also makes it possibly to upgrade package without adding it to
top-level deps. fixes #69.

this way we never change cwd, and relative filenames are always
parsed consistently. this also helps filename construction in many
places. this patch also changes '--root' to override location of
all configuration to be in the new root. previously it depended
on the file which one was used.

apparently the double colon rule dependencies affect only the
specific rule-set.

an utility to check package signature and integrity.

use pkgconfig of zlib instead of hard requiring it. and link in
the pkg-config libs with --as-needed as not all of the openssl
libs are really required.

instead of having static md5 implemenation, use the openssl
library for digest functions.

Administrative tool to download or delete files to/from the cache.

Currently just goes through all world dependencies and updates them
where possible (ref #51).

Cache non-local index files always locally.
Introduce 'update' applet to force refresh of cached index files.
Fixes #19.