diff --git a/.gitlab-ci.yml b/.gitlab-ci.yml
index 413ca6ae..8a699b1b 100644
--- a/.gitlab-ci.yml
+++ b/.gitlab-ci.yml
@@ -1,15 +1,27 @@
 # The GitLab Continuous Integration configuration
-image: "ubuntu:24.04"
 
 variables:
   GIT_STRATEGY: "clone"
-  GIT_SUBMODULE_STRATEGY: "recursive"
 
 stages:
+  - lint
   - test
-  - retag
+
+fmt:
+  stage: lint
+  script:
+    - rustup component add rustfmt
+    - cargo fmt -- --check
+
+cargo-test:
+  stage: lint
+  script:
+    # TODO: we should omit fuse from cargo install chains
+    - apt update && apt install -y fuse3 libfuse3-dev
+    - cargo test --locked
 
 img:
+  image: "ubuntu:24.04"
   stage: test
   rules:
     - if: '$CI_COMMIT_BRANCH == "master" && $CI_PROJECT_NAMESPACE == "redox-os"'
@@ -35,16 +47,14 @@ img:
           help2man \
           autoconf \
           automake \
-          zstd &&
-      curl https://sh.rustup.rs -sSf | sh -s -- -y --default-toolchain none
+          zstd
   script:
     - |
-      source "$HOME/.cargo/env" &&
+      export PATH="$HOME/.cargo/bin:$PATH" &&
       bash podman/rustinstall.sh &&
-      cargo build --manifest-path installer/Cargo.toml --release &&
-      PODMAN_BUILD=0 REPO_BINARY=1 make ci-img IMG_TAG=$CI_COMMIT_REF_NAME &&
+      PODMAN_BUILD=0 REPO_BINARY=1 COOKBOOK_VERBOSE=false make ci-img IMG_TAG=$CI_COMMIT_REF_NAME &&
       ([ $CI_MERGE_REQUEST_TARGET_BRANCH_NAME == "master" ] && rm -rf build/img/* || true)
   artifacts:
     paths:
       - build/img/
-    expire_in: 1 week
\ No newline at end of file
+    expire_in: 1 week
diff --git a/Makefile b/Makefile
index 1254c879..982a3a59 100644
--- a/Makefile
+++ b/Makefile
@@ -69,8 +69,6 @@ endif # PODMAN_BUILD
 
 pull:
 	git pull
-	git submodule sync --recursive
-	git submodule update --recursive --init
 
 repo: $(BUILD)/repo.tag
 
diff --git a/mk/prefix.mk b/mk/prefix.mk
index 48ebc223..4fa0e871 100644
--- a/mk/prefix.mk
+++ b/mk/prefix.mk
@@ -162,6 +162,7 @@ endif
 else
 
 $(ROOT)/rust/configure:
+	git submodule sync --recursive
 	git submodule update --progress --init --recursive --checkout rust
 
 PREFIX_FREESTANDING_INSTALL=$(PREFIX)/gcc-freestanding-install
diff --git a/native_bootstrap.sh b/native_bootstrap.sh
index ac40762a..3c89dc87 100755
--- a/native_bootstrap.sh
+++ b/native_bootstrap.sh
@@ -1014,7 +1014,7 @@ statusCheck()
 boot()
 {
     echo "Cloning gitlab repo..."
-    git clone https://gitlab.redox-os.org/redox-os/redox.git --origin upstream --recursive
+    git clone https://gitlab.redox-os.org/redox-os/redox.git --origin upstream
     echo "Creating .config with PODMAN_BUILD=0"
     echo 'PODMAN_BUILD?=0' > redox/.config
     echo "Cleaning up..."
@@ -1047,7 +1047,6 @@ if [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
     usage
 elif [ "$1" == "-u" ]; then
     git pull upstream master
-    git submodule update --recursive --init
     exit
 elif [ "$1" == "-s" ]; then
     statusCheck
@@ -1088,7 +1087,6 @@ fi
 
 if [ "$update" == "true" ]; then
     git pull upstream master
-    git submodule update --recursive --init
     exit
 fi
 
diff --git a/podman_bootstrap.sh b/podman_bootstrap.sh
index 55f34997..a13f9696 100755
--- a/podman_bootstrap.sh
+++ b/podman_bootstrap.sh
@@ -560,7 +560,7 @@ rustInstall()
 boot()
 {
     echo "Cloning gitlab repo..."
-    git clone https://gitlab.redox-os.org/redox-os/redox.git --origin upstream --recursive
+    git clone https://gitlab.redox-os.org/redox-os/redox.git --origin upstream
     echo "Creating .config with PODMAN_BUILD=1"
     echo 'PODMAN_BUILD?=1' > redox/.config
     if [[ "$(uname -m)" == "arm64" ]]; then
@@ -596,7 +596,6 @@ if [ "$1" == "-h" ] || [ "$1" == "--help" ]; then
     usage
 elif [ "$1" == "-u" ]; then
     git pull upstream master
-    git submodule update --recursive --init
     exit
 fi
 
@@ -622,7 +621,6 @@ rustInstall "$noninteractive"
 
 if [ "$update" == "true" ]; then
     git pull upstream master
-    git submodule update --recursive --init
     exit
 fi
 
diff --git a/recipes/wip/db/clickhouse/recipe.toml b/recipes/wip/db/clickhouse/recipe.toml
index 5c52357e..67eff9c3 100644
--- a/recipes/wip/db/clickhouse/recipe.toml
+++ b/recipes/wip/db/clickhouse/recipe.toml
@@ -1,12 +1,13 @@
 #TODO not compiled or tested
 # build instructions: https://clickhouse.com/docs/en/development/build#how-to-build-clickhouse-on-any-linux
-#TODO probably disable some submodules to use our recipes
 [source]
-tar = "https://github.com/ClickHouse/ClickHouse"
+git = "https://github.com/ClickHouse/ClickHouse"
+rev = "v25.10.2.65-stable"
+shallow_clone = true
 [build]
 template = "cmake"
 dependencies = [
     "curl",
-    "openssl1",
+    "openssl3",
     "xz",
 ]
diff --git a/recipes/wip/db/memcached/recipe.toml b/recipes/wip/db/memcached/recipe.toml
index 89f494be..5e6ebc37 100644
--- a/recipes/wip/db/memcached/recipe.toml
+++ b/recipes/wip/db/memcached/recipe.toml
@@ -1,5 +1,5 @@
-#TODO probably wrong template, see https://github.com/memcached/memcached/wiki/Install#from-source
-#TODO make libevent works
+#TODO not compiled or tested
+# build instructions: https://docs.memcached.org/serverguide/#from-source
 [source]
 tar = "https://www.memcached.org/files/memcached-1.6.22.tar.gz"
 [build]
diff --git a/recipes/wip/db/mysql-server/recipe.toml b/recipes/wip/db/mysql-server/recipe.toml
index 4c978500..c94fb444 100644
--- a/recipes/wip/db/mysql-server/recipe.toml
+++ b/recipes/wip/db/mysql-server/recipe.toml
@@ -3,13 +3,9 @@
 [source]
 tar = "https://dev.mysql.com/downloads/file/?id=523432"
 [build]
-template = "custom"
+template = "cmake"
 dependencies = [
     "boost",
     "ncurses",
-    "openssl1",
+    "openssl3",
 ]
-script = """
-export CPPFLAGS="-I${COOKBOOK_SYSROOT}/include/ncurses"
-cookbook_cmake
-"""
diff --git a/recipes/wip/db/mysql-shell/recipe.toml b/recipes/wip/db/mysql-shell/recipe.toml
index 03b5312f..596ca67d 100644
--- a/recipes/wip/db/mysql-shell/recipe.toml
+++ b/recipes/wip/db/mysql-shell/recipe.toml
@@ -1,4 +1,4 @@
-#TODO missing script for cross-compilation
+#TODO missing script
 [source]
 tar = "https://dev.mysql.com/downloads/file/?id=524161"
 [build]
diff --git a/recipes/wip/db/rocksdb/recipe.toml b/recipes/wip/db/rocksdb/recipe.toml
index 844a6494..94e5507e 100644
--- a/recipes/wip/db/rocksdb/recipe.toml
+++ b/recipes/wip/db/rocksdb/recipe.toml
@@ -1,7 +1,8 @@
-#TODO missing script for "make", see https://github.com/facebook/rocksdb/blob/main/INSTALL.md
+#TODO missing script for gnu make: https://github.com/facebook/rocksdb/blob/main/INSTALL.md
 [source]
 git = "https://github.com/facebook/rocksdb"
-rev = "49ce8a1064dd1ad89117899839bf136365e49e79"
+rev = "v10.7.5"
+shallow_clone = true
 [build]
 template = "custom"
 dependencies = [
diff --git a/recipes/wip/files/gnome-files/recipe.toml b/recipes/wip/files/gnome-files/recipe.toml
new file mode 100644
index 00000000..18199b87
--- /dev/null
+++ b/recipes/wip/files/gnome-files/recipe.toml
@@ -0,0 +1,19 @@
+#TODO not compiled or tested
+#TODO discover minimum dependencies from meson log
+[source]
+tar = "https://download.gnome.org/sources/nautilus/49/nautilus-49.1.tar.xz"
+[build]
+template = "meson"
+mesonflags = [
+    "-Dextensions=false",
+    "-Dintrospection=false",
+    "-Dpackagekit=false",
+    "-Dselinux=disabled",
+    "-Dcloudproviders=disabled",
+    "-Dtests=none",
+]
+#[package] # probably optional dependencies
+#dependencies = [
+#    "localsearch",
+#    "xdg-user-dirs-gtk",
+#]
diff --git a/recipes/wip/files/kde-dolphin/recipe.toml b/recipes/wip/files/kde-dolphin/recipe.toml
new file mode 100644
index 00000000..e562f033
--- /dev/null
+++ b/recipes/wip/files/kde-dolphin/recipe.toml
@@ -0,0 +1,8 @@
+#TODO not compiled or tested
+#TODO discover minimum dependencies from cmake log
+[source]
+git = "https://invent.kde.org/system/dolphin"
+branch = "release/25.08"
+shallow_clone = true
+[build]
+template = "cmake"
diff --git a/recipes/wip/libs/gtk/xdg-user-dirs-gtk/recipe.toml b/recipes/wip/libs/gtk/xdg-user-dirs-gtk/recipe.toml
new file mode 100644
index 00000000..53fbbc03
--- /dev/null
+++ b/recipes/wip/libs/gtk/xdg-user-dirs-gtk/recipe.toml
@@ -0,0 +1,5 @@
+#TODO not compiled or tested
+[source]
+tar = "https://download.gnome.org/sources/xdg-user-dirs-gtk/0.14/xdg-user-dirs-gtk-0.14.tar.xz"
+[build]
+template = "meson"
diff --git a/recipes/wip/math/gnome-calculator/recipe.toml b/recipes/wip/math/gnome-calculator/recipe.toml
index 333ffd55..2b0c3433 100644
--- a/recipes/wip/math/gnome-calculator/recipe.toml
+++ b/recipes/wip/math/gnome-calculator/recipe.toml
@@ -1,6 +1,5 @@
 #TODO not compiled or tested
-# lacking build instructions
-# build options: https://gitlab.gnome.org/GNOME/gnome-calculator/-/blob/main/meson_options.txt?ref_type=heads
+#TODO determine minimum dependencies from meson log
 [source]
 tar = "https://download.gnome.org/sources/gnome-calculator/49/gnome-calculator-49.1.1.tar.xz"
 [build]
diff --git a/recipes/wip/net/http/apache-httpd/recipe.toml b/recipes/wip/net/http/apache-httpd/recipe.toml
index b882a489..f75c1f02 100644
--- a/recipes/wip/net/http/apache-httpd/recipe.toml
+++ b/recipes/wip/net/http/apache-httpd/recipe.toml
@@ -1,6 +1,6 @@
 #TODO compiles but requires setgroups syscall at startup
 [source]
-tar="https://dlcdn.apache.org/httpd/httpd-2.4.61.tar.bz2"
+tar= "https://dlcdn.apache.org/httpd/httpd-2.4.61.tar.bz2"
 patches = [
     "redox.patch",
 ]
diff --git a/recipes/wip/net/ssh/dropbear/recipe.toml b/recipes/wip/net/ssh/dropbear/recipe.toml
index 487c164c..fdffc6bd 100644
--- a/recipes/wip/net/ssh/dropbear/recipe.toml
+++ b/recipes/wip/net/ssh/dropbear/recipe.toml
@@ -1,23 +1,19 @@
+#TODO test dynamic linking
 [source]
 git = "https://gitlab.redox-os.org/tfinnegan937/dropbear.git"
 rev = "4c6828d39f988712cf4d2a64c7acf15d76f24aa9"
-
 [build]
-template = "custom"
+template = "configure"
+configureflags = [
+    "--disable-syslog",
+    "--disable-utmpx",
+    "--disable-utmp",
+    "--disable-lastlog",
+    "--disable-loginfunc",
+    "--disable-wtmp",
+    "--disable-wtmpx",
+]
 dependencies = [
     "openssl1",
     "zlib"
 ]
-script="""
-COOKBOOK_CONFIGURE_FLAGS+=(
-    --enable-static
-    --disable-syslog
-    --disable-utmpx
-    --disable-utmp
-    --disable-lastlog
-    --disable-loginfunc
-    --disable-wtmp
-    --disable-wtmpx
-)
-cookbook_configure
-"""
diff --git a/recipes/wip/search/localsearch/recipe.toml b/recipes/wip/search/localsearch/recipe.toml
new file mode 100644
index 00000000..6687bc50
--- /dev/null
+++ b/recipes/wip/search/localsearch/recipe.toml
@@ -0,0 +1,14 @@
+#TODO not compiled or tested
+#TODO discover minimum dependencies from meson log
+[source]
+tar = "https://download.gnome.org/sources/localsearch/3.10/localsearch-3.10.1.tar.xz"
+[build]
+template = "meson"
+mesonflags = [
+    "-Dfunctional_tests=false",
+    "-Dsandbox_tests=false",
+    "-Dseccomp=false",
+    "-Dbattery_detection=none",
+    "-Dsystemd_user_services=false",
+    "-Dman=false",
+]
diff --git a/recipes/wip/system/discover/recipe.toml b/recipes/wip/system/discover/recipe.toml
new file mode 100644
index 00000000..32828d4d
--- /dev/null
+++ b/recipes/wip/system/discover/recipe.toml
@@ -0,0 +1,8 @@
+#TODO not compiled or tested
+#TODO determine minimum dependencies from cmake log
+[source]
+git = "https://invent.kde.org/plasma/discover"
+branch = "Plasma/6.5"
+shallow_clone = true
+[build]
+template = "cmake"
diff --git a/src/cook/cook_build.rs b/src/cook/cook_build.rs
index fde4d068..2fb19b6b 100644
--- a/src/cook/cook_build.rs
+++ b/src/cook/cook_build.rs
@@ -411,7 +411,13 @@ fn build_auto_deps(
 }
 
 fn get_remote_url(name: &PackageName, ext: &str) -> String {
-    return format!("{}/{}/{}.{}", REMOTE_PKG_SOURCE, redoxer::target(), name, ext);
+    return format!(
+        "{}/{}/{}.{}",
+        REMOTE_PKG_SOURCE,
+        redoxer::target(),
+        name,
+        ext
+    );
 }
 fn get_pubkey_url() -> String {
     return format!("{}/id_ed25519.pub.toml", REMOTE_PKG_SOURCE);