diff --git a/packages/cmake/tangram.ts b/packages/cmake/tangram.ts
index 8057d645..8c615ed3 100644
--- a/packages/cmake/tangram.ts
+++ b/packages/cmake/tangram.ts
@@ -13,13 +13,13 @@ export const metadata = {
 	license: "BSD-3-Clause",
 	name: "cmake",
 	repository: "https://gitlab.kitware.com/cmake/cmake",
-	version: "3.31.1",
+	version: "3.31.2",
 };
 
 export const source = tg.target(() => {
 	const { version } = metadata;
 	const checksum =
-		"sha256:c4fc2a9bd0cd5f899ccb2fb81ec422e175090bc0de5d90e906dd453b53065719";
+		"sha256:42abb3f48f37dbd739cdfeb19d3712db0c5935ed5c2aef6c340f9ae9114238a2";
 	const owner = "Kitware";
 	const repo = "CMake";
 	const tag = `v${version}`;
diff --git a/packages/std/bootstrap/sdk.tg.ts b/packages/std/bootstrap/sdk.tg.ts
index 15a43dc6..74db8fa8 100644
--- a/packages/std/bootstrap/sdk.tg.ts
+++ b/packages/std/bootstrap/sdk.tg.ts
@@ -22,7 +22,7 @@ export namespace sdk {
 		if (os === "darwin") {
 			toolchain = await tg.directory(toolchain, {
 				["bin/gcc"]: tg.symlink("clang"),
-				["bin/g++"]: tg.symlink("clang++")
+				["bin/g++"]: tg.symlink("clang++"),
 			});
 		}
 		const bootstrapHost = await bootstrap.toolchainTriple(host);
diff --git a/packages/std/env.tg.ts b/packages/std/env.tg.ts
index 229b3111..9df01155 100644
--- a/packages/std/env.tg.ts
+++ b/packages/std/env.tg.ts
@@ -316,10 +316,22 @@ export namespace env {
 					(artifact instanceof tg.File || artifact instanceof tg.Symlink)
 				) {
 					if (artifact instanceof tg.Symlink) {
-						artifact = await tg.symlink({
-							artifact: dir,
-							subpath: artifact.subpath(),
-						});
+						const symlinkArtifact = await artifact.artifact();
+						if (symlinkArtifact === undefined) {
+							// If this symlink points above the current directory, we don't have the context to resolve. No match.
+							const symlinkTarget = await artifact.target();
+							if (
+								symlinkTarget === undefined ||
+								symlinkTarget.startsWith("..")
+							) {
+								continue;
+							}
+							// Otherwise, construct a new symlink using this directory as the artifact.
+							artifact = await tg.symlink({
+								artifact: dir,
+								subpath: symlinkTarget,
+							});
+						}
 					}
 					yield [name, artifact];
 				}
diff --git a/packages/std/sdk/cmake.tg.ts b/packages/std/sdk/cmake.tg.ts
index 6a876e5e..d89413b6 100644
--- a/packages/std/sdk/cmake.tg.ts
+++ b/packages/std/sdk/cmake.tg.ts
@@ -7,13 +7,13 @@ export const metadata = {
 	license: "BSD-3-Clause",
 	name: "cmake",
 	repository: "https://gitlab.kitware.com/cmake/cmake",
-	version: "3.31.1",
+	version: "3.31.2",
 };
 
 export const source = tg.target(() => {
 	const { version } = metadata;
 	const checksum =
-		"sha256:c4fc2a9bd0cd5f899ccb2fb81ec422e175090bc0de5d90e906dd453b53065719";
+		"sha256:42abb3f48f37dbd739cdfeb19d3712db0c5935ed5c2aef6c340f9ae9114238a2";
 	const owner = "Kitware";
 	const repo = "CMake";
 	const tag = `v${version}`;
diff --git a/packages/std/sdk/kernel_headers.tg.ts b/packages/std/sdk/kernel_headers.tg.ts
index 82bb7eb6..b64383d9 100644
--- a/packages/std/sdk/kernel_headers.tg.ts
+++ b/packages/std/sdk/kernel_headers.tg.ts
@@ -6,13 +6,13 @@ export const metadata = {
 	license: "GPLv2",
 	name: "linux",
 	repository: "https://git.kernel.org",
-	version: "6.12.1",
+	version: "6.12.2",
 };
 
 export const source = tg.target(async () => {
 	const { name, version } = metadata;
 	const checksum =
-		"sha256:0193b1d86dd372ec891bae799f6da20deef16fc199f30080a4ea9de8cef0c619";
+		"sha256:bb1e0710c73e877b1f3005be7301734903636be8ef1700d3b12106e8f3403d8b";
 	const extension = ".tar.xz";
 	const majorVersion = version.split(".")[0];
 	const base = `https://cdn.kernel.org/pub/linux/kernel/v${majorVersion}.x`;
diff --git a/packages/std/sdk/llvm.tg.ts b/packages/std/sdk/llvm.tg.ts
index d993e945..48217592 100644
--- a/packages/std/sdk/llvm.tg.ts
+++ b/packages/std/sdk/llvm.tg.ts
@@ -24,13 +24,13 @@ export const metadata = {
 	license:
 		"https://github.com/llvm/llvm-project/blob/991cfd1379f7d5184a3f6306ac10cabec742bbd2/LICENSE.TXT",
 	repository: "https://github.com/llvm/llvm-project/",
-	version: "19.1.4",
+	version: "19.1.5",
 };
 
 export const source = tg.target(async () => {
 	const { name, version } = metadata;
 	const checksum =
-		"sha256:3aa2d2d2c7553164ad5c6f3b932b31816e422635e18620c9349a7da95b98d811";
+		"sha256:bd8445f554aae33d50d3212a15e993a667c0ad1b694ac1977f3463db3338e542";
 	const owner = name;
 	const repo = "llvm-project";
 	const tag = `llvmorg-${version}`;
diff --git a/packages/std/sdk/llvm/ncurses.tg.ts b/packages/std/sdk/llvm/ncurses.tg.ts
index 694413a5..88861459 100644
--- a/packages/std/sdk/llvm/ncurses.tg.ts
+++ b/packages/std/sdk/llvm/ncurses.tg.ts
@@ -19,7 +19,7 @@ type Arg = {
 	build?: string;
 	env?: std.env.Arg;
 	host?: string;
-	sdk?: std.sdk.Arg;
+	sdk?: std.sdk.Arg | boolean;
 	source?: tg.Directory;
 };
 
diff --git a/packages/std/utils.tg.ts b/packages/std/utils.tg.ts
index dbed7fc3..d9d5ced5 100644
--- a/packages/std/utils.tg.ts
+++ b/packages/std/utils.tg.ts
@@ -40,38 +40,34 @@ export type Arg = {
 
 /** A basic set of GNU system utilites. */
 export const env = tg.target(async (arg?: Arg) => {
-	const { env: env_, host: host_, ...rest } = arg ?? {};
+	const { build, env: env_, host: host_, sdk } = arg ?? {};
 	const host = host_ ?? (await std.triple.host());
 
-	// Build bash and use it as the default shell.
-	const bashArtifact = await bash.build({
-		...rest,
-		env: env_,
-		host,
-	});
-
-	const bashExecutable = tg.File.expect(await bashArtifact.get("bin/bash"));
-	const bashEnv = {
-		CONFIG_SHELL: bashExecutable,
-		SHELL: bashExecutable,
+	const shellArtifact = await bash.build({ build, env: env_, host, sdk });
+	const shellExecutable = await shellArtifact
+		.get(`bin/bash`)
+		.then(tg.File.expect);
+	const shellEnv = {
+		CONFIG_SHELL: shellExecutable,
+		SHELL: shellExecutable,
 	};
-	const env = await std.env.arg(env_, bashEnv);
+	const env = await std.env.arg(env_, shellEnv);
 
-	let utils = [bashArtifact, bashEnv];
+	let utils = [shellArtifact, shellEnv];
 	utils = utils.concat(
 		await Promise.all([
-			bzip2({ ...rest, env, host }),
-			coreutils({ ...rest, env, host }),
-			diffutils({ ...rest, env, host }),
-			findutils({ ...rest, env, host }),
-			gawk({ ...rest, env, host }),
-			grep({ ...rest, env, host }),
-			gzip({ ...rest, env, host }),
-			make({ ...rest, env, host }),
-			patch({ ...rest, env, host }),
-			sed({ ...rest, env, host }),
-			tar({ ...rest, env, host }),
-			xz({ ...rest, env, host }),
+			bzip2({ build, env, host, sdk }),
+			coreutils({ build, env, host, sdk }),
+			diffutils({ build, env, host, sdk }),
+			findutils({ build, env, host, sdk }),
+			gawk({ build, env, host, sdk }),
+			grep({ build, env, host, sdk }),
+			gzip({ build, env, host, sdk }),
+			make({ build, env, host, sdk }),
+			patch({ build, env, host, sdk }),
+			sed({ build, env, host, sdk }),
+			tar({ build, env, host, sdk }),
+			xz({ build, env, host, sdk }),
 		]),
 	);
 	return await std.env.arg(utils);
@@ -148,7 +144,7 @@ export const changeShebang = async (scriptFile: tg.File) => {
 
 export const assertProvides = async (env: std.env.Arg) => {
 	const names = [
-		"bash",
+		"bash", // bash for linux, zsh for macOS
 		"bzip2",
 		"ls", // coreutils
 		"diff", // diffutils
diff --git a/packages/std/utils/patch.tg.ts b/packages/std/utils/patch.tg.ts
index c86c4561..167bed44 100644
--- a/packages/std/utils/patch.tg.ts
+++ b/packages/std/utils/patch.tg.ts
@@ -6,7 +6,6 @@ import libiconv from "./libiconv.tg.ts";
 import coreutils from "./coreutils.tg.ts";
 import diffutils from "./diffutils.tg.ts";
 import rlimitFix from "./patch-rlimit-fix.patch" with { type: "file" };
-import macOsPatchCmds from "./patch_cmds.tg.ts";
 
 export const metadata = {
 	name: "patch",
@@ -48,10 +47,6 @@ export const build = tg.target(async (arg?: Arg) => {
 	const host = host_ ?? (await std.triple.host());
 	const build = build_ ?? host;
 
-	if (std.triple.os(host) === "darwin") {
-		return macOsPatchCmds(arg);
-	}
-
 	const configure = {
 		args: ["--disable-dependency-tracking"],
 	};
diff --git a/packages/std/utils/patch_cmds.tg.ts b/packages/std/utils/patch_cmds.tg.ts
deleted file mode 100644
index 5066a778..00000000
--- a/packages/std/utils/patch_cmds.tg.ts
+++ /dev/null
@@ -1,80 +0,0 @@
-import * as bootstrap from "../bootstrap.tg.ts";
-import * as std from "../tangram.ts";
-
-export const metadata = {
-	name: "patch_cmds",
-	version: "66",
-};
-
-export const source = tg.target(async () => {
-	const { name, version } = metadata;
-	const checksum =
-		"sha256:ce39ccafd2690e1f7cf825d20043a42614814e6f7bc9f7638fbbec328a0f282d";
-	const owner = "apple-oss-distributions";
-	const repo = name;
-	const tag = std.download.packageName({ name, version });
-	return std.download.fromGithub({
-		checksum,
-		source: "tag",
-		owner,
-		repo,
-		tag,
-	});
-});
-
-export type Arg = {
-	build?: string | undefined;
-	env?: std.env.Arg;
-	host?: string | undefined;
-	sdk?: std.sdk.Arg | boolean;
-	source?: tg.Directory;
-};
-
-/** Produce an `patch` executable that preserves xattrs on macOS. */
-export const macOsPatchCmds = tg.target(async (arg?: Arg) => {
-	const build = arg?.build ?? (await std.triple.host());
-	const os = std.triple.os(build);
-
-	// Assert that the system is macOS.
-	if (os !== "darwin") {
-		throw new Error(`patchCmds is only supported on macOS, detected ${os}.`);
-	}
-
-	const sourceDir = await source();
-
-	const script = tg`
-		set -eux
-		cp -R ${sourceDir}/patch/* .
-		CC="cc"
-		CFLAGS="-Wall -Oz"
-		SOURCES="backupfile.c inp.c mkpath.c pch.c util.c patch.c vcs.c"
-		OBJS=$(echo "$SOURCES" | sed 's/\.c$/\.o/')
-		for src in $SOURCES; do
-			obj=$(echo "$src" | sed 's/\.c$/\.o/')
-			$CC $CFLAGS -c "$src" -o "$obj"
-			if [ $? -ne 0 ]; then
-				echo "Error compiling $src"
-				exit 1
-			fi
-		done
-		mkdir -p $OUTPUT/bin
-		$CC $CFLAGS $OBJS -o $OUTPUT/bin/patch
-		if [ $? -ne 0 ]; then
-			echo "Linking failed"
-			exit 1
-		fi
-		rm -f $OBJS
-	`;
-
-	const result = await tg
-		.target(script, {
-			host: std.triple.archAndOs(build),
-			env: std.env.arg(arg?.env ?? {}, bootstrap.sdk.env()),
-		})
-		.then((target) => target.output())
-		.then(tg.Directory.expect);
-
-	return result;
-});
-
-export default macOsPatchCmds;
diff --git a/packages/zsh/tangram.ts b/packages/zsh/tangram.ts
index e192a68b..eb111d5a 100644
--- a/packages/zsh/tangram.ts
+++ b/packages/zsh/tangram.ts
@@ -10,7 +10,7 @@ export const metadata = {
 	version: "5.9",
 };
 
-export const source = tg.target(async (arg?: Arg) => {
+export const source = tg.target(async () => {
 	const { name, version } = metadata;
 	const url = `https://sourceforge.net/projects/zsh/files/zsh/5.9/${name}-${version}.tar.xz/download`;
 	const checksum =