This largely makes the stdlib conform to strict provenance on Ubuntu. Some hairier things have been left alone for now.