diff --git a/.github/workflows/build_python.yml b/.github/workflows/build_python.yml
index e1c8a6d9..7f4e7e04 100644
--- a/.github/workflows/build_python.yml
+++ b/.github/workflows/build_python.yml
@@ -6,93 +6,52 @@ on:
       python_version:
         required: true
         type: string
+      run_tests:
+        required: false
+        type: boolean
+      debug:
+        required: false
+        type: boolean
   workflow_call:
     inputs:
       python_version:
         required: true
         type: string
+      run_tests:
+        required: false
+        type: boolean
+      debug:
+        required: false
+        type: boolean
 
 env:
-  image_map: '{"x86_64": "debian:buster", "aarch64": "debian:buster", "armv7l": "debian:buster"}'
-  platform_map: '{"x86_64": "linux/amd64", "aarch64": "linux/arm64/v8", "armv7l": "linux/arm/v7"}'
+  RUN_TESTS: ${{ inputs.run_tests }}
+  DEBUG_CI: ${{ inputs.debug }}
 
 jobs:
   build_linux:
     name: Linux ${{ inputs.python_version }} ${{ matrix.arch }}
-    runs-on: ubuntu-latest
     strategy:
       fail-fast: false
       matrix:
         arch: [ x86_64, aarch64, armv7l ]
-
-    steps:
-      - name: Parse image
-        id: parse_image
-        run: |
-          IMAGE=$(echo ${{ toJSON(env.image_map) }} | jq -r '.["${{ matrix.arch }}"]')
-          echo "::set-output name=image::$IMAGE"
-
-      - name: Parse platform
-        id: parse_platform
-        run: |
-          PLATFORM=$(echo ${{ toJSON(env.platform_map) }} | jq -r '.["${{ matrix.arch }}"]')
-          echo "::set-output name=platform::$PLATFORM"
-
-      - name: Checkout
-        uses: actions/checkout@v3
-
-      - name: Set up QEMU
-        uses: docker/setup-qemu-action@v2
-        if: ${{ matrix.arch != 'x86_64' }}
-
-      - name: Build
-        uses: addnab/docker-run-action@v3
-        with:
-          image: ${{ steps.parse_image.outputs.image }}
-          options: -v ${{ github.workspace }}:/work --workdir /tmp --platform ${{ steps.parse_platform.outputs.platform }}
-          run: |
-            set -e
-            /work/scripts/build_linux.sh ${{ matrix.arch }} ${{ inputs.python_version }}
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        with:
-          name: python
-          path: ./python*.zip
-
-      - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        if: ${{ always() }}
-        with:
-          name: build-python
-          path: ./*python*.tar.gz
-
-      - name: Test python in clean environment
-        uses: addnab/docker-run-action@v3
-        with:
-          image: ${{ steps.parse_image.outputs.image }}
-          options: -v ${{ github.workspace }}:/work --workdir /tmp --platform ${{ steps.parse_platform.outputs.platform }}
-          run: |
-            set -e
-            apt update
-            apt install -y unzip
-
-            cp /work/python*.zip .
-            unzip ./python*.zip
-
-            cd python-${{ inputs.python_version }}-linux-${{ matrix.arch }}
-            chmod +x ./bin/python
-            ldd -v -r ./bin/python || true
-            ./bin/python --version
-
-            # make tests nonfatal for now
-            # ./bin/python -m test || true
+    uses: ./.github/workflows/build_python_linux.yml
+    with:
+      python_version: ${{ inputs.python_version }}
+      arch: ${{ matrix.arch }}
+      run_tests: ${{ inputs.run_tests }}
+      debug: ${{ inputs.debug }}
 
   build_windows:
     name: Windows ${{ inputs.python_version }} x86_64 (build)
     runs-on: windows-latest
 
     steps:
+      - name: Set git to use LF
+        run: |
+          git config --global core.autocrlf false
+          git config --global core.eol lf
+
       - name: Checkout
         uses: actions/checkout@v3
 
@@ -111,16 +70,16 @@ jobs:
           ./scripts/build_windows.sh x86_64 ${{ inputs.python_version }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: python
+          name: python-windows-x86_64-${{ inputs.python_version }}
           path: ./python*.zip
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        if: ${{ always() && inputs.debug }}
         with:
-          name: build-python
+          name: build-python-windows-x86_64-${{ inputs.python_version }}
           path: ./*python*.tar.gz
 
   test_windows:
@@ -130,9 +89,9 @@ jobs:
 
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: python
+          name: python-windows-x86_64-${{ inputs.python_version }}
           path: ./python/
 
       - name: Test python in clean environment
@@ -144,8 +103,9 @@ jobs:
           bin/python --version
           ./bin/python -c "import ssl"
 
-          # make tests nonfatal for now
-          # ./bin/python -m test || true
+          if [[ "${{ inputs.run_tests }}" == "true" ]]; then
+            ./bin/python -m test -v -ulargefile,network,decimal,cpu,subprocess,urlfetch,tzdata
+          fi
 
   build_macos:
     name: MacOS ${{ inputs.python_version }} universal2 (build)
@@ -155,22 +115,25 @@ jobs:
       - name: Checkout
         uses: actions/checkout@v3
 
+      - name: Install coreutils
+        run: brew install coreutils
+
       - name: Build
         run: |
           set -ex
           ./scripts/build_macos.sh universal2 ${{ inputs.python_version }}
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
+        uses: actions/upload-artifact@v4
         with:
-          name: python
+          name: python-darwin-universal2-${{ inputs.python_version }}
           path: ./python*.zip
 
       - name: Upload artifacts
-        uses: actions/upload-artifact@v3
-        if: ${{ always() }}
+        uses: actions/upload-artifact@v4
+        if: ${{ always() && inputs.debug }}
         with:
-          name: build-python
+          name: build-python-darwin-universal2-${{ inputs.python_version }}
           path: ./*python*.tar.gz
 
   test_macos:
@@ -180,9 +143,9 @@ jobs:
 
     steps:
       - name: Download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: python
+          name: python-darwin-universal2-${{ inputs.python_version }}
           path: ./python/
 
       - name: Test python in clean environment
@@ -195,5 +158,6 @@ jobs:
           ./bin/python --version
           ./bin/python -c "import ssl"
 
-          # make tests nonfatal for now
-          # ./bin/python -m test || true
+          if [[ "${{ inputs.run_tests }}" == "true" ]]; then
+            ./bin/python -m test -v -ulargefile,network,decimal,cpu,subprocess,urlfetch,tzdata
+          fi
diff --git a/.github/workflows/build_python_linux.yml b/.github/workflows/build_python_linux.yml
new file mode 100644
index 00000000..8b69bd24
--- /dev/null
+++ b/.github/workflows/build_python_linux.yml
@@ -0,0 +1,161 @@
+name: Build Python
+
+on:
+  workflow_call:
+    inputs:
+      python_version:
+        required: true
+        type: string
+      arch:
+        required: true
+        type: string
+      run_tests:
+        required: false
+        type: boolean
+      debug:
+        required: false
+        type: boolean
+
+env:
+  image_map: '{"x86_64": "debian:buster", "aarch64": "debian:buster", "armv7l": "debian:buster"}'
+  platform_map: '{"x86_64": "linux/amd64", "aarch64": "linux/arm64/v8", "armv7l": "linux/arm/v7"}'
+  RUN_TESTS: ${{ inputs.run_tests }}
+  DEBUG_CI: ${{ inputs.debug }}
+
+jobs:
+  build_linux_zig:
+    if: ${{ inputs.arch != 'armv7l' }}
+    name: Linux (Zig) ${{ inputs.python_version }} ${{ inputs.arch }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Parse platform
+        id: parse_platform
+        run: |
+          PLATFORM=$(echo ${{ toJSON(env.platform_map) }} | jq -r '.["${{ inputs.arch }}"]')
+          echo "::set-output name=platform::$PLATFORM"
+
+      - name: Set up zig
+        uses: goto-bus-stop/setup-zig@v2
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Build
+        run: |
+          ./scripts/build_linux_zig.sh ${{ inputs.arch }} ${{ inputs.python_version }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-linux-${{ inputs.arch }}-${{ inputs.python_version }}
+          path: ./python*.zip
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        if: ${{ always() && inputs.debug }}
+        with:
+          name: build-python-linux-${{ inputs.arch }}-${{ inputs.python_version }}
+          path: ./*python*.tar.gz
+
+      - name: Test python in clean environment
+        uses: addnab/docker-run-action@v3
+        with:
+          image: centos:7
+          options: -v ${{ github.workspace }}:/work --workdir /tmp --platform ${{ steps.parse_platform.outputs.platform }}
+          shell: bash
+          run: |
+            set -e
+
+            if [[ "${{ inputs.arch }}" == "armv7l" ]]; then
+              echo "armhfp" > /etc/yum/vars/basearch
+              echo "armv7hl" > /etc/yum/vars/arch
+              echo "armv7hl-redhat-linux-gpu" > /etc/rpm/platform
+            fi
+
+            yum -y install unzip
+
+            cp /work/python*.zip .
+            unzip ./python*.zip
+
+            cd python-${{ inputs.python_version }}-linux-${{ inputs.arch }}
+            chmod +x ./bin/python
+            ldd -v -r ./bin/python || true
+            ./bin/python --version
+            ./bin/python -c "import ssl"
+
+            if [[ "${{ inputs.run_tests }}" == "true" ]]; then
+              ./bin/python -m test -v -ulargefile,network,decimal,cpu,subprocess,urlfetch,tzdata
+            fi
+
+  build_linux:
+    if: ${{ inputs.arch == 'armv7l' }}
+    name: Linux (Docker) ${{ inputs.python_version }} ${{ inputs.arch }}
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Parse image
+        id: parse_image
+        run: |
+          IMAGE=$(echo ${{ toJSON(env.image_map) }} | jq -r '.["${{ inputs.arch }}"]')
+          echo "::set-output name=image::$IMAGE"
+
+      - name: Parse platform
+        id: parse_platform
+        run: |
+          PLATFORM=$(echo ${{ toJSON(env.platform_map) }} | jq -r '.["${{ inputs.arch }}"]')
+          echo "::set-output name=platform::$PLATFORM"
+
+      - name: Checkout
+        uses: actions/checkout@v3
+
+      - name: Set up QEMU
+        uses: docker/setup-qemu-action@v2
+        if: ${{ inputs.arch != 'x86_64' }}
+
+      - name: Build
+        uses: addnab/docker-run-action@v3
+        with:
+          image: ${{ steps.parse_image.outputs.image }}
+          options: -v ${{ github.workspace }}:/work --workdir /tmp --platform ${{ steps.parse_platform.outputs.platform }}
+          shell: bash
+          run: |
+            set -e
+            /work/scripts/build_linux.sh ${{ inputs.arch }} ${{ inputs.python_version }}
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: python-linux-${{ inputs.arch }}-${{ inputs.python_version }}
+          path: ./python*.zip
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        if: ${{ always() && inputs.debug }}
+        with:
+          name: build-python-linux-${{ inputs.arch }}-${{ inputs.python_version }}
+          path: ./*python*.tar.gz
+
+      - name: Test python in clean environment
+        uses: addnab/docker-run-action@v3
+        with:
+          image: ${{ steps.parse_image.outputs.image }}
+          options: -v ${{ github.workspace }}:/work --workdir /tmp --platform ${{ steps.parse_platform.outputs.platform }}
+          shell: bash
+          run: |
+            set -e
+            apt update
+            apt install -y unzip
+
+            cp /work/python*.zip .
+            unzip ./python*.zip
+
+            cd python-${{ inputs.python_version }}-linux-${{ inputs.arch }}
+            chmod +x ./bin/python
+            ldd -v -r ./bin/python || true
+            ./bin/python --version
+            ./bin/python -c "import ssl"
+
+            if [[ "${{ inputs.run_tests }}" == "true" ]]; then
+              ./bin/python -m test -v -ulargefile,network,decimal,cpu,subprocess,urlfetch,tzdata
+            fi
diff --git a/.github/workflows/build_python_on_branch.yml b/.github/workflows/build_python_on_branch.yml
index 41383fbd..baa396da 100644
--- a/.github/workflows/build_python_on_branch.yml
+++ b/.github/workflows/build_python_on_branch.yml
@@ -7,6 +7,13 @@ on:
   pull_request:
     paths: ["scripts/**", ".github/workflows/**"]
   workflow_dispatch:
+    inputs:
+      run_tests:
+        required: false
+        type: boolean
+      debug:
+        required: false
+        type: boolean
 
 jobs:
   build:
@@ -14,7 +21,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        python_version: [ 3.9.17, 3.10.13 ]
+        python_version: [ 3.8.17, 3.9.17, 3.10.13 ]
     uses: ./.github/workflows/build_python.yml
     with:
       python_version: ${{ matrix.python_version }}
+      run_tests: ${{ inputs.run_tests || false }}
+      debug: ${{ inputs.debug || false }}
diff --git a/.github/workflows/release_python.yml b/.github/workflows/release_python.yml
index 02284968..ed0c9691 100644
--- a/.github/workflows/release_python.yml
+++ b/.github/workflows/release_python.yml
@@ -41,10 +41,11 @@ jobs:
         run: git fetch --tags origin
 
       - name: Download artifact
-        uses: actions/download-artifact@v3
+        uses: actions/download-artifact@v4
         with:
-          name: python
+          pattern: python-*
           path: /tmp/python/
+          merge-multiple: true
 
       - name: Pick tag
         run: |
diff --git a/checksums/brotli-1.1.0.tar.gz.sha256 b/checksums/brotli-1.1.0.tar.gz.sha256
new file mode 100644
index 00000000..288008d7
--- /dev/null
+++ b/checksums/brotli-1.1.0.tar.gz.sha256
@@ -0,0 +1 @@
+e720a6ca29428b803f4ad165371771f5398faba397edf6778837a18599ea13ff  brotli-1.1.0.tar.gz
\ No newline at end of file
diff --git a/checksums/expat-2.5.0.tar.gz.sha256 b/checksums/expat-2.5.0.tar.gz.sha256
new file mode 100644
index 00000000..42a02189
--- /dev/null
+++ b/checksums/expat-2.5.0.tar.gz.sha256
@@ -0,0 +1 @@
+6b902ab103843592be5e99504f846ec109c1abb692e85347587f237a4ffa1033  expat-2.5.0.tar.gz
\ No newline at end of file
diff --git a/checksums/fontconfig-2.15.0.tar.gz.sha256 b/checksums/fontconfig-2.15.0.tar.gz.sha256
new file mode 100644
index 00000000..4b1cc37d
--- /dev/null
+++ b/checksums/fontconfig-2.15.0.tar.gz.sha256
@@ -0,0 +1 @@
+f5f359d6332861bd497570848fcb42520964a9e83d5e3abe397b6b6db9bcaaf4  fontconfig-2.15.0.tar.gz
\ No newline at end of file
diff --git a/checksums/freetype-2.13.2.tar.gz.sha256 b/checksums/freetype-2.13.2.tar.gz.sha256
new file mode 100644
index 00000000..736eb3e4
--- /dev/null
+++ b/checksums/freetype-2.13.2.tar.gz.sha256
@@ -0,0 +1 @@
+1ac27e16c134a7f2ccea177faba19801131116fd682efc1f5737037c5db224b5  freetype-2.13.2.tar.gz
\ No newline at end of file
diff --git a/checksums/gdbm-1.23.tar.gz.sha256 b/checksums/gdbm-1.23.tar.gz.sha256
new file mode 100644
index 00000000..f2e521dd
--- /dev/null
+++ b/checksums/gdbm-1.23.tar.gz.sha256
@@ -0,0 +1 @@
+74b1081d21fff13ae4bd7c16e5d6e504a4c26f7cde1dca0d963a484174bbcacd  gdbm-1.23.tar.gz
\ No newline at end of file
diff --git a/checksums/inputproto-2.3.2.tar.gz.sha256 b/checksums/inputproto-2.3.2.tar.gz.sha256
new file mode 100644
index 00000000..8c31c4cf
--- /dev/null
+++ b/checksums/inputproto-2.3.2.tar.gz.sha256
@@ -0,0 +1 @@
+10eaadd531f38f7c92ab59ef0708ca195caf3164a75c4ed99f0c04f2913f6ef3  inputproto-2.3.2.tar.gz
diff --git a/checksums/kbproto-1.0.7.tar.gz.sha256 b/checksums/kbproto-1.0.7.tar.gz.sha256
new file mode 100644
index 00000000..9561d61d
--- /dev/null
+++ b/checksums/kbproto-1.0.7.tar.gz.sha256
@@ -0,0 +1 @@
+828cb275b91268b1a3ea950d5c0c5eb076c678fdf005d517411f89cc8c3bb416  kbproto-1.0.7.tar.gz
diff --git a/checksums/libICE-1.0.7.tar.gz.sha256 b/checksums/libICE-1.0.7.tar.gz.sha256
new file mode 100644
index 00000000..e4925563
--- /dev/null
+++ b/checksums/libICE-1.0.7.tar.gz.sha256
@@ -0,0 +1 @@
+8463d080da6f87d5c20b21fe694dfb81f97319a8617030ea4720e97d1bb4659c  libICE-1.0.7.tar.gz
diff --git a/checksums/libSM-1.2.2.tar.gz.sha256 b/checksums/libSM-1.2.2.tar.gz.sha256
new file mode 100644
index 00000000..62a6a25c
--- /dev/null
+++ b/checksums/libSM-1.2.2.tar.gz.sha256
@@ -0,0 +1 @@
+14bb7c669ce2b8ff712fbdbf48120e3742a77edcd5e025d6b3325ed30cf120f4  libSM-1.2.2.tar.gz
diff --git a/checksums/libX11-1.8.7.tar.gz.sha256 b/checksums/libX11-1.8.7.tar.gz.sha256
new file mode 100644
index 00000000..499a02e3
--- /dev/null
+++ b/checksums/libX11-1.8.7.tar.gz.sha256
@@ -0,0 +1 @@
+793ebebf569f12c864b77401798d38814b51790fce206e01a431e5feb982e20b  libX11-1.8.7.tar.gz
\ No newline at end of file
diff --git a/checksums/libXScrnSaver-1.2.4.tar.gz.sha256 b/checksums/libXScrnSaver-1.2.4.tar.gz.sha256
new file mode 100644
index 00000000..b7f6d69f
--- /dev/null
+++ b/checksums/libXScrnSaver-1.2.4.tar.gz.sha256
@@ -0,0 +1 @@
+0656b2630475104d6df75d91ebb8e0153e61d14e9871ef1f403bcda4a62a838a  libXScrnSaver-1.2.4.tar.gz
diff --git a/checksums/libXau-1.0.11.tar.gz.sha256 b/checksums/libXau-1.0.11.tar.gz.sha256
new file mode 100644
index 00000000..b8a966f2
--- /dev/null
+++ b/checksums/libXau-1.0.11.tar.gz.sha256
@@ -0,0 +1 @@
+3a321aaceb803577a4776a5efe78836eb095a9e44bbc7a465d29463e1a14f189  libXau-1.0.11.tar.gz
\ No newline at end of file
diff --git a/checksums/libXdmcp-1.1.2.tar.gz.sha256 b/checksums/libXdmcp-1.1.2.tar.gz.sha256
new file mode 100644
index 00000000..fa1a8eed
--- /dev/null
+++ b/checksums/libXdmcp-1.1.2.tar.gz.sha256
@@ -0,0 +1 @@
+6f7c7e491a23035a26284d247779174dedc67e34e93cc3548b648ffdb6fc57c0  libXdmcp-1.1.2.tar.gz
\ No newline at end of file
diff --git a/checksums/libXext-1.3.5.tar.gz.sha256 b/checksums/libXext-1.3.5.tar.gz.sha256
new file mode 100644
index 00000000..d4e5ef45
--- /dev/null
+++ b/checksums/libXext-1.3.5.tar.gz.sha256
@@ -0,0 +1 @@
+1a3dcda154f803be0285b46c9338515804b874b5ccc7a2b769ab7fd76f1035bd  libXext-1.3.5.tar.gz
diff --git a/checksums/libXft-2.3.8.tar.gz.sha256 b/checksums/libXft-2.3.8.tar.gz.sha256
new file mode 100644
index 00000000..52d4f7bd
--- /dev/null
+++ b/checksums/libXft-2.3.8.tar.gz.sha256
@@ -0,0 +1 @@
+32e48fe2d844422e64809e4e99b9d8aed26c1b541a5acf837c5037b8d9f278a8  libXft-2.3.8.tar.gz
diff --git a/checksums/libXrender-0.9.11.tar.gz.sha256 b/checksums/libXrender-0.9.11.tar.gz.sha256
new file mode 100644
index 00000000..b7b71d2f
--- /dev/null
+++ b/checksums/libXrender-0.9.11.tar.gz.sha256
@@ -0,0 +1 @@
+6aec3ca02e4273a8cbabf811ff22106f641438eb194a12c0ae93c7e08474b667  libXrender-0.9.11.tar.gz
diff --git a/checksums/libffi-3.4.2.tar.gz.sha256 b/checksums/libffi-3.4.2.tar.gz.sha256
new file mode 100644
index 00000000..aec8a5af
--- /dev/null
+++ b/checksums/libffi-3.4.2.tar.gz.sha256
@@ -0,0 +1 @@
+540fb721619a6aba3bdeef7d940d8e9e0e6d2c193595bc243241b77ff9e93620  libffi-3.4.2.tar.gz
\ No newline at end of file
diff --git a/checksums/libgcrypt-1.10.3.tar.bz2.sha256 b/checksums/libgcrypt-1.10.3.tar.bz2.sha256
new file mode 100644
index 00000000..6d0bbc23
--- /dev/null
+++ b/checksums/libgcrypt-1.10.3.tar.bz2.sha256
@@ -0,0 +1 @@
+8b0870897ac5ac67ded568dcfadf45969cfa8a6beb0fd60af2a9eadc2a3272aa  libgcrypt-1.10.3.tar.bz2
\ No newline at end of file
diff --git a/checksums/libgpg-error-1.47.tar.bz2.sha256 b/checksums/libgpg-error-1.47.tar.bz2.sha256
new file mode 100644
index 00000000..ce88377c
--- /dev/null
+++ b/checksums/libgpg-error-1.47.tar.bz2.sha256
@@ -0,0 +1 @@
+9e3c670966b96ecc746c28c2c419541e3bcb787d1a73930f5e5f5e1bcbbb9bdb  libgpg-error-1.47.tar.bz2
\ No newline at end of file
diff --git a/checksums/libpng-1.6.41.tar.gz.sha256 b/checksums/libpng-1.6.41.tar.gz.sha256
new file mode 100644
index 00000000..0e3c8f25
--- /dev/null
+++ b/checksums/libpng-1.6.41.tar.gz.sha256
@@ -0,0 +1 @@
+f00a11840f60616bdced9056d0f4cf2e4897697db039f15ce911704f957d3c5d  libpng-1.6.41.tar.gz
\ No newline at end of file
diff --git a/checksums/libpthread-stubs-0.5.tar.gz.sha256 b/checksums/libpthread-stubs-0.5.tar.gz.sha256
new file mode 100644
index 00000000..7c5ba435
--- /dev/null
+++ b/checksums/libpthread-stubs-0.5.tar.gz.sha256
@@ -0,0 +1 @@
+593196cc746173d1e25cb54a93a87fd749952df68699aab7e02c085530e87747  libpthread-stubs-0.5.tar.gz
diff --git a/checksums/libxcb-1.16.tar.gz.sha256 b/checksums/libxcb-1.16.tar.gz.sha256
new file mode 100644
index 00000000..fdfcfda0
--- /dev/null
+++ b/checksums/libxcb-1.16.tar.gz.sha256
@@ -0,0 +1 @@
+bc0f75f84b28e6496a19a1d094d7e47def861a50cb7cce5b23b62eecdc2a4479  libxcb-1.16.tar.gz
diff --git a/checksums/libxml2-2.12.4.tar.xz.sha256 b/checksums/libxml2-2.12.4.tar.xz.sha256
new file mode 100644
index 00000000..e959ce52
--- /dev/null
+++ b/checksums/libxml2-2.12.4.tar.xz.sha256
@@ -0,0 +1 @@
+497360e423cf0bd99eacdb7c6215dea92e6d6e89ee940393c2bae0e77cb9b7d0  libxml2-2.12.4.tar.xz
\ No newline at end of file
diff --git a/checksums/libxslt-1.1.39.tar.xz.sha256 b/checksums/libxslt-1.1.39.tar.xz.sha256
new file mode 100644
index 00000000..f6f75a45
--- /dev/null
+++ b/checksums/libxslt-1.1.39.tar.xz.sha256
@@ -0,0 +1 @@
+2a20ad621148339b0759c4d4e96719362dee64c9a096dbba625ba053846349f0  libxslt-1.1.39.tar.xz
\ No newline at end of file
diff --git a/checksums/mpdecimal-2.5.0.tar.gz.sha256 b/checksums/mpdecimal-2.5.0.tar.gz.sha256
new file mode 100644
index 00000000..9169aa9a
--- /dev/null
+++ b/checksums/mpdecimal-2.5.0.tar.gz.sha256
@@ -0,0 +1 @@
+15417edc8e12a57d1d9d75fa7e3f22b158a3b98f44db9d694cfd2acde8dfa0ca  mpdecimal-2.5.0.tar.gz
diff --git a/checksums/ncurses-6.4.tar.gz.sha256 b/checksums/ncurses-6.4.tar.gz.sha256
new file mode 100644
index 00000000..19867692
--- /dev/null
+++ b/checksums/ncurses-6.4.tar.gz.sha256
@@ -0,0 +1 @@
+6931283d9ac87c5073f30b6290c4c75f21632bb4fc3603ac8100812bed248159  ncurses-6.4.tar.gz
\ No newline at end of file
diff --git a/checksums/openssl-1.1.1w.tar.gz.sha256 b/checksums/openssl-1.1.1w.tar.gz.sha256
new file mode 100644
index 00000000..9b3e18b4
--- /dev/null
+++ b/checksums/openssl-1.1.1w.tar.gz.sha256
@@ -0,0 +1 @@
+ cf3098950cb4d853ad95c0841f1f9c6d3dc102dccfcacd521d93925208b76ac8  openssl-1.1.1w.tar.gz
\ No newline at end of file
diff --git a/checksums/readline-8.2.tar.gz.sha256 b/checksums/readline-8.2.tar.gz.sha256
new file mode 100644
index 00000000..6176359c
--- /dev/null
+++ b/checksums/readline-8.2.tar.gz.sha256
@@ -0,0 +1 @@
+3feb7171f16a84ee82ca18a36d7b9be109a52c04f492a053331d7d1095007c35  readline-8.2.tar.gz
\ No newline at end of file
diff --git a/checksums/renderproto-0.11.1.tar.gz.sha256 b/checksums/renderproto-0.11.1.tar.gz.sha256
new file mode 100644
index 00000000..fb24b253
--- /dev/null
+++ b/checksums/renderproto-0.11.1.tar.gz.sha256
@@ -0,0 +1 @@
+a0a4be3cad9381ae28279ba5582e679491fc2bec9aab8a65993108bf8dbce5fe  renderproto-0.11.1.tar.gz
diff --git a/checksums/scrnsaverproto-1.2.2.tar.gz.sha256 b/checksums/scrnsaverproto-1.2.2.tar.gz.sha256
new file mode 100644
index 00000000..81fd8e89
--- /dev/null
+++ b/checksums/scrnsaverproto-1.2.2.tar.gz.sha256
@@ -0,0 +1 @@
+d8dee19c52977f65af08fad6aa237bacee11bc5a33e1b9b064e8ac1fd99d6e79  scrnsaverproto-1.2.2.tar.gz
diff --git a/checksums/sqlite-amalgamation-3430100.zip.sha256 b/checksums/sqlite-amalgamation-3430100.zip.sha256
new file mode 100644
index 00000000..457593ba
--- /dev/null
+++ b/checksums/sqlite-amalgamation-3430100.zip.sha256
@@ -0,0 +1 @@
+7e634bbd4b2870a83dc7c1e3cc02e4d30b8555cd7db7b332f24e0c447fd0dd16  sqlite-amalgamation-3430100.zip
diff --git a/checksums/sqlite-autoconf-3450000.tar.gz.sha256 b/checksums/sqlite-autoconf-3450000.tar.gz.sha256
new file mode 100644
index 00000000..e0417f2b
--- /dev/null
+++ b/checksums/sqlite-autoconf-3450000.tar.gz.sha256
@@ -0,0 +1 @@
+72887d57a1d8f89f52be38ef84a6353ce8c3ed55ada7864eb944abd9a495e436  sqlite-autoconf-3450000.tar.gz
\ No newline at end of file
diff --git a/checksums/tcl8.6.13-src.tar.gz.sha256 b/checksums/tcl8.6.13-src.tar.gz.sha256
new file mode 100644
index 00000000..e652922b
--- /dev/null
+++ b/checksums/tcl8.6.13-src.tar.gz.sha256
@@ -0,0 +1 @@
+43a1fae7412f61ff11de2cfd05d28cfc3a73762f354a417c62370a54e2caf066  tcl8.6.13-src.tar.gz
diff --git a/checksums/tk8.6.13-src.tar.gz.sha256 b/checksums/tk8.6.13-src.tar.gz.sha256
new file mode 100644
index 00000000..4f350979
--- /dev/null
+++ b/checksums/tk8.6.13-src.tar.gz.sha256
@@ -0,0 +1 @@
+2e65fa069a23365440a3c56c556b8673b5e32a283800d8d9b257e3f584ce0675  tk8.6.13-src.tar.gz
diff --git a/checksums/util-linux-2.39.3.tar.gz.sha256 b/checksums/util-linux-2.39.3.tar.gz.sha256
new file mode 100644
index 00000000..fd3e5e0b
--- /dev/null
+++ b/checksums/util-linux-2.39.3.tar.gz.sha256
@@ -0,0 +1 @@
+2434edd1cf2aaca2a2b76b5de5ce7c98b12f75af9f600800c0655af20be85956  util-linux-2.39.3.tar.gz
\ No newline at end of file
diff --git a/checksums/xcb-proto-1.16.0.tar.gz.sha256 b/checksums/xcb-proto-1.16.0.tar.gz.sha256
new file mode 100644
index 00000000..aa199be2
--- /dev/null
+++ b/checksums/xcb-proto-1.16.0.tar.gz.sha256
@@ -0,0 +1 @@
+d9c7f010b1105fc3858bf07b5169b2dd8e7493c6652b1fe45f3321d874f291d7  xcb-proto-1.16.0.tar.gz
diff --git a/checksums/xextproto-7.3.0.tar.gz.sha256 b/checksums/xextproto-7.3.0.tar.gz.sha256
new file mode 100644
index 00000000..b22620bb
--- /dev/null
+++ b/checksums/xextproto-7.3.0.tar.gz.sha256
@@ -0,0 +1 @@
+1b1bcdf91221e78c6c33738667a57bd9aaa63d5953174ad8ed9929296741c9f5  xextproto-7.3.0.tar.gz
diff --git a/checksums/xorgproto-2023.2.tar.gz.sha256 b/checksums/xorgproto-2023.2.tar.gz.sha256
new file mode 100644
index 00000000..71ff3b69
--- /dev/null
+++ b/checksums/xorgproto-2023.2.tar.gz.sha256
@@ -0,0 +1 @@
+c791aad9b5847781175388ebe2de85cb5f024f8dabf526d5d699c4f942660cc3  xorgproto-2023.2.tar.gz
diff --git a/checksums/xproto-7.0.31.tar.gz.sha256 b/checksums/xproto-7.0.31.tar.gz.sha256
new file mode 100644
index 00000000..97a3323b
--- /dev/null
+++ b/checksums/xproto-7.0.31.tar.gz.sha256
@@ -0,0 +1 @@
+6d755eaae27b45c5cc75529a12855fed5de5969b367ed05003944cf901ed43c7  xproto-7.0.31.tar.gz
diff --git a/checksums/xtrans-1.5.0.tar.gz.sha256 b/checksums/xtrans-1.5.0.tar.gz.sha256
new file mode 100644
index 00000000..5a5460a3
--- /dev/null
+++ b/checksums/xtrans-1.5.0.tar.gz.sha256
@@ -0,0 +1 @@
+a806f8a92f879dcd0146f3f1153fdffe845f2fc0df9b1a26c19312b7b0a29c86  xtrans-1.5.0.tar.gz
diff --git a/checksums/xz-5.4.5.tar.gz.sha256 b/checksums/xz-5.4.5.tar.gz.sha256
new file mode 100644
index 00000000..d0e480e0
--- /dev/null
+++ b/checksums/xz-5.4.5.tar.gz.sha256
@@ -0,0 +1 @@
+135c90b934aee8fbc0d467de87a05cb70d627da36abe518c357a873709e5b7d6  xz-5.4.5.tar.gz
\ No newline at end of file
diff --git a/checksums/zlib-1.3.1.tar.gz.sha256 b/checksums/zlib-1.3.1.tar.gz.sha256
new file mode 100644
index 00000000..c8155b9f
--- /dev/null
+++ b/checksums/zlib-1.3.1.tar.gz.sha256
@@ -0,0 +1 @@
+9a93b2b7dfdac77ceba5a558a580e74667dd6fede4585b91eefb60f03b72df23  zlib-1.3.1.tar.gz
\ No newline at end of file
diff --git a/scripts/build_linux.sh b/scripts/build_linux.sh
index 87b31328..25188975 100755
--- a/scripts/build_linux.sh
+++ b/scripts/build_linux.sh
@@ -1,10 +1,8 @@
 #!/bin/bash
 
-ARCH=$1
-PYTHON_FULL_VER=$2
-PYTHON_VER=$(echo ${PYTHON_FULL_VER} | cut -d "." -f 1-2)
-
-set -ex
+PLATFORM=linux
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+source ${SCRIPT_DIR}/utils.sh
 
 ########################
 # Install dependencies #
@@ -34,7 +32,7 @@ case "$ARCH" in
     wget -q https://files.pythonhosted.org/packages/0d/41/85549e9645097cddc7279886eafeafc7462215f309133ea2eae4941f9c35/cmake-3.26.4-py2.py3-none-manylinux2014_aarch64.manylinux_2_17_aarch64.whl
     ;;
   armv7l)
-    wget -q https://www.piwheels.org/simple/cmake/cmake-3.26.4-cp37-cp37m-linux_armv7l.whl
+    wget -q https://github.com/bjia56/armv7l-wheels/releases/download/cmake-3.26.4-cpython3.7/cmake-3.26.4-cp37-cp37m-manylinux_2_17_armv7l.manylinux2014_armv7l.whl
     ;;
 esac
 mv cmake*.whl cmake-3.26.4-py2.py3-none-any.whl
@@ -60,8 +58,7 @@ cd /build
 mkdir python-build
 mkdir python-install
 
-git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch python3.10 --single-branch --depth 1
-#git clone https://github.com/python-cmake-buildsystem/python-cmake-buildsystem.git
+git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch portable-python --single-branch --depth 1
 
 echo "::endgroup::"
 #############
@@ -71,7 +68,7 @@ echo "::group::Run build"
 
 if [[ "${ARCH}" == "armv7l" ]]; then
   cd /tmp
-  wget -q https://www.bytereef.org/software/mpdecimal/releases/mpdecimal-2.5.0.tar.gz
+  wget -q https://github.com/bjia56/portable-python/releases/download/build-dependencies/mpdecimal-2.5.0.tar.gz
   tar -xzf mpdecimal*.tar.gz
   cd mpdecimal-2.5.0
   ./configure
@@ -86,6 +83,7 @@ if [[ "${ARCH}" == "armv7l" ]]; then
   additionalparams+=(-DUSE_SYSTEM_LIBMPDEC=ON)
   export LD_LIBRARY_PATH=$LD_LIBRARY_PATH:/usr/local/lib
 fi
+
 #cmake --trace-expand \
 cmake \
   -DPYTHON_VERSION=${PYTHON_FULL_VER} \
@@ -94,8 +92,8 @@ cmake \
   -DBUILD_EXTENSIONS_AS_BUILTIN=ON \
   -DBUILD_LIBPYTHON_SHARED=ON \
   "${additionalparams[@]}" \
-  -DBUILD_TESTING=ON \
-  -DINSTALL_TEST=OFF \
+  -DBUILD_TESTING=${INSTALL_TEST} \
+  -DINSTALL_TEST=${INSTALL_TEST} \
   -DINSTALL_MANUAL=OFF \
   ../python-cmake-buildsystem
 make -j8
diff --git a/scripts/build_linux_zig.sh b/scripts/build_linux_zig.sh
new file mode 100755
index 00000000..ea5e6269
--- /dev/null
+++ b/scripts/build_linux_zig.sh
@@ -0,0 +1,532 @@
+#!/bin/bash
+
+PLATFORM=linux
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+source ${SCRIPT_DIR}/utils.sh
+
+zig version
+
+
+########################
+# Install dependencies #
+########################
+echo "::group::Install dependencies"
+
+export DEBIAN_FRONTEND=noninteractive
+sudo apt update
+sudo apt -y install \
+  wget build-essential pkg-config cmake autoconf git \
+  python2 python3 python3-pip clang patchelf qemu-user-static \
+  gettext bison libtool autopoint gperf ncurses-bin xutils-dev
+case "$ARCH" in
+  x86_64)
+    sudo apt -y install libc6-amd64-cross
+    sudo ln -s /usr/x86_64-linux-gnu/lib/ld-linux-x86-64.so.2 /lib/ld-linux-x86-64.so.2
+    ;;
+  aarch64)
+    sudo apt -y install libc6-arm64-cross
+    sudo ln -s /usr/aarch64-linux-gnu/lib/ld-linux-aarch64.so.1 /lib/ld-linux-aarch64.so.1
+    ;;
+  arm)
+    sudo apt -y install libc6-armhf-cross
+    sudo ln -s /usr/arm-linux-gnueabihf/lib/ld-linux-armhf.so.3 /lib/ld-linux-armhf.so.3
+    ;;
+esac
+sudo pip install https://github.com/mesonbuild/meson/archive/2baae24.zip ninja
+
+mkdir ${BUILDDIR}
+mkdir ${DEPSDIR}
+
+export ZIG_TARGET=${ARCH}-linux-gnu.2.17
+
+# Python's sysconfig module will retain references to these compiler values, which cause
+# problems when sysconfig is used to pick a compiler during binary extension builds.
+# Since clang (zig) is a drop-in replacement for gcc, we set these so the final sysconfig
+# will work on other platforms.
+sudo cp ${WORKDIR}/zigshim/zig_ar /usr/bin/${ARCH}-linux-gnu-gcc-ar
+sudo cp ${WORKDIR}/zigshim/zig_cc /usr/bin/${ARCH}-linux-gnu-gcc
+sudo cp ${WORKDIR}/zigshim/zig_cxx /usr/bin/${ARCH}-linux-gnu-g++
+
+export AR="${ARCH}-linux-gnu-gcc-ar"
+export CC="${ARCH}-linux-gnu-gcc"
+export CXX="${ARCH}-linux-gnu-g++"
+export CHOST=${ARCH}
+export CFLAGS="-I${DEPSDIR}/include"
+export CPPFLAGS="-I${DEPSDIR}/include"
+export CXXFLAGS="${CPPFLAGS}"
+export LDFLAGS="-L${DEPSDIR}/lib"
+export PKG_CONFIG_PATH="${DEPSDIR}/lib/pkgconfig:${DEPSDIR}/share/pkgconfig"
+
+echo "::endgroup::"
+########
+# zlib #
+########
+echo "::group::zlib"
+cd ${BUILDDIR}
+
+download_verify_extract zlib-1.3.1.tar.gz
+cd zlib*
+./configure --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+###########
+# OpenSSL #
+###########
+echo "::group::OpenSSL"
+cd ${BUILDDIR}
+
+download_verify_extract openssl-1.1.1w.tar.gz
+cd openssl*
+./Configure linux-${ARCH} no-shared --prefix=${DEPSDIR} --openssldir=${DEPSDIR}
+make -j4
+make install_sw
+
+echo "::endgroup::"
+##########
+# libffi #
+##########
+echo "::group::libffi"
+cd ${BUILDDIR}
+
+download_verify_extract libffi-3.4.2.tar.gz
+cd libffi*
+./configure --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+###########
+# sqlite3 #
+###########
+echo "::group::sqlite3"
+cd ${BUILDDIR}
+
+download_verify_extract sqlite-autoconf-3450000.tar.gz
+cd sqlite*
+./configure --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+#########
+# expat #
+#########
+echo "::group::expat"
+cd ${BUILDDIR}
+
+download_verify_extract expat-2.5.0.tar.gz
+cd expat*
+./configure --host=${ARCH}-linux --disable-shared --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+###########
+# ncurses #
+###########
+echo "::group::ncurses"
+cd ${BUILDDIR}
+
+download_verify_extract ncurses-6.4.tar.gz
+cd ncurses*
+./configure --host=${ARCH}-linux --with-normal --without-progs --enable-overwrite --disable-stripping --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+############
+# readline #
+############
+echo "::group::readline"
+cd ${BUILDDIR}
+
+download_verify_extract readline-8.2.tar.gz
+cd readline*
+./configure --with-curses --disable-shared --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+#########
+# bzip2 #
+#########
+echo "::group::bzip2"
+cd ${BUILDDIR}
+
+wget --no-verbose -O bzip2.tar.gz https://github.com/commontk/bzip2/tarball/master
+tar -xf bzip2*.tar.gz
+rm *.tar.gz
+cd commontk-bzip2*
+mkdir build
+cd build
+cmake -DCMAKE_SYSTEM_PROCESSOR=${ARCH} -DCMAKE_INSTALL_PREFIX:PATH=${DEPSDIR} ..
+make -j4
+make install
+
+echo "::endgroup::"
+######
+# xz #
+######
+echo "::group::xz"
+cd ${BUILDDIR}
+
+download_verify_extract xz-5.4.5.tar.gz
+cd xz*
+mkdir build
+cd build
+cmake -DCMAKE_SYSTEM_PROCESSOR=${ARCH} -DCMAKE_INSTALL_PREFIX:PATH=${DEPSDIR} ..
+make -j4
+make install
+
+echo "::endgroup::"
+##########
+# Brotli #
+##########
+echo "::group::Brotli"
+cd ${BUILDDIR}
+
+download_verify_extract brotli-1.1.0.tar.gz
+cd brotli*
+mkdir build
+cd build
+cmake -DCMAKE_SYSTEM_PROCESSOR=${ARCH} -DCMAKE_INSTALL_PREFIX:PATH=${DEPSDIR} ..
+make -j4
+make install
+
+echo "::endgroup::"
+########
+# uuid #
+########
+echo "::group::uuid"
+cd ${BUILDDIR}
+
+download_verify_extract util-linux-2.39.3.tar.gz
+cd util-linux*
+./autogen.sh
+./configure --host=${ARCH}-linux --disable-all-programs --enable-libuuid --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+########
+# gdbm #
+########
+echo "::group::gdbm"
+cd ${BUILDDIR}
+
+download_verify_extract gdbm-1.23.tar.gz
+cd gdbm*
+./configure --host=${ARCH}-linux --enable-libgdbm-compat --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+###########
+# libxml2 #
+###########
+echo "::group::libxml2"
+cd ${BUILDDIR}
+
+download_verify_extract libxml2-2.12.4.tar.xz
+cd libxml2*
+./configure --host=${ARCH}-linux --enable-static --disable-shared --without-python --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+############
+# libpng16 #
+############
+echo "::group::libpng16"
+cd ${BUILDDIR}
+
+download_verify_extract libpng-1.6.41.tar.gz
+cd libpng*
+./configure --host=${ARCH}-linux --with-zlib-prefix=${DEPSDIR} --disable-tools --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+#############
+# libgcrypt #
+#############
+echo "::group::libgcrypt"
+cd ${BUILDDIR}
+
+download_verify_extract libgpg-error-1.47.tar.bz2
+cd libgpg-error*
+./configure --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+cd ${BUILDDIR}
+
+download_verify_extract libgcrypt-1.10.3.tar.bz2
+cd libgcrypt*
+LDFLAGS="${LDFLAGS} -Wl,--undefined-version" ./configure --disable-asm --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+###########
+# libxslt #
+###########
+echo "::group::libxslt"
+cd ${BUILDDIR}
+
+download_verify_extract libxslt-1.1.39.tar.xz
+cd libxslt*
+CFLAGS="${CFLAGS} -I${DEPSDIR}/include/libxml2" ./configure --host=${ARCH}-linux --with-libxml-prefix=${DEPSDIR} --without-python --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+############
+# freetype #
+############
+echo "::group::freetype"
+cd ${BUILDDIR}
+
+download_verify_extract freetype-2.13.2.tar.gz
+cd freetype*
+./configure --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+##############
+# fontconfig #
+##############
+echo "::group::fontconfig"
+cd ${BUILDDIR}
+
+download_verify_extract fontconfig-2.15.0.tar.gz
+cd fontconfig*
+LDFLAGS="${LDFLAGS} -lxml2" ./configure --host=${ARCH}-linux --enable-static --disable-shared --enable-libxml2 --disable-cache-build --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+#######
+# X11 #
+#######
+#echo "::group::X11"
+#cd ${BUILDDIR}
+
+function build_x11_lib () {
+  echo "::group::$1"
+  cd ${BUILDDIR}
+
+  pkg=$1
+  ext_flags="$2"
+  file=$pkg.tar.gz
+  download_verify_extract $file
+  cd $pkg
+  autoreconf -vfi
+  ./configure $ext_flags --host=${ARCH}-linux --prefix=${DEPSDIR}
+  make -j4
+  make install
+
+  echo "::endgroup::"
+}
+
+build_x11_lib xorgproto-2023.2
+build_x11_lib xproto-7.0.31
+build_x11_lib xextproto-7.3.0
+build_x11_lib kbproto-1.0.7
+build_x11_lib inputproto-2.3.2
+build_x11_lib renderproto-0.11.1
+build_x11_lib scrnsaverproto-1.2.2
+build_x11_lib xcb-proto-1.16.0
+build_x11_lib libpthread-stubs-0.5
+build_x11_lib xtrans-1.5.0
+build_x11_lib libXau-1.0.11
+build_x11_lib libxcb-1.16
+build_x11_lib libXdmcp-1.1.2
+build_x11_lib libX11-1.8.7 --enable-malloc0returnsnull
+build_x11_lib libXext-1.3.5 --enable-malloc0returnsnull
+build_x11_lib libICE-1.0.7
+build_x11_lib libSM-1.2.2
+build_x11_lib libXrender-0.9.11 --enable-malloc0returnsnull
+build_x11_lib libXft-2.3.8
+build_x11_lib libXScrnSaver-1.2.4 --enable-malloc0returnsnull
+
+#echo "::endgroup::"
+#######
+# tcl #
+#######
+echo "::group::tcl"
+cd ${BUILDDIR}
+
+download_verify_extract tcl8.6.13-src.tar.gz
+cd tcl*/unix
+LDFLAGS="${LDFLAGS} -lxml2" ./configure --disable-shared --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+######
+# tk #
+######
+echo "::group::tk"
+cd ${BUILDDIR}
+
+download_verify_extract tk8.6.13-src.tar.gz
+cd tk*/unix
+LDFLAGS="${LDFLAGS} -lxml2" ./configure --disable-shared --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+#############
+# mpdecimal #
+#############
+echo "::group::mpdecimal"
+cd ${BUILDDIR}
+
+download_verify_extract mpdecimal-2.5.0.tar.gz
+cd mpdecimal*
+./configure --disable-cxx --host=${ARCH}-linux --prefix=${DEPSDIR}
+make -j4
+make install
+
+echo "::endgroup::"
+##########
+# Python #
+##########
+echo "::group::Python"
+cd ${BUILDDIR}
+
+wget --no-verbose -O python-cmake-buildsystem.tar.gz https://github.com/bjia56/python-cmake-buildsystem/tarball/portable-python
+tar -xf python-cmake-buildsystem.tar.gz
+rm *.tar.gz
+mv *python-cmake-buildsystem* python-cmake-buildsystem
+mkdir python-build
+mkdir python-install
+cd python-build
+LDFLAGS="${LDFLAGS} -lfontconfig -lfreetype" cmake \
+  -DCMAKE_SYSTEM_PROCESSOR=${ARCH} \
+  -DCMAKE_CROSSCOMPILING_EMULATOR=${WORKDIR}/scripts/qemu_${ARCH}_interpreter \
+  -DCMAKE_IGNORE_PATH=/usr/include \
+  -DCMAKE_C_STANDARD=99 \
+  -DPYTHON_VERSION=${PYTHON_FULL_VER} \
+  -DCMAKE_BUILD_TYPE:STRING=Release \
+  -DCMAKE_INSTALL_PREFIX:PATH=${BUILDDIR}/python-install \
+  -DBUILD_EXTENSIONS_AS_BUILTIN=ON \
+  -DBUILD_LIBPYTHON_SHARED=ON \
+  -DUSE_SYSTEM_LIBRARIES=OFF \
+  -DBUILD_TESTING=${INSTALL_TEST} \
+  -DINSTALL_TEST=${INSTALL_TEST} \
+  -DINSTALL_MANUAL=OFF \
+  -DOPENSSL_INCLUDE_DIR:PATH=${DEPSDIR}/include \
+  -DOPENSSL_LIBRARIES="${DEPSDIR}/lib/libssl.a;${DEPSDIR}/lib/libcrypto.a" \
+  -DSQLite3_INCLUDE_DIR:PATH=${DEPSDIR}/include \
+  -DSQLite3_LIBRARY:FILEPATH=${DEPSDIR}/lib/libsqlite3.a \
+  -DZLIB_INCLUDE_DIR:PATH=${DEPSDIR}/include \
+  -DZLIB_LIBRARY:FILEPATH=${DEPSDIR}/lib/libz.a \
+  -DLZMA_INCLUDE_PATH:PATH=${DEPSDIR}/include \
+  -DLZMA_LIBRARY:FILEPATH=${DEPSDIR}/lib/liblzma.a \
+  -DBZIP2_INCLUDE_DIR:PATH=${DEPSDIR}/include \
+  -DBZIP2_LIBRARIES:FILEPATH=${DEPSDIR}/lib/libbz2.a \
+  -DLibFFI_INCLUDE_DIR:PATH=${DEPSDIR}/include \
+  -DLibFFI_LIBRARY:FILEPATH=${DEPSDIR}/lib/libffi.a \
+  -DREADLINE_INCLUDE_PATH:FILEPATH=${DEPSDIR}/include/readline/readline.h \
+  -DREADLINE_LIBRARY:FILEPATH=${DEPSDIR}/lib/libreadline.a \
+  -DUUID_LIBRARY:FILEPATH=${DEPSDIR}/lib/libuuid.a \
+  -DCURSES_LIBRARIES:FILEPATH=${DEPSDIR}/lib/libncurses.a \
+  -DPANEL_LIBRARIES:FILEPATH=${DEPSDIR}/lib/libpanel.a \
+  -DGDBM_INCLUDE_PATH:FILEPATH=${DEPSDIR}/include/gdbm.h \
+  -DGDBM_LIBRARY:FILEPATH=${DEPSDIR}/lib/libgdbm.a \
+  -DGDBM_COMPAT_LIBRARY:FILEPATH=${DEPSDIR}/lib/libgdbm_compat.a \
+  -DNDBM_TAG=NDBM \
+  -DTK_INCLUDE_PATH:FILEPATH=${DEPSDIR}/include/tk.h \
+  -DTK_LIBRARY:FILEPATH=${DEPSDIR}/lib/libtk8.6.a \
+  -DTCL_INCLUDE_PATH:FILEPATH=${DEPSDIR}/include/tcl.h \
+  -DTCL_LIBRARY:FILEPATH=${DEPSDIR}/lib/libtcl8.6.a \
+  -DX11_INCLUDE_DIR:PATH=${DEPSDIR}/include/X11 \
+  -DX11_LIBRARIES="${DEPSDIR}/lib/libXau.a;${DEPSDIR}/lib/libXdmcp.a;${DEPSDIR}/lib/libX11.a;${DEPSDIR}/lib/libXext.a;${DEPSDIR}/lib/libICE.a;${DEPSDIR}/lib/libSM.a;${DEPSDIR}/lib/libXrender.a;${DEPSDIR}/lib/libXft.a;${DEPSDIR}/lib/libXss.a;${DEPSDIR}/lib/libxcb.a" \
+  ../python-cmake-buildsystem
+make -j4
+make install
+
+cd ${BUILDDIR}
+cp -r ${DEPSDIR}/lib/tcl8.6 ./python-install/lib
+cp -r ${DEPSDIR}/lib/tk8.6 ./python-install/lib
+
+echo "::endgroup::"
+#############################################
+# Check executable dependencies (pre-patch) #
+#############################################
+echo "::group::Check executable dependencies (pre-patch)"
+cd ${BUILDDIR}
+
+cd python-install
+echo "python dependencies"
+readelf -d ./bin/python
+echo
+echo "libpython dependencies"
+readelf -d ./lib/libpython${PYTHON_VER}.so
+
+echo "::endgroup::"
+################
+# Patch python #
+################
+echo "::group::Patch python"
+cd ${BUILDDIR}
+
+cd python-install
+${WORKDIR}/scripts/patch_libpython.sh ./lib/libpython${PYTHON_VER}.so ./bin/python
+patchelf --replace-needed libpython${PYTHON_VER}.so "\$ORIGIN/../lib/libpython${PYTHON_VER}.so" ./bin/python
+
+echo "::endgroup::"
+##############################################
+# Check executable dependencies (post-patch) #
+##############################################
+echo "::group::Check executable dependencies (post-patch)"
+cd ${BUILDDIR}
+
+cd python-install
+# we don't make ldd errors fatal here since ldd doesn't work
+# when cross compiling
+echo "python dependencies"
+ldd -v -r ./bin/python || true
+echo
+echo "libpython dependencies"
+ldd -v -r ./lib/libpython${PYTHON_VER}.so || true
+
+echo "::endgroup::"
+###############
+# Test python #
+###############
+echo "::group::Test python"
+cd ${BUILDDIR}
+
+cd python-install
+qemu-${ARCH}-static ./bin/python --version
+
+echo "::endgroup::"
+###############
+# Preload pip #
+###############
+echo "::group::Preload pip"
+cd ${BUILDDIR}
+
+cd python-install
+qemu-${ARCH}-static ./bin/python -m ensurepip
+
+echo "::endgroup::"
+###################
+# Compress output #
+###################
+echo "::group::Compress output"
+cd ${BUILDDIR}
+
+python3 -m pip install pyclean
+python3 -m pyclean -v python-install
+mv python-install python-${PYTHON_FULL_VER}-linux-${ARCH}
+tar -czf ${WORKDIR}/python-${PYTHON_FULL_VER}-linux-${ARCH}.tar.gz python-${PYTHON_FULL_VER}-linux-${ARCH}
+zip ${WORKDIR}/python-${PYTHON_FULL_VER}-linux-${ARCH}.zip $(tar tf ${WORKDIR}/python-${PYTHON_FULL_VER}-linux-${ARCH}.tar.gz)
+
+echo "::endgroup::"
diff --git a/scripts/build_macos.sh b/scripts/build_macos.sh
index f23d2fba..1c7586d3 100755
--- a/scripts/build_macos.sh
+++ b/scripts/build_macos.sh
@@ -1,10 +1,9 @@
 #!/bin/bash
 
-ARCH=$1
-PYTHON_FULL_VER=$2
-PYTHON_VER=$(echo ${PYTHON_FULL_VER} | cut -d "." -f 1-2)
+PLATFORM=darwin
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+source ${SCRIPT_DIR}/utils.sh
 
-WORKDIR=$(pwd)
 NPROC=$(sysctl -n hw.ncpu)
 
 set -ex
@@ -20,8 +19,7 @@ mkdir deps
 
 export MACOSX_DEPLOYMENT_TARGET=10.5
 
-git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch python3.10 --single-branch --depth 1
-#git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch macos-arm64 --single-branch --depth 1
+git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch portable-python --single-branch --depth 1
 
 echo "::endgroup::"
 ###########
@@ -30,8 +28,7 @@ echo "::endgroup::"
 echo "::group::OpenSSL"
 cd ${WORKDIR}
 
-wget -q https://www.openssl.org/source/openssl-1.1.1w.tar.gz
-tar -xf openssl-1.1.1w.tar.gz
+download_verify_extract openssl-1.1.1w.tar.gz
 
 mkdir deps/openssl
 cd openssl-1.1.1w
@@ -100,10 +97,9 @@ echo "::endgroup::"
 echo "::group::sqlite3"
 cd ${WORKDIR}
 
-wget -q https://www.sqlite.org/2023/sqlite-autoconf-3430100.tar.gz
-tar -xf sqlite-autoconf-3430100.tar.gz
+download_verify_extract sqlite-autoconf-3450000.tar.gz
 mkdir deps/sqlite3
-cd sqlite-autoconf-3430100
+cd sqlite-autoconf-3450000
 CC=clang CFLAGS="-arch x86_64 -arch arm64" ./configure --prefix ${WORKDIR}/deps/sqlite3
 make -j${NPROC}
 make install
@@ -117,10 +113,9 @@ echo "::endgroup::"
 echo "::group::zlib"
 cd ${WORKDIR}
 
-curl -L https://zlib.net/fossils/zlib-1.3.tar.gz --output zlib.tar.gz
-tar -xf zlib.tar.gz
+download_verify_extract zlib-1.3.1.tar.gz
 mkdir deps/zlib
-cd zlib-1.3
+cd zlib-1.3.1
 mkdir build
 cd build
 cmake \
@@ -180,8 +175,8 @@ cmake \
   -DCMAKE_INSTALL_PREFIX:PATH=${WORKDIR}/python-install \
   -DBUILD_EXTENSIONS_AS_BUILTIN=OFF \
   -DBUILD_LIBPYTHON_SHARED=ON \
-  -DBUILD_TESTING=ON \
-  -DINSTALL_TEST=OFF \
+  -DBUILD_TESTING=${INSTALL_TEST} \
+  -DINSTALL_TEST=${INSTALL_TEST} \
   -DINSTALL_MANUAL=OFF \
   -DOPENSSL_ROOT_DIR:PATH=${WORKDIR}/deps/openssl \
   -DSQLite3_INCLUDE_DIR:PATH=${WORKDIR}/deps/sqlite3/include \
diff --git a/scripts/build_windows.sh b/scripts/build_windows.sh
index 31196580..f844c020 100755
--- a/scripts/build_windows.sh
+++ b/scripts/build_windows.sh
@@ -1,11 +1,8 @@
 #!/bin/bash
 
-ARCH=$1
-PYTHON_FULL_VER=$2
-
-WORKDIR=$(pwd)
-
-set -ex
+PLATFORM=windows
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+source ${SCRIPT_DIR}/utils.sh
 
 ##############
 # Initialize #
@@ -16,8 +13,7 @@ mkdir python-build
 mkdir python-install
 mkdir deps
 
-git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch python3.10 --single-branch --depth 1
-#git clone https://github.com/python-cmake-buildsystem/python-cmake-buildsystem.git
+git clone https://github.com/bjia56/python-cmake-buildsystem.git --branch portable-python --single-branch --depth 1
 
 echo "::endgroup::"
 ###########
@@ -75,8 +71,8 @@ echo "::endgroup::"
 echo "::group::sqlite3"
 cd ${WORKDIR}
 
-curl -L https://www.sqlite.org/2023/sqlite-amalgamation-3430100.zip --output sqlite3-src.zip
-unzip -qq sqlite3-src.zip
+download_and_verify sqlite-amalgamation-3430100.zip
+unzip -qq sqlite-amalgamation-3430100.zip
 mv sqlite-amalgamation-3430100 deps/sqlite3
 cd deps/sqlite3
 cl //c sqlite3.c
@@ -89,10 +85,9 @@ echo "::endgroup::"
 echo "::group::zlib"
 cd ${WORKDIR}
 
-curl -L https://zlib.net/fossils/zlib-1.3.tar.gz --output zlib.tar.gz
-tar -xf zlib.tar.gz
+download_verify_extract zlib-1.3.1.tar.gz
 mkdir deps/zlib
-cd zlib-1.3
+cd zlib-1.3.1
 mkdir build
 cd build
 cmake \
@@ -137,8 +132,8 @@ cmake \
   -DCMAKE_INSTALL_PREFIX:PATH=${WORKDIR}/python-install \
   -DBUILD_EXTENSIONS_AS_BUILTIN=OFF \
   -DBUILD_LIBPYTHON_SHARED=ON \
-  -DBUILD_TESTING=ON \
-  -DINSTALL_TEST=OFF \
+  -DBUILD_TESTING=${INSTALL_TEST} \
+  -DINSTALL_TEST=${INSTALL_TEST} \
   -DINSTALL_MANUAL=OFF \
   -DBUILD_WININST=OFF \
   -DINSTALL_WINDOWS_TRADITIONAL:BOOL=OFF \
diff --git a/scripts/qemu_aarch64_interpreter b/scripts/qemu_aarch64_interpreter
new file mode 100755
index 00000000..0968b059
--- /dev/null
+++ b/scripts/qemu_aarch64_interpreter
@@ -0,0 +1,15 @@
+#!/bin/bash
+# this interpreter shim is used by cmake to run platform
+# detection programs
+
+# we need to ensure that the binary uses the correct libc
+# so first patch the program
+patchelf --add-rpath /usr/aarch64-linux-gnu/lib/ $1
+patchelf --add-needed libm.so.6 $1
+patchelf --add-needed libpthread.so.0 $1
+patchelf --add-needed libdl.so.2 $1
+patchelf --add-needed libutil.so.1 $1
+patchelf --add-needed librt.so.1 $1
+
+# run the interpreter
+qemu-aarch64-static "$@"
diff --git a/scripts/qemu_x86_64_interpreter b/scripts/qemu_x86_64_interpreter
new file mode 100755
index 00000000..c1e54a20
--- /dev/null
+++ b/scripts/qemu_x86_64_interpreter
@@ -0,0 +1,10 @@
+#!/bin/bash
+# this interpreter shim is used by cmake to run platform
+# detection programs
+
+# we need to ensure that the binary uses the correct libc
+# so first patch the program
+patchelf --add-rpath /usr/x86_64-linux-gnu/lib/ $1
+
+# run the interpreter
+qemu-x86_64-static "$@"
\ No newline at end of file
diff --git a/scripts/utils.sh b/scripts/utils.sh
new file mode 100644
index 00000000..38c83d67
--- /dev/null
+++ b/scripts/utils.sh
@@ -0,0 +1,42 @@
+#!/bin/bash
+
+set -e
+
+SCRIPT_DIR="$(dirname "$(readlink -f "$0")")"
+
+function verify_checksum () {
+  file="$1"
+  filename=$(basename $file)
+  sha256sum -c ${SCRIPT_DIR}/../checksums/$file.sha256
+}
+
+function download_and_verify () {
+  file="$1"
+  curl -s -S -f -L -o $file https://github.com/bjia56/portable-python/releases/download/build-dependencies/$file
+  verify_checksum $file
+}
+
+function download_verify_extract () {
+  file="$1"
+  download_and_verify $file
+  tar -xf $file
+  rm $file
+}
+
+ARCH=$1
+PYTHON_FULL_VER=$2
+PYTHON_VER=$(echo ${PYTHON_FULL_VER} | cut -d "." -f 1-2)
+
+WORKDIR=$(pwd)
+BUILDDIR=${WORKDIR}/build
+DEPSDIR=${WORKDIR}/deps
+
+if [[ "${RUN_TESTS}" == "true" ]]; then
+  INSTALL_TEST="ON"
+else
+  INSTALL_TEST="OFF"
+fi
+
+if [[ "${DEBUG_CI}" == "true" ]]; then
+  trap "cd ${BUILDDIR} && tar -czf ${WORKDIR}/build-python-${PYTHON_FULL_VER}-${PLATFORM}-${ARCH}.tar.gz ." EXIT
+fi
diff --git a/zigshim/zig_ar b/zigshim/zig_ar
new file mode 100755
index 00000000..80b2e84f
--- /dev/null
+++ b/zigshim/zig_ar
@@ -0,0 +1,2 @@
+#!/bin/bash
+zig ar "$@"
\ No newline at end of file
diff --git a/zigshim/zig_cc b/zigshim/zig_cc
new file mode 100755
index 00000000..5e5302c2
--- /dev/null
+++ b/zigshim/zig_cc
@@ -0,0 +1,2 @@
+#!/bin/bash
+zig cc -target $ZIG_TARGET "$@"
\ No newline at end of file
diff --git a/zigshim/zig_cxx b/zigshim/zig_cxx
new file mode 100755
index 00000000..15fd2e9f
--- /dev/null
+++ b/zigshim/zig_cxx
@@ -0,0 +1,2 @@
+#!/bin/bash
+zig c++ -target $ZIG_TARGET "$@"
\ No newline at end of file