@@ -23,7 +23,7 @@ jobs:
   ubuntu-20-04:
     # The type of runner that the job will run on
     runs-on: ubuntu-20.04
-    timeout-minutes: 20
+    timeout-minutes: 30
     # Steps represent a sequence of tasks that will be executed as part of the job
     steps:
     # Make sure there are no concurrent jobs
@@ -42,13 +42,6 @@ jobs:
           build-python-package
         key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}
 
-    # Do not run when the following strings are used in the commit message.
-    - name: Fail on skip ci
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-ci'
-
-    - name: Fail on skip gha
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-gha'
-
     - name: Prepare OS
       run: sudo apt-get install libncurses5-dev
 
@@ -72,7 +65,7 @@ jobs:
 
   macos-10-15:
     runs-on: macos-10.15
-    timeout-minutes: 30
+    timeout-minutes: 60
     steps:
     - uses: chevah/auto-cancel-redundant-job@v1
     - uses: actions/checkout@v2
@@ -86,24 +79,24 @@ jobs:
           build-python-package
         key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}
 
-    - name: Fail on skip ci
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-ci'
-
-    - name: Fail on skip gha
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-gha'
+    - name: Download needed deps for the detected OS
+      run: ./brink.sh detect_os
 
-    # Avoid linking to Homebrew's libintl. We can use needed tools from /usr/bin.
-    - name: Prepare OS
+    # Avoid linking to Homebrew's libintl during build.
+    # We can use needed tools from /usr/bin.
+    - name: Hack Homebrew
       run: |
-        sudo find /usr/local -iname 'libintl*' -exec rm -f {} +
+        sudo find /usr/local -name 'libintl*' -exec chmod a-r {} +
         sudo rm -f /usr/local/bin/{wget,curl,git}
 
-    - name: Download needed deps for the detected OS
-      run: ./brink.sh detect_os
-
     - name: Build Python
       run: ./chevah_build build
 
+    # Fix back Homebrew, to make everything functional.
+    - name: Unhack Homebrew
+      run: |
+        sudo find /usr/local -name 'libintl*' -exec chmod a+r {} +
+
     - name: Test Python
       run: ./chevah_build test
 
@@ -117,7 +110,7 @@ jobs:
 
   windows-2019:
     runs-on: windows-2019
-    timeout-minutes: 25
+    timeout-minutes: 30
     steps:
     - uses: chevah/auto-cancel-redundant-job@v1
     - uses: actions/checkout@v2
@@ -131,25 +124,20 @@ jobs:
           build-python-package
         key: ${{ runner.os }}-${{ hashFiles('pavement.py') }}
 
-    - name: Fail on skip ci
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-ci'
-
-    - name: Fail on skip gha
-      run: git log -1 --pretty=format:"%s" ${{ toJSON(github.sha) }} | grep -v 'skip-gha'
-
     # Add packages needed to build our patched pycrypto.
     - name: Prepare OS
       run: |
         chocolatey install -y make vcpython27
 
+    # Explicitly run our scripts with Bash, not PowerShell (GitHub's default).
     - name: Download needed deps for the detected OS
-      run: ./brink.sh detect_os
+      run: bash ./brink.sh detect_os
 
     - name: Build Python
-      run: ./chevah_build build
+      run: bash ./chevah_build build
 
     - name: Test Python
-      run: ./chevah_build test
+      run: bash ./chevah_build test
 
     - name: Test Compat
-      run: ./chevah_build test_compat
+      run: bash ./chevah_build test_compat
@@ -0,0 +1,24 @@
+#
+# Experimental Travis-CI
+# For now, the build matrix has a single member: linux-arm64
+#
+# Pinned on the oldest available distribution, to get a generic Linux build.
+
+language: c
+
+arch:
+  - arm64
+
+os:
+  - linux
+
+dist:
+  - xenial
+
+install: skip
+
+script:
+  - ./brink.sh detect_os
+  - ./chevah_build build
+  - ./chevah_build test
+  - ./chevah_build test_compat
@@ -12,33 +12,40 @@ please check https://binary.chevah.com/production/python/.
 
 Building steps as used by Buildbot:
 
-* Login to the desired platform.
-* Get code from GitHub.
-* ```./chevah_build build```
-* ```./chevah_build test```
-* Upload to binary dist publishing website.
+* Login to a system running on the desired platform (e.g. Ubuntu Server 20.04).
+* Get the code for this repository from GitHub.
+* ``./brink.sh detect_os``
+* ``./chevah_build build``
+* ``./chevah_build test``
+* ``./chevah_build test_compat``
 
-You can try the first 4 steps on your own to build and test a new
-Python package on your own.
+You can try the above steps on your own to build and test a new Python package.
 
-Use ```./chevah_build help``` to discover all available commands.
+To have new Python packages uploaded (typically for all supported platforms),
+you should try the following, after securing access to Chevah infrastructure:
+
+* ``./brink.sh test_remote group-all --properties=force_upload_production=yes
+
+Use ``./chevah_build help`` to discover all available commands.
 
 
 Patching upstream code
 ----------------------
 
 This repository contains a lot of imported code from upstream repos:
-Python, OpenSSL, LibreSSL, SQLite, gmp, libffi, PyCrypto, etc.
+Python, OpenSSL, SQLite, gmp, libffi, PyCrypto, etc.
 
 You can find those sources in two sub-directories:
-* ```src/```
-* ```python-modules/```
+
+* ``src/``
+* ``python-modules/``
 
 Local changes to upstream projects are kept separated from upstream code.
-For every problem we fix downstream there's a patch to be applied at build
+For every problem we fix downstream, there's a patch to be applied at build
 time. Those patches are kept in one of these places:
-* ```src/$PROJECT/*.patch```
-* ```python-modules/$PROJECT-$VERSION-patches/```
+
+* ``src/$PROJECT/*.patch``
+* ``python-modules/$PROJECT-$VERSION-patches/``
 
 New patches added as documented above will be picked up automatically
 by the build system.
@@ -60,7 +67,7 @@ External dependencies and associated vulnerabilities
 This Python package builds on and links to third-party libraries.
 
 To document them for all OS'es and to list their known vulnerabilities,
-the LibreOffice spreadsheet ```external_deps.fods``` is used.
+the LibreOffice spreadsheet ``external_deps.fods`` is used.
 
 For your convenience, this flat ODS file is also exported in CSV format in
-```external_deps.csv```.
+``external_deps.csv``.
@@ -1,4 +1,4 @@
-BASE_REQUIREMENTS='pip==20.1.1 chevah-brink==0.74.2 paver==1.2.4'
+BASE_REQUIREMENTS='pip==20.1.1 chevah-brink==0.75 paver==1.2.4'
 PYTHON_CONFIGURATION='default@2.7.18.4b61bd67:sol10@2.7.8.4b61bd67'
 BINARY_DIST_URI='http://binary.chevah.com/production'
 PIP_INDEX='http://pypi.chevah.com/simple'
@@ -7,20 +7,3 @@ PIP_INDEX='http://pypi.chevah.com/simple'
 #   * 'build' is a sub-dir used for building GMP / Python / gmpy / etc.
 #   * $CHEVAH_BUILD_DIR is used by the Python that builds the above.
 CHEVAH_BUILD_DIR='build-python-package'
-
-# For the Python build, we need to detect current OS and get needed deps.
-# This extedens brink.sh with the `detect_os` command option, which writes
-# the BUILD_ENV_VARS file in the Python build dir for chevah_build to pick up.
-execute_venv() {
-    set +o nounset
-    local command=$1
-    set -o nounset
-    if [ "$command" == "detect_os" ]; then
-        echo "PYTHON_VERSION=$PYTHON_NAME" > BUILD_ENV_VARS
-        echo "OS=$OS" >> BUILD_ENV_VARS
-        echo "ARCH=$ARCH" >> BUILD_ENV_VARS
-        exit 0
-    fi
-
-    ${PYTHON_BIN} $PYTHON3_CHECK -c 'from paver.tasks import main; main()' "$@"
-}
@@ -607,11 +607,25 @@ check_os_version() {
 # For old unsupported Linux distros (some with no /etc/os-release) and for other
 # unsupported Linux distros (eg. Arch), we check if the system is glibc-based.
 # If so, we use a generic code path that builds everything statically,
-# including OpenSSL, thus only requiring glibc 2.x.
+# including OpenSSL, thus only requiring glibc 2.X, where X differs by arch.
 #
 check_linux_glibc() {
     local glibc_version
     local glibc_version_array
+    local supported_glibc2_version
+
+    # Supported minimum minor glibc 2.X versions for various arches.
+    # For x64, we build on SLES 11 with glibc 2.11.3.
+    # For arm64, we build on Ubuntu 16.04 with glibc 2.23.
+    # Beware we haven't normalized arch names yet.
+    case "$ARCH" in
+        "amd64"|"x86_64"|"x64")
+            supported_glibc2_version=11
+            ;;
+        "aarch64"|"arm64")
+            supported_glibc2_version=23
+            ;;
+    esac
 
     (>&2 echo -n "Couldn't detect a supported distribution. ")
     (>&2 echo "Trying to treat it as generic Linux...")
@@ -630,7 +644,7 @@ check_linux_glibc() {
         exit 19
     fi
 
-    # Parsing tested with glibc 2.11.x and 2.29, eglibc 2.13 and 2.19.
+    # Tested with glibc 2.5/2.11.3/2.12/2.23/2.28-31 and eglibc 2.13/2.19.
     glibc_version=$(ldd --version | head -n 1 | rev | cut -d\  -f1 | rev)
 
     if [[ $glibc_version =~ [^[:digit:]\.] ]]; then
@@ -647,16 +661,17 @@ check_linux_glibc() {
     fi
 
     # We pass here because:
-    #   1. In python-package building should work with older glibc version.
+    #   1. Building python-package should work with an older glibc version.
     #   2. Our generic "lnx" runtime might work with a slightly older glibc 2.
-    if [ ${glibc_version_array[1]} -lt 11 ]; then
-        (>&2 echo "Beware glibc versions older than 2.11 were NOT tested!")
-        (>&2 echo "Detected glibc version: $glibc_version")
+    if [ ${glibc_version_array[1]} -lt ${supported_glibc2_version} ]; then
+        (>&2 echo -n "Detected glibc version: ${glibc_version}. Versions older")
+        (>&2 echo " than 2.${supported_glibc2_version} were NOT tested!")
+
     fi
 
     set -o errexit
 
-    # glibc 2 detected, we set $OS for a generic build.
+    # glibc 2 detected, we set $OS for a generic Linux build.
     OS="lnx"
 }
 
@@ -720,8 +735,8 @@ detect_os() {
                         ;;
                     ubuntu|ubuntu-core)
                         os_version_raw="$VERSION_ID"
-                        # 12.04/14.04 have OpenSSL 1.0.1, use generic Linux.
-                        check_os_version "$distro_fancy_name" 16.04 \
+                        # For versions with older OpenSSL, use generic build.
+                        check_os_version "$distro_fancy_name" 18.04 \
                             "$os_version_raw" os_version_chevah
                         # Only LTS versions are supported. If it doesn't end in
                         # 04 or first two digits are uneven, use generic build.
@@ -865,6 +880,13 @@ if [ "$COMMAND" = "purge" ] ; then
     exit 0
 fi
 
+# Initialize BUILD_ENV_VARS file when building python-package from scratch.
+if [ "$COMMAND" == "detect_os" ]; then
+    echo "PYTHON_VERSION=$PYTHON_NAME" > BUILD_ENV_VARS
+    echo "OS=$OS" >> BUILD_ENV_VARS
+    echo "ARCH=$ARCH" >> BUILD_ENV_VARS
+    exit 0
+fi
 
 if [ "$COMMAND" = "get_python" ] ; then
     OS=$2