diff --git a/CHANGELOG.md b/CHANGELOG.md
index c97c20f0c..287c105c2 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,9 @@
+# tectonic 0.1.14 (2020-09-08)
+
+- No code changes from 0.1.13. Just trying to iron out some of the automated
+  deployment systems. Is this the time that the Arch Linux auto-deployment
+  finally works??
+
 # tectonic 0.1.13 (2020-09-07)
 
 It has once more been a long time since the last release. But this new release
diff --git a/Cargo.lock b/Cargo.lock
index 18750a137..27caf743a 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -15,6 +15,12 @@ version = "0.2.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ee2a4ec343196209d6594e19543ae87a39f96d5534d7174822a3ad825dd6ed7e"
 
+[[package]]
+name = "adler32"
+version = "1.2.0"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "aae1277d39aeec15cb388266ecc24b11c80469deae6067e17a1a7aa9e5c1f234"
+
 [[package]]
 name = "aho-corasick"
 version = "0.7.13"
@@ -89,7 +95,7 @@ dependencies = [
  "addr2line",
  "cfg-if",
  "libc",
- "miniz_oxide",
+ "miniz_oxide 0.4.1",
  "object",
  "rustc-demangle",
 ]
@@ -376,9 +382,9 @@ checksum = "cd56b59865bce947ac5958779cfa508f6c3b9497cc762b7e24a12d11ccde2c4f"
 
 [[package]]
 name = "encoding_rs"
-version = "0.8.23"
+version = "0.8.24"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e8ac63f94732332f44fe654443c46f6375d1939684c17b0afb6cb56b0456e171"
+checksum = "a51b8cf747471cb9499b6d59e59b0444f4c90eba8968c4e44874e92b5b64ace2"
 dependencies = [
  "cfg-if",
 ]
@@ -423,15 +429,15 @@ checksum = "e88a8acf291dafb59c2d96e8f59828f3838bb1a70398823ade51a84de6a6deed"
 
 [[package]]
 name = "flate2"
-version = "1.0.17"
+version = "1.0.14"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "766d0e77a2c1502169d4a93ff3b8c15a71fd946cd0126309752104e5f3c46d94"
+checksum = "2cfff41391129e0a856d6d822600b8d71179d46879e310417eb9c762eb178b42"
 dependencies = [
  "cfg-if",
  "crc32fast",
  "libc",
  "libz-sys",
- "miniz_oxide",
+ "miniz_oxide 0.3.7",
 ]
 
 [[package]]
@@ -530,7 +536,7 @@ checksum = "7abc8dd8451921606d809ba32e95b6111925cd2906060d2dcc29c070220503eb"
 dependencies = [
  "cfg-if",
  "libc",
- "wasi",
+ "wasi 0.9.0+wasi-snapshot-preview1",
 ]
 
 [[package]]
@@ -559,12 +565,9 @@ dependencies = [
 
 [[package]]
 name = "hashbrown"
-version = "0.8.2"
+version = "0.9.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "e91b62f79061a0bc2e046024cb7ba44b08419ed238ecbd9adbd787434b9e8c25"
-dependencies = [
- "autocfg 1.0.1",
-]
+checksum = "00d63df3d41950fb462ed38308eea019113ad1508da725bbedcd0fa5a85ef5f7"
 
 [[package]]
 name = "headers"
@@ -706,9 +709,9 @@ dependencies = [
 
 [[package]]
 name = "indexmap"
-version = "1.5.1"
+version = "1.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "86b45e59b16c76b11bf9738fd5d38879d3bd28ad292d7b313608becb17ae2df9"
+checksum = "55e2e4c765aa53a0424761bf9f41aa7a6ac1efa87238f59560640e27fca028f2"
 dependencies = [
  "autocfg 1.0.1",
  "hashbrown",
@@ -773,11 +776,12 @@ checksum = "755456fae044e6fa1ebbbd1b3e902ae19e73097ed4ed87bb79934a867c007bc3"
 
 [[package]]
 name = "libz-sys"
-version = "1.1.0"
+version = "1.1.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "af67924b8dd885cccea261866c8ce5b74d239d272e154053ff927dae839f5ae9"
+checksum = "602113192b08db8f38796c4e85c39e960c145965140e918018bcde1952429655"
 dependencies = [
  "cc",
+ "libc",
  "pkg-config",
  "vcpkg",
 ]
@@ -854,6 +858,15 @@ dependencies = [
  "unicase",
 ]
 
+[[package]]
+name = "miniz_oxide"
+version = "0.3.7"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "791daaae1ed6889560f8c4359194f56648355540573244a5448a83ba1ecc7435"
+dependencies = [
+ "adler32",
+]
+
 [[package]]
 name = "miniz_oxide"
 version = "0.4.1"
@@ -1092,12 +1105,6 @@ version = "0.3.18"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "d36492546b6af1463394d46f0c834346f31548646f6ba10849802c9c9a27ac33"
 
-[[package]]
-name = "podio"
-version = "0.1.7"
-source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "b18befed8bc2b61abc79a457295e7e838417326da1586050b919414073977f19"
-
 [[package]]
 name = "ppv-lite86"
 version = "0.2.9"
@@ -1139,9 +1146,9 @@ dependencies = [
 
 [[package]]
 name = "proc-macro2"
-version = "1.0.19"
+version = "1.0.20"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "04f5f085b5d71e2188cb8271e5da0161ad52c3f227a661a3c135fdf28e258b12"
+checksum = "175c513d55719db99da20232b06cda8bab6b83ec2d04e3283edf0213c37c1a29"
 dependencies = [
  "unicode-xid",
 ]
@@ -1599,9 +1606,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "1.0.39"
+version = "1.0.40"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "891d8d6567fe7c7f8835a3a98af4208f3846fba258c1bc3c31d6e506239f11f9"
+checksum = "963f7d3cc59b59b9325165add223142bbf1df27655d07789f109896d353d8350"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -1622,7 +1629,7 @@ dependencies = [
 
 [[package]]
 name = "tectonic"
-version = "0.1.13"
+version = "0.1.14"
 dependencies = [
  "app_dirs2",
  "byte-unit",
@@ -1700,6 +1707,26 @@ dependencies = [
  "unicode-width",
 ]
 
+[[package]]
+name = "thiserror"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "7dfdd070ccd8ccb78f4ad66bf1982dc37f620ef696c6b5028fe2ed83dd3d0d08"
+dependencies = [
+ "thiserror-impl",
+]
+
+[[package]]
+name = "thiserror-impl"
+version = "1.0.20"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "bd80fc12f73063ac132ac92aceea36734f04a1d93c1240c6944e23a3b8841793"
+dependencies = [
+ "proc-macro2",
+ "quote",
+ "syn",
+]
+
 [[package]]
 name = "thread_local"
 version = "1.0.1"
@@ -1711,11 +1738,12 @@ dependencies = [
 
 [[package]]
 name = "time"
-version = "0.1.43"
+version = "0.1.44"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "ca8a50ef2360fbd1eeb0ecd46795a87a19024eb4b53c5dc916ca1fd95fe62438"
+checksum = "6db9e6914ab8b1ae1c260a4ae7a49b6c5611b40328a735b21862567685e73255"
 dependencies = [
  "libc",
+ "wasi 0.10.0+wasi-snapshot-preview1",
  "winapi 0.3.9",
 ]
 
@@ -2091,6 +2119,12 @@ version = "0.9.0+wasi-snapshot-preview1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "cccddf32554fecc6acb585f82a32a72e28b48f8c4c1883ddfeeeaa96f7d8e519"
 
+[[package]]
+name = "wasi"
+version = "0.10.0+wasi-snapshot-preview1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "1a143597ca7c7793eff794def352d41792a93c481eb1042423ff7ff72ba2c31f"
+
 [[package]]
 name = "winapi"
 version = "0.2.8"
@@ -2161,11 +2195,12 @@ checksum = "d089681aa106a86fade1b0128fb5daf07d5867a509ab036d99988dec80429a57"
 
 [[package]]
 name = "zip"
-version = "0.5.6"
+version = "0.5.7"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "58287c28d78507f5f91f2a4cf1e8310e2c76fd4c6932f93ac60fd1ceb402db7d"
+checksum = "d30de6e58104bb7b9a94f34b52a2bdabb8a40b678a64201cd0069e3d7119b5ff"
 dependencies = [
+ "byteorder",
  "crc32fast",
  "flate2",
- "podio",
+ "thiserror",
 ]
diff --git a/Cargo.toml b/Cargo.toml
index 5bb153a13..913cc09c1 100644
--- a/Cargo.toml
+++ b/Cargo.toml
@@ -4,7 +4,7 @@
 
 [package]
 name = "tectonic"
-version = "0.1.13"
+version = "0.1.14"
 authors = ["Peter Williams <peter@newton.cx>"]
 build = "build.rs"
 description = """
diff --git a/RELEASE_PROCESS.md b/RELEASE_PROCESS.md
index ceaeac0f1..2bd6ef752 100644
--- a/RELEASE_PROCESS.md
+++ b/RELEASE_PROCESS.md
@@ -1,63 +1,16 @@
 # Releasing New Versions of Tectonic
 
+The new goal is to automate as much of this process as possible with [Cranko].
+Here are some notes that might still be helpful even in the Cranko world, though.
+
+[Cranko]: https://pkgw.github.io/cranko/
+
 1. Announce intention to make a release.
-2. Review outstanding pull requests and issues for showstoppers or easy wins.
+1. Review outstanding pull requests and issues for showstoppers or easy wins.
    Address as many as possible.
-3. Fetch from `tectonic-typesetting` and create a new branch `release-X.Y.Z`
-   from `master`.
-4. Update deps: `cargo update && cargo test --all`, then commit changes.
-5. Check Arch Linux PKGBUILD file for updates and merge locally if necessary:
+1. Check if worth bulk-updating deps: `cargo update`
+1. Check Arch Linux PKGBUILD file for updates to keep:
    ```
    curl 'https://aur.archlinux.org/cgit/aur.git/plain/PKGBUILD?h=tectonic' >dist/arch/PKGBUILD
    ```
-6. Consider updating the mdbook version used in `dist/build-mdbook.sh`;
-   [releases listed here](https://github.com/rust-lang/mdBook/releases).
-7. Backfill `CHANGELOG.md` from the Git history (which will include GitHub PR
-   numbers, etc.) To view the history while skipping dependabot commits:
-   ```
-   git log --perl-regexp --author='^((?!dependabot).*)$' v${CURRENT_VERSION}..
-   ```
-8. Update version number(s):
-   - Main version in `Cargo.toml`
-   - Un-bump versions of crates like `tectonic_xdv` if they haven't updated.
-   - `cargo build --release` to update `Cargo.lock` as well.
-   Commit with message `Tentative version $version`
-9. Push to GitHub and create a pull request.
-10. Examine the CI output. Fix any failures, committing any changes and
-    re-pushing. No need to rewrite history at this juncture.
-11. `mkdir ~/tectonictmp; mv .envrc target $other_files ~/tectonictmp ; git clean -fxd`
-12. Attempt to `cargo publish`. Fix anything that needs fixing, committing
-    changes.
-13. Do a `git rebase -i` to rewrite the history to make the version-bump
-    commit the most recent one, rewording its commit message to remove the
-    "Tentative". Re-push and re-CI if anything changed that might affect the
-    build.
-14. Download the new package from
-    <https://crates.io/api/v1/crates/tectonic/$version/download>. Put its
-    sha512 sum into `dist/arch/PKGBULD` and update the package version and
-    release in that file. Rewrite the version-bump commit to include the
-    changes (`git commit --amend -C HEAD`).
-15. `git tag v${version}` and, if necessary, `git tag submodule-v${version}`.
-16. Back to development:
-    - Bump main version in `Cargo.toml` and crates like `tectonic_xdv`.
-    - `cargo build` to update the lockfile
-    - Commit with message `Back to development, version $version`.
-17. Re-push to the release PR branch and wait for CI.
-18. Merge, assuming nothing bad happened with the CI.
-19. Pull the new `master` locally to get GitHub’s merge commit.
-20. `git push --tags`, which should trigger some automated release processes.
-    Monitor them.
-21. Create new release on GitHub, filling with contents of `CHANGELOG.md`.
-22. Update
-    [conda-forge package](https://github.com/conda-forge/tectonic-feedstock) —
-    the bot should notice the new version on Crates.io and automatically file
-    a pull request quickly.
-23. Announce on forum.
-24. Update website.
-
-
-### To check
-
-- Do we need to take any further steps to release the AppImage?
-- Uploading artifacts like static binaries to the GitHub release
-- `cargo publish` from CI, not manually (need some way to test-publish first).
+1. Announce on forum.
diff --git a/cfg_support/CHANGELOG.md b/cfg_support/CHANGELOG.md
new file mode 100644
index 000000000..c27274410
--- /dev/null
+++ b/cfg_support/CHANGELOG.md
@@ -0,0 +1,8 @@
+# See elsewhere for changelog
+
+This project’s release notes are curated from the Git history of its main
+branch. You can find them by looking at [the version of this file on the
+`release` branch][branch] or the [GitHub release history][gh-releases].
+
+[branch]: https://github.com/tectonic-typesetting/tectonic/blob/release/cfg_support/CHANGELOG.md
+[gh-releases]: https://github.com/tectonic-typesetting/tectonic/releases
diff --git a/dist/add-github-release-artifact.sh b/dist/add-github-release-artifact.sh
deleted file mode 100755
index b7988d48d..000000000
--- a/dist/add-github-release-artifact.sh
+++ /dev/null
@@ -1,141 +0,0 @@
-#! /bin/bash
-# Copyright 2019 the Tectonic Project
-# Licensed under the MIT License.
-
-# Upload one or more files to be artifacts associated with the named release
-# on GitHub. If the named release does not already exist, it is created.
-#
-# Arguments:
-#
-# -t RELEASE-TITLE -- use this as the release title; defaults to the release tag name
-# -p               -- mark the release as a prerelease
-# -d DESCRIPTION   -- use DESCRIPTION as the release description; defaults to
-#                     brief text describing the origin commit
-# $1               -- the release tag name
-# $2...            -- paths to artifacts (files) to attach to the release
-#
-# Environment variables:
-#
-# $GITHUB_TOKEN -- the API token for talking to GitHub
-# $TRAVIS_REPO_SLUG -- the "repo slug" (e.g. "tectonic-typesetting/tectonic") we're building
-
-set -o pipefail
-set -e
-
-is_prerelease=false
-
-while getopts ":d:pt:" opt; do
-    case $opt in
-        d)
-            description="$OPTARG" ;;
-        p)
-            is_prerelease=true ;;
-        t)
-            release_title="$OPTARG" ;;
-        \?)
-            echo >&2 "error: unexpected option -$OPTARG"
-            exit 1 ;;
-        :)
-            echo >&2 "error: -$OPTARG requires an argument"
-            exit 1 ;;
-    esac
-done
-
-shift $((OPTIND - 1))
-
-release_tag="$1"
-shift
-
-if [ -z "$release_tag" ] ; then
-    echo >&2 "error: no release tag name specified"
-    exit 1
-fi
-
-if [ -z "$release_title" ] ; then
-    release_title="$release_tag"
-fi
-
-if [ -z "$1" ] ; then
-    echo >&2 "error: must specify at least file to upload"
-    exit 1
-fi
-
-# OK. Arguments done. Environment variables?
-
-if [ -z "$GITHUB_TOKEN" ] ; then
-    echo >&2 "error: no GITHUB_TOKEN environment variable"
-    exit 1
-fi
-
-curl=(
-    curl
-    -s
-    --header "Authorization: token ${GITHUB_TOKEN}"
-)
-
-if [ -z "$TRAVIS_REPO_SLUG" ] ; then
-    echo >&2 "error: no TRAVIS_REPO_SLUG environment variable"
-    exit 1
-fi
-
-api_base_url="https://api.github.com/repos/$TRAVIS_REPO_SLUG"
-
-echo "info: adding artifacts to release $TRAVIS_REPO_SLUG:$release_tag"
-
-if [ -z "$description" ] ; then
-    description="Autogenerated release."
-fi
-
-if ! type jql >/dev/null 2>&1 ; then
-    echo "info: installing jql"
-    cargo install -q --force jql
-fi
-
-# Finally ready to actually do something. Get the upload URL if the release
-# exists.
-
-upload_url=$(
-    "${curl[@]}" -XGET "$api_base_url/releases/tags/$release_tag" | \
-        jql '"upload_url"' | \
-        sed -e 's|"||g' -e 's|{.*||'
-)
-
-# If that didn't work we assume that we need to create the release. There's a
-# race condition here, but I don't know how to avoid it. We can't create it as
-# a draft because the tag-based query above doesn't return information for
-# draft releases.
-
-if [ -z "$upload_url" ] ; then
-    echo "info: creating release for tag $release_tag"
-    release_json='{
-  "tag_name": "'"$release_tag"'",
-  "name": "'"$release_title"'",
-  "body": "'"$description"'",
-  "draft": false,
-  "prerelease": '$is_prerelease'
-}'
-
-    upload_url=$(
-    "${curl[@]}" --data "$release_json" "$api_base_url/releases" | \
-        jql '"upload_url"' | \
-        sed -e 's|"||g' -e 's|{.*||'
-    )
-fi
-
-# Actually upload the files.
-
-while [ $# -gt 0 ] ; do
-    path="$1"
-    shift
-
-    url=$(
-        "${curl[@]}" \
-            --header "Accept: application/vnd.github.manifold-preview" \
-            --header "Content-Type: application/octet-stream" \
-            --data-binary @"$path" \
-            "$upload_url?name=$(basename "$path")" | \
-        jql '"url"' | \
-        sed -e 's|"||g'
-    )
-    echo "info: $path -> $url"
-done
diff --git a/dist/arch/PKGBUILD b/dist/arch/PKGBUILD.in
similarity index 73%
rename from dist/arch/PKGBUILD
rename to dist/arch/PKGBUILD.in
index 303ab85a9..498bcb5bf 100644
--- a/dist/arch/PKGBUILD
+++ b/dist/arch/PKGBUILD.in
@@ -4,14 +4,13 @@
 
 # The master version of this file is maintained here:
 #
-#   https://github.com/tectonic-typesetting/tectonic/blob/master/dist/arch/PKGBUILD
+#   https://github.com/tectonic-typesetting/tectonic/blob/master/dist/arch/PKGBUILD.in
 #
-# The version on aur.archlinux.org is updated automatically through a Travis
-# CI deploy script that's invoked when new tags are pushed to the GitHub
-# tectonic repository.
+# The version on aur.archlinux.org is updated automatically by the Tectonic
+# CI/CD system # when new versions are released.
 
 pkgname=tectonic
-pkgver=0.1.12
+pkgver=@version@
 pkgrel=0
 arch=('x86_64')
 pkgdesc='Modernized, complete, self-contained TeX/LaTeX engine, powered by XeTeX and TeXLive'
@@ -20,7 +19,7 @@ license=('MIT')
 depends=('fontconfig' 'harfbuzz-icu' 'openssl')
 makedepends=('rust')
 source=("$pkgname-$pkgver.tar.gz::https://crates.io/api/v1/crates/$pkgname/$pkgver/download")
-sha512sums=('837f38346d6b2c07d960d087f7eda1a0ca57735e18a71f956010c59bf9a45628ce40b4efc541f0b69cefe35261ffeb7d44e941448f5c550aeba3782f8b9d903b')
+sha512sums=('@sha512@')
 
 build() {
 	cd $pkgname-$pkgver
diff --git a/dist/arch/deploy.sh b/dist/arch/deploy.sh
index 9cb1277e3..74397faae 100755
--- a/dist/arch/deploy.sh
+++ b/dist/arch/deploy.sh
@@ -1,32 +1,43 @@
-#!/bin/bash
+#! /usr/bin/env bash
+# Copyright 2018-2020 the Tectonic Project
+# Licensed under the MIT license
 
-set -ex
+# Auto-update the Arch Linux AUR repo for Tectonic. This script is invoked in
+# the CI/CD pipeline when a new release of the main Tectonic package has been
+# made. It must be called *after* the Crates.io package has been updated.
+
+set -xeuo pipefail
 cd "$(dirname $0)"
-keypath="$1"
-release_desc="$2"
+
+if [ ! -f deploy_key ] ; then
+  echo >&2 "error: the deploy_key file must be created by the CI system"
+  exit 1
+fi
+
+# Get the settings that we need
+version="$(cranko show version tectonic)"
+url="https://crates.io/api/v1/crates/tectonic/$version/download" -O tectonic.crate.gz
+wget -q --progress=dot "$url"
+sha512="$(sha512sum tectonic.crate.gz |cut -d' ' -f1)"
 
 # Set up to run makepkg
-wget https://www.archlinux.org/packages/core/x86_64/pacman/download/ -O pacman.pkg.tar.xz
-tar -Jxf pacman.pkg.tar.xz
+wget https://www.archlinux.org/packages/core/x86_64/pacman/download/ -O pacman.pkg.tar.zst
+tar -I zstd -xf pacman.pkg.tar.zst
 bindir="$(pwd)/usr/bin"
 export PATH="$bindir:$PATH"
 export LIBRARY="$(pwd)/usr/share/makepkg"
 config="$(pwd)/etc/makepkg.conf"
 
 # Get the repo
-git config --global --add core.sshCommand "ssh -o StrictHostKeyChecking=false -i $keypath"
+export GIT_SSH_COMMAND="ssh -o UserKnownHostsFile=/dev/null -o StrictHostKeyChecking=no -i $(pwd)/deploy_key"
 git clone ssh://aur@aur.archlinux.org/tectonic.git aur
 
 # Update it
-cp PKGBUILD aur
+sed -e "s|@version@|$version|g" -e "s|@sha512@|$sha512|g" PKGBUILD.in >aur/PKGBUILD
 cd aur
 /bin/bash "$bindir/makepkg" --config="$config" --printsrcinfo >.SRCINFO
-
-# Commit
 git add PKGBUILD .SRCINFO
-git config user.email "tectonic-deploy@example.com"
-git config user.name "tectonic-deploy"
-git commit -m "Release $release_desc"
+git commit -m "Release $version"
 
 # Deploy to AUR
 git push origin master
diff --git a/dist/azure-deployment.yml b/dist/azure-deployment.yml
index 0f43d7594..528492d15 100644
--- a/dist/azure-deployment.yml
+++ b/dist/azure-deployment.yml
@@ -157,10 +157,18 @@ steps:
   # the toplevel project was made:
   - bash: |
       set -xeuo pipefail
-      keypath=$(mktemp)
-      echo "$ARCHLINUX_DEPLOY_KEY_BASE64" |base64 -d >"$keypath"
-      bash dist/arch/deploy.sh "$keypath" "$(cranko show version tectonic)"
+      cranko ci-util env-to-file --decode=base64 ARCHLINUX_DEPLOY_KEY_BASE64 dist/arch/deploy_key
+      bash dist/arch/deploy.sh
+      shred dist/arch/deploy_key
     displayName: Update ArchLinux package
     condition: and(succeeded(), ne(variables['TOPLEVEL_MODE'], 'skip'))
     env:
       ARCHLINUX_DEPLOY_KEY_BASE64: $(ARCHLINUX_DEPLOY_KEY_BASE64)
+
+  - bash: |
+      set -xeuo pipefail
+      bash dist/update-website.sh
+    displayName: Update GitHub Pages website
+    condition: and(succeeded(), ne(variables['TOPLEVEL_MODE'], 'skip'))
+    env:
+      GITHUB_TOKEN: $(GITHUB_TOKEN)
diff --git a/dist/build-mdbook.sh b/dist/build-mdbook.sh
deleted file mode 100755
index d5a8e0c9c..000000000
--- a/dist/build-mdbook.sh
+++ /dev/null
@@ -1,51 +0,0 @@
-#! /bin/bash
-# Copyright 2019 The Tectonic Project
-# Licensed under the MIT License.
-
-# A helper script to build a book built via the [mdbook] documentation
-# program.
-#
-# [mdbook]: https://rust-lang-nursery.github.io/mdBook/
-#
-# Arguments:
-#
-# $1 - path to the mdbook directory in this project, relative to PWD
-
-set -e
-
-# Parameters
-
-src_path="$1"
-
-# Configuration that we expect to be stable.
-
-mdbook_version=0.3.5
-ci_platform=x86_64-unknown-linux-gnu
-mdbook_binary_fn="mdbook-v${mdbook_version}-${ci_platform}.tar.gz"
-mdbook_binary_url="https://github.com/rust-lang-nursery/mdBook/releases/download/v${mdbook_version}/${mdbook_binary_fn}"
-mdbook_binary_sha256=e03cc253650fa0b4780fab4d75df64c48d35d48f452fcf61c5ec0ae652f9bd8e
-
-# Get an mdbook executable. If we end up with multiple books to build,
-# this script might run multiple times, so avoid the work if possible.
-
-mdbook="$(pwd)/mdbook"
-
-if [ ! -x "$mdbook" ] ; then
-    echo "Getting mdbook executable ..."
-    wget -q --progress=dot "$mdbook_binary_url"
-    echo "$mdbook_binary_sha256  $mdbook_binary_fn" |sha256sum -c
-    tar xzf "$mdbook_binary_fn"
-    rm -f "$mdbook_binary_fn"
-fi
-
-# Build the book.
-
-echo "Building book ..."
-pushd "$src_path"
-"$mdbook" build
-"$mdbook" test
-popd
-
-# And that's it.
-
-echo "Success."
diff --git a/dist/create-github-tag.sh b/dist/create-github-tag.sh
deleted file mode 100755
index 760cddfb7..000000000
--- a/dist/create-github-tag.sh
+++ /dev/null
@@ -1,59 +0,0 @@
-#! /bin/bash
-# Copyright 2019 the Tectonic Project
-# Licensed under the MIT License.
-
-# Create a Git tag on GitHub. This script supports the Tectonic continuous
-# deployment workflow.
-#
-# Arguments:
-#
-# $1 -- the tag name
-# $2 -- the Git commit identifier to associate with the tag
-#
-# Environment variables:
-#
-# $GITHUB_TOKEN -- the API token for talking to GitHub
-# $TRAVIS_REPO_SLUG -- the "repo slug" (e.g. "tectonic-typesetting/tectonic") we're building
-
-set -o pipefail
-set -e
-
-tag_name="$1"
-commit_id="$2"
-
-if [ -z "$tag_name" ] ; then
-    echo >&2 "error: no tag name specified"
-    exit 1
-fi
-
-if [ -z "$commit_id" ] ; then
-    echo >&2 "error: no commit ID specified"
-    exit 1
-fi
-
-if [ -z "$GITHUB_TOKEN" ] ; then
-    echo >&2 "error: no GITHUB_TOKEN environment variable"
-    exit 1
-fi
-
-curl=(
-    curl
-    -s
-    --header "Authorization: token ${GITHUB_TOKEN}"
-)
-
-if [ -z "$TRAVIS_REPO_SLUG" ] ; then
-    echo >&2 "error: no TRAVIS_REPO_SLUG environment variable"
-    exit 1
-fi
-
-api_base_url="https://api.github.com/repos/$TRAVIS_REPO_SLUG"
-
-echo "info: planning to create lightweight tag $TRAVIS_REPO_SLUG:$tag_name"
-
-tag_json='{
-  "ref": "refs/tags/'"$tag_name"'",
-  "sha": "'"$commit_id"'"
-}'
-
-"${curl[@]}" --data "$tag_json" "$api_base_url/git/refs"
diff --git a/dist/delete-github-release-and-tag.sh b/dist/delete-github-release-and-tag.sh
deleted file mode 100755
index 88392d72c..000000000
--- a/dist/delete-github-release-and-tag.sh
+++ /dev/null
@@ -1,69 +0,0 @@
-#! /bin/bash
-# Copyright 2019 the Tectonic Project
-# Licensed under the MIT License.
-
-# Delete the named github release and its associated tag. This script is meant
-# for our "continuous" continuous deployment release that hosts artifacts
-# associated with the most recent build on `master`.
-#
-# Arguments:
-#
-# $1 -- the release tag name
-#
-# Environment variables:
-#
-# $GITHUB_TOKEN -- the API token for talking to GitHub
-# $TRAVIS_REPO_SLUG -- the "repo slug" (e.g. "tectonic-typesetting/tectonic") we're building
-
-set -o pipefail
-set -e
-
-release_name="$1"
-
-if [ -z "$release_name" ] ; then
-    echo >&2 "error: no release name specified"
-    exit 1
-fi
-
-if [ -z "$GITHUB_TOKEN" ] ; then
-    echo >&2 "error: no GITHUB_TOKEN environment variable"
-    exit 1
-fi
-
-curl=(
-    curl
-    -s
-    --header "Authorization: token ${GITHUB_TOKEN}"
-)
-
-if [ -z "$TRAVIS_REPO_SLUG" ] ; then
-    echo >&2 "error: no TRAVIS_REPO_SLUG environment variable"
-    exit 1
-fi
-
-# For now ...
-if [ "$release_name" != continuous ] ; then
-    echo >&2 "error: safety check: refusing to run with release name other than \"continuous\""
-    exit 1
-fi
-
-api_base_url="https://api.github.com/repos/$TRAVIS_REPO_SLUG"
-
-echo "info: planning to delete release $TRAVIS_REPO_SLUG:$release_name"
-
-if ! type jql >/dev/null 2>&1 ; then
-    echo "info: installing jql"
-    cargo install -q --force jql
-fi
-
-release_id=$("${curl[@]}" -XGET "$api_base_url/releases/tags/$release_name" | jql '"id"')
-
-if [ -z "$release_id" ] ; then
-    echo "warning: couldn't get release ID; presuming no such release"
-else
-    echo "info: deleting release"
-    "${curl[@]}" -XDELETE "$api_base_url/releases/$release_id"
-fi
-
-echo "info: deleting tag"
-"${curl[@]}" -XDELETE "$api_base_url/git/refs/tags/$release_name"
diff --git a/dist/travis.sh b/dist/travis.sh
deleted file mode 100644
index 6d871958b..000000000
--- a/dist/travis.sh
+++ /dev/null
@@ -1,358 +0,0 @@
-# Copyright 2019 the Tectonic Project
-# Licensed under the MIT License.
-#
-# This script handles most of the Travis processing. Travis lets you break
-# your build into a bunch of steps in their YAML file, but that don't provide
-# much value for us since we barely use their built-in features. So we just
-# have a big script that does almost everything.
-#
-# For each CI'd commit, this script will be run numerous times -- once for
-# each item in the build matrix defined in .travis.yml.
-#
-# This script might be run even *more* times when one commit corresponds to
-# more than one "event": a pull request; a push to a branch; explicit trigger
-# via the API; or timed trigger via cron.
-#
-# Finally, we might have multiple forks of the repo, each seeing the same
-# commits but CI'ing them in various ways.
-#
-# So, it's complicated.
-
-# Exit immediately if a command exits with a non-zero status.
-set -e
-
-# ... but not actually, due to travis-ci/travis-ci#6018. Sleeping upon exit
-# helps avoid truncated logs.
-trap 'sleep 5' EXIT
-
-echo ""
-
-# We use `travis_retry` [1] to deal with transient network errors for commands
-# that download things (e.g. apt-get, wget).
-#
-# Notes:
-# * `cargo` does retry. [2]
-# * `rustup` does not retry [3], but it may be coming soon. [4]
-#
-# [1] https://docs.travis-ci.com/user/common-build-problems/#timeouts-installing-dependencies
-# [2] https://github.com/rust-lang/cargo/pull/2396
-# [3] https://github.com/rust-lang/rustup.rs/issues/1667
-# [4] https://github.com/rust-lang/rustup.rs/pull/1722
-
-# We use `travis_fold` commands to hide chunks of the Travis-CI log. Follow the
-# usage documentation below and put `travis_fold_start`/`travis_fold_end` pairs
-# _inside_ `if` blocks to reduce the log noise. (For example, after `set -x`,
-# `if` statements print out as `+ false`, which is not very useful.)
-
-# Usage: travis_fold_start <fold-name> <title> [<verbose>]
-#
-#   Start a fold with a name and title and (optionally) enable Bash verbose
-#   logging.
-#
-#   <fold-name>  string to use with travis_fold_end to close the fold
-#   <title>      string that appears alone when the fold is closed
-#   <verbose>    (optional) if non-empty, enables Bash verbose echoing
-#
-function travis_fold_start() {
-    echo "travis_fold:start:$1"
-    echo -e "\033[33;1m$2\033[0m"
-    if [ -n "$3" ]; then
-        set -x
-    fi
-}
-
-# Usage: travis_fold_end <fold-name>
-#
-#   End a fold started with the given name and disable Bash verbose logging in
-#   case it was enabled by `travis_fold_start`.
-#
-#   <fold-name>  string that should have been used with travis_fold_start to
-#                open the fold
-#
-function travis_fold_end() {
-    set +x
-    echo ""
-    echo "travis_fold:end:$1"
-}
-
-# Helpful context.
-
-travis_fold_start env "Environment variables"
-echo "TRAVIS_ALLOW_FAILURE: $TRAVIS_ALLOW_FAILURE"
-echo "TRAVIS_BRANCH: $TRAVIS_BRANCH"
-echo "TRAVIS_BUILD_ID: $TRAVIS_BUILD_ID"
-echo "TRAVIS_COMMIT: $TRAVIS_COMMIT"
-echo "TRAVIS_EVENT_TYPE: $TRAVIS_EVENT_TYPE" # one of: push, pull_request, api, cron
-echo "TRAVIS_OS_NAME: $TRAVIS_OS_NAME"
-echo "TRAVIS_OSX_IMAGE: $TRAVIS_OSX_IMAGE"
-echo "TRAVIS_REPO_SLUG: $TRAVIS_REPO_SLUG"
-echo "TRAVIS_SECURE_ENV_VARS: $TRAVIS_SECURE_ENV_VARS"
-echo "TRAVIS_TAG: $TRAVIS_TAG"
-
-if [[ "$TRAVIS_OS_NAME" == linux && "$TRAVIS_RUST_VERSION" == stable ]] ; then
-    # This is the "main" build of the matrix for this commit. The commit might
-    # still be on a non-master branch, or caused by a PR rather than a push,
-    # etc.
-    is_main_build=true
-else
-    is_main_build=false
-fi
-echo "is_main_build: $is_main_build"
-
-if [[ "$TRAVIS_BRANCH" == master && "$TRAVIS_EVENT_TYPE" == push && "$TRAVIS_TAG" == "" ]] ; then
-    # This is a push to master that's not tagged, so we'll want to initiate
-    # our continuous-deployment (CD) workflow. Note that this variable can be
-    # true with $is_main_build being false.
-    is_continuous_deployment_trigger=true
-else
-    is_continuous_deployment_trigger=false
-fi
-echo "is_continuous_deployment_trigger: $is_continuous_deployment_trigger"
-
-publish_artifacts=false
-version_text=none
-upload_artifact=false
-
-if [[ "$TRAVIS_EVENT_TYPE" == push && "$TRAVIS_TAG" == continuous ]] ; then
-    # The second half of our CD workflow is triggered by the creation of a new
-    # tag called "continuous". Creating that tag triggers another CI run,
-    # which is the one that does most of the actual work.
-    is_continuous_deployment_build=true
-    publish_artifacts=true
-    version_text=latest
-    upload_artifacts=(
-        dist/add-github-release-artifact.sh
-        -d "Continuous deployment of commit $TRAVIS_COMMIT"
-        -p  # prerelease
-        continuous
-    )
-else
-    is_continuous_deployment_build=false
-fi
-echo "is_continuous_deployment_build: $is_continuous_deployment_build"
-
-if [[ "$TRAVIS_EVENT_TYPE" == push && "$TRAVIS_TAG" =~ ^v[0-9]+\. ]] ; then
-    # This is a push of tag that matches the above regex: a new release. As
-    # above, this variable can be true with $is_main_build being false.
-    is_release_build=true
-    publish_artifacts=true
-    version_text="$(echo "$TRAVIS_TAG" |sed -e 's/^v//')"
-    upload_artifacts=(
-        dist/add-github-release-artifact.sh
-        -d "Release tag $TRAVIS_TAG"
-        $TRAVIS_TAG
-    )
-else
-    is_release_build=false
-fi
-echo "is_release_build: $is_release_build"
-echo "publish_artifacts: $publish_artifacts (v. $version_text)"
-travis_fold_end env
-
-# The main build of the CD trigger deletes the previous GitHub Release and tag
-# named "continuous", then recreates the tag to point to the current commit.
-# This makes it so that the same workflows can run for both the CD case and
-# when full release tags are pushed. Another nice aspect of this approach is
-# that it does the right thing even although multiple instances of this script
-# are running without any way to communicate with each other.
-
-if $is_continuous_deployment_trigger ; then
-    if $is_main_build ; then
-        travis_fold_start launch_cd "Trigger continuous deployment workflow" verbose
-        dist/delete-github-release-and-tag.sh continuous
-        dist/create-github-tag.sh continuous $TRAVIS_COMMIT
-        travis_fold_end launch_cd
-    fi
-
-    echo -e "\033[34;1mThis is a continuous deployment trigger build. Exiting.\033[0m"
-    exit 0
-fi
-
-# If we're the main build of a job that will create artifacts, immediately
-# upload a fake-ish artifact to trigger the creation of the release on GitHub.
-# This means that any real job that wants to upload an artifact will be able
-# to assume that the destination release exists, since this codepath is going
-# to run much faster than anything that requires a build.
-
-if $publish_artifacts; then
-    if $is_main_build ; then
-        travis_fold_start create_release "Creating GitHub release" verbose
-        cat >RELEASE-INFO.txt <<EOF
-commit=$TRAVIS_COMMIT
-github_tag=$TRAVIS_TAG
-version_text=$version_text
-EOF
-        "${upload_artifacts[@]}" RELEASE-INFO.txt
-        travis_fold_end create_release
-    fi
-fi
-
-# Install dependencies
-
-if [[ "$TRAVIS_OS_NAME" == osx ]]; then
-    travis_fold_start install_deps "Install dependencies" verbose
-    export OPENSSL_INCLUDE_DIR=$(brew --prefix openssl)/include
-    export OPENSSL_LIB_DIR=$(brew --prefix openssl)/lib
-    export DEP_OPENSSL_INCLUDE=$(brew --prefix openssl)/include
-    export PKG_CONFIG_PATH=/usr/local/opt/icu4c/lib/pkgconfig
-    travis_fold_end install_deps
-elif [[ "$TRAVIS_OS_NAME" == linux ]] ; then
-    # We actually use .travis.yml to install basic packages, but we need
-    # to install a newer Harfbuzz. At the moment, Travis' Xenial images
-    # have an auto-update daemon that can lock the apt/dpkg system under
-    # us. See https://github.com/travis-ci/travis-cookbooks/issues/952 and
-    # https://unix.stackexchange.com/questions/315502/how-to-disable-apt-daily-service-on-ubuntu-cloud-vm-image
-    # . We adopt the workaround from the StackExchange post.
-
-    travis_fold_start install_deps "Install dependencies" verbose
-    sudo systemctl stop apt-daily.timer
-    sudo systemctl stop apt-daily.service
-    sudo systemctl kill --kill-who=all apt-daily.service
-
-    while ! (systemctl list-units --all apt-daily.service | fgrep -q dead) ; do
-        sleep 1
-    done
-
-    travis_retry sudo add-apt-repository -y ppa:k-peter/tectonic-ci
-    travis_retry sudo apt-get update
-    travis_retry sudo apt-get install -y libharfbuzz-dev
-    travis_fold_end install_deps
-fi
-
-# Check that the code is properly rustfmt'd and clippy'd.
-
-if $is_main_build ; then
-    travis_fold_start cargo_fmt "cargo fmt" verbose
-    travis_retry rustup component add rustfmt
-    cargo fmt --all -- --check
-    travis_fold_end cargo_fmt
-    travis_fold_start cargo_clippy "cargo clippy" verbose
-    travis_retry rustup component add clippy
-    cargo clippy --all --all-targets --all-features -- --deny warnings
-    travis_fold_end cargo_clippy
-fi
-
-# OK, the biggie: does it compile and pass the test suite?
-
-export RUST_BACKTRACE=1
-
-travis_fold_start cargo_build_no_default_features "cargo build --no-default-features" verbose
-cargo build --no-default-features --verbose
-travis_fold_end cargo_build_no_default_features
-travis_fold_start cargo_build "cargo build" verbose
-cargo build --verbose
-travis_fold_end cargo_build
-travis_fold_start cargo_test "cargo test" verbose
-cargo test
-travis_fold_end cargo_test
-
-# OK! If we got this far, we think we made a functional set of (debug-mode)
-# Tectonic artifacts for this build matrix element.
-
-# The main build is equipped to test code coverage.
-
-if $is_main_build ; then
-    travis_fold_start cargo_kcov "cargo kcov" verbose
-    travis_retry sudo apt-get install -y kcov
-    cargo install --force cargo-kcov
-
-    # As of Rust 1.44, test executables land in target/debug/deps/ instead of
-    # target/debug/, which messes up current cargo-kcov (0.5.2) because it tries
-    # to search for those executables. Work around with `cp`. One of the
-    # `tectonic-*` binaries is the debug executable, which is hard-linked to
-    # `target/debug/tectonic`. kcov will erroneously try to run this as a test
-    # if we copy it, so we have to make not to do that, which we accomplish with
-    # a search based on the hardlink count. Hacky and fragile but this should
-    # get us going. Hopefully kcov will get fixed where this will become
-    # unneccessary anyway.
-    rm target/debug/deps/tectonic-????????????????
-    cargo test --no-run
-    find target/debug/deps/tectonic-???????????????? -links 2 -print -delete
-    cp -vp target/debug/deps/*-???????????????? target/debug/
-
-    env RUNNING_COVERAGE=1 cargo kcov --no-clean-rebuild
-    bash <(curl -s https://codecov.io/bash)
-    travis_fold_end cargo_kcov
-fi
-
-# The docs/ mdbook: only built in the main build.
-
-if $is_main_build ; then
-    if $publish_artifacts ; then
-        verb="build and publish"
-
-        if $is_release_build ; then
-            book_desc="docs mdbook @ v$version_text"
-        else  # continuous deployment
-            book_desc="docs mdbook @ $TRAVIS_COMMIT"
-        fi
-    else
-        verb="build"
-    fi
-
-    travis_fold_start docs_mdbook "mdbook $verb docs" verbose
-    dist/build-mdbook.sh docs
-
-    if $publish_artifacts; then
-        dist/force-push-tree.sh \
-            docs/book \
-            https://github.com/tectonic-typesetting/book.git \
-            "$version_text" \
-            "$book_desc"
-    fi
-
-    travis_fold_end docs_mdbook
-fi
-
-# Everything until now has been exercising and validating the build. The rest
-# of this script builds release artifacts, which is only worth doing if we
-# have a place to put them. Currently, this happens for continuous deployment
-# and release tag builds, but not pull requests.
-
-if ! $publish_artifacts; then
-    echo -e "\033[34;1mThis build does not include release artifacts. Stopping here.\033[0m"
-    exit 0
-fi
-
-# Careful! For the code coverage, we use "-C link-dead-code" in the main
-# build, which we don't want for release artifacts. But if we ever add other
-# stuff to $RUSTFLAGS, this command will lose it.
-
-if $is_main_build ; then
-    unset RUSTFLAGS
-fi
-
-# AppImage artifact: currently only Linux/x86_64, i.e. main build
-
-if $is_main_build; then
-    travis_fold_start appimage "Build and publish AppImage" verbose
-
-    if $is_continuous_deployment_build ; then
-        # In CD, we include extra information for incremental updates.
-        repo_info=$(echo "$TRAVIS_REPO_SLUG" |sed -e 's,/,|,g')
-        export TECTONIC_APPIMAGE_TAG=continuous
-        export UPDATE_INFORMATION="gh-releases-zsync|$repo_info|continuous|tectonic-*.AppImage.zsync"
-    fi
-
-    dist/appimage/build.sh
-    "${upload_artifacts[@]}" dist/appimage/tectonic-*.AppImage*
-    travis_fold_end appimage
-fi
-
-# Everything below here is only for tagged releases.
-
-if ! $is_release_build; then
-    echo -e "\033[34;1mThis build is not a tagged release. Stopping here.\033[0m"
-    exit 0
-fi
-
-# Yet more work to do. Trigger Arch Linux to build a new package.
-
-if $is_main_build; then
-    travis_fold_start arch_linux "Update Arch Linux package" verbose
-    openssl aes-256-cbc -K $encrypted_bc40b17e21fa_key -iv $encrypted_bc40b17e21fa_iv \
-            -in dist/deploy_key.enc -out /tmp/deploy_key -d
-    chmod 600 /tmp/deploy_key
-    bash dist/arch/deploy.sh
-    travis_fold_end arch_linux
-fi
diff --git a/dist/update-website.sh b/dist/update-website.sh
new file mode 100755
index 000000000..2344004eb
--- /dev/null
+++ b/dist/update-website.sh
@@ -0,0 +1,26 @@
+#! /usr/bin/env bash
+# Copyright 2020 the Tectonic Project
+# Licensed under the MIT license
+
+# Auto-update the main Tectonic website repo to show the date of the latest
+# release. This script is run from the CI/CD pipeline after the main package is
+# updated. The environment variable $GITHUB_TOKEN should be set and the local
+# Git user should be configured with proper GitHub authentication and the
+# ability to create commits.
+
+set -xeuo pipefail
+cd "$(dirname $0)"
+
+version="$(cranko show version tectonic)"
+date="$(date +%Y-%m-%d)"
+
+git clone https://github.com/tectonic-typesetting/tectonic-typesetting.github.io.git website
+cd website
+
+sed -e "s|^latest:.*|latest: \"$version\"|" \
+  -e "s|^latest_date:.*|latest_date: \"$date\"|" \
+  -i _config.yml
+
+git add _config.yml
+git commit -m "Auto-update for release of version $version"
+git push origin master
diff --git a/xdv/CHANGELOG.md b/xdv/CHANGELOG.md
new file mode 100644
index 000000000..17b66fa53
--- /dev/null
+++ b/xdv/CHANGELOG.md
@@ -0,0 +1,8 @@
+# See elsewhere for changelog
+
+This project’s release notes are curated from the Git history of its main
+branch. You can find them by looking at [the version of this file on the
+`release` branch][branch] or the [GitHub release history][gh-releases].
+
+[branch]: https://github.com/tectonic-typesetting/tectonic/blob/release/xdv/CHANGELOG.md
+[gh-releases]: https://github.com/tectonic-typesetting/tectonic/releases