tweak cleanup and package installation. Add cacert roots