPIX}/${__%%/*};
 		set -o noglob;
 	done;
 };
diff --git a/vars/nginx.vars b/vars/nginx.vars
index e9db7982..154c73b4 100644
--- a/vars/nginx.vars
+++ b/vars/nginx.vars
@@ -5,7 +5,7 @@
 pkg_nginx_configure() {
 	export CFLAGS="${PKG_CFLAGS_CONFIGURE} -I${PKG_PREFIX}/include -pipe -W -Wall -Wpointer-arith -Wno-unused-parameter -Werror";
 	export LDFLAGS="${PKG_LDFLAGS_CONFIGURE} -L${PKG_PREFIX}/lib";
-	insecure_mkdir objs/src objs/src/core objs/src/event objs/src/event/modules objs/src/http objs/src/http/modules objs/src/os/unix;
+	build_fileop mkdir objs/src objs/src/core objs/src/event objs/src/event/modules objs/src/http objs/src/http/modules objs/src/os/unix;
 	set_build_script_done configure clean -build;
 };
 
diff --git a/vars/perl.vars b/vars/perl.vars
index 28f9d9bd..3d021fa0 100644
--- a/vars/perl.vars
+++ b/vars/perl.vars
@@ -12,7 +12,7 @@ pkg_perl_extract_post() {
 		if [ ! -d "$(dirname ${_ppep_fname_dst})" ]; then
 			mkdir -p -- $(dirname ${_ppep_fname_dst});
 		fi;
-		cp -- ${_ppep_fname_src} ${_ppep_fname_dst};
+		build_fileop cp ${_ppep_fname_src} ${_ppep_fname_dst};
 	done;
 	for _ppep_cflag in ${PKG_CFLAGS_CONFIGURE}; do
 		PKG_CONFIGURE_ARGS="${PKG_CONFIGURE_ARGS:+${PKG_CONFIGURE_ARGS} }-A ccflags=${_ppep_cflag}";
diff --git a/vars/pkgconf_host.vars b/vars/pkgconf_host.vars
index 61d467a2..3435a2c0 100644
--- a/vars/pkgconf_host.vars
+++ b/vars/pkgconf_host.vars
@@ -4,7 +4,7 @@
 
 pkg_pkgconf_host_install_post() {
 	if [ -e ${PREFIX}/bin/${TARGET}-pkg-config ]; then
-		secure_rm ${PREFIX}/bin/${TARGET}-pkg-config;
+		build_fileop rm ${PREFIX}/bin/${TARGET}-pkg-config;
 	fi;
 	cat > ${PREFIX}/bin/${TARGET}-pkg-config <<EOF
 #!/bin/sh
diff --git a/vars/psxstub.vars b/vars/psxstub.vars
index 2dad9c4e..a476bd15 100644
--- a/vars/psxstub.vars
+++ b/vars/psxstub.vars
@@ -7,10 +7,10 @@ pkg_psxstub_all() {
 	if ! is_build_script_done install; then
 		if [ "${TARGET}" = i686-nt32-midipix ]	\
 		|| [ "${TARGET}" = x86_64-nt64-midipix ]; then
-			cd psxstub;
+			build_fileop cd psxstub;
 			make ${MAKEFLAGS} DESTDIR=${PKG_PREFIX} TARGET=${TARGET} install;
 			if [ -e ${PKG_PREFIX}/lib/libpsxscl.a ]; then
-				secure_rm ${PKG_PREFIX}/lib/libpsxscl.a;
+				build_fileop rm ${PKG_PREFIX}/lib/libpsxscl.a;
 			fi;
 			set_build_script_done install finish;
 		fi;