diff --git a/.github/workflows/ios.yml b/.github/workflows/ios.yml
index e1b2d0e..b748560 100644
--- a/.github/workflows/ios.yml
+++ b/.github/workflows/ios.yml
@@ -33,7 +33,7 @@ jobs:
           PSIPHON_CONFIG_KEY: ${{ secrets.PSIPHON_CONFIG_KEY }}
           PSIPHON_CONFIG_JSON_AGE_BASE64: ${{ secrets.PSIPHON_CONFIG_JSON_AGE_BASE64 }}
 
-      - run: ./mk XCODE_VERSION=12.4 ./MOBILE/ios
+      - run: ./mk EXPECTED_XCODE_VERSION=12.4 ./MOBILE/ios
 
       - run: |
           tag=$(echo $GITHUB_REF | sed 's|refs/tags/||g')
diff --git a/.github/workflows/windows.yml b/.github/workflows/windows.yml
index 7ce51da..f0a9fbb 100644
--- a/.github/workflows/windows.yml
+++ b/.github/workflows/windows.yml
@@ -31,7 +31,7 @@ jobs:
           PSIPHON_CONFIG_KEY: ${{ secrets.PSIPHON_CONFIG_KEY }}
           PSIPHON_CONFIG_JSON_AGE_BASE64: ${{ secrets.PSIPHON_CONFIG_JSON_AGE_BASE64 }}
 
-      - run: ./mk MINGW_W64_VERSION="9.3-win32" ./CLI/ooniprobe-windows
+      - run: ./mk EXPECTED_MINGW_W64_VERSION="9.3-win32" ./CLI/ooniprobe-windows
 
       - uses: actions/upload-artifact@v2
         with:
diff --git a/CLI/build-linux b/CLI/build-linux
deleted file mode 100755
index edc01e6..0000000
--- a/CLI/build-linux
+++ /dev/null
@@ -1,24 +0,0 @@
-#!/bin/sh
-# This script is executed by `./mk` when building inside
-# an Alpine Linux docker container. Using Alpine Linux, which
-# uses musl libc, allows us to emit static binaries.
-set -e
-if [ "$GOARCH" = "" ]; then
-	echo 'fatal: GOARCH is not set' 1>&2
-	exit 1
-fi
-set -x
-apk update
-apk upgrade
-apk add --no-progress gcc git linux-headers musl-dev
-# some of the following exports are redundant but are however
-# useful because they provide explicit logging
-export GOARM=$GOARM
-export CGO_ENABLED=1
-export GOOS=linux
-export GOARCH=$GOARCH
-archname=$GOARCH
-if [ "$GOARCH" = "arm" -a "$GOARM" = "7" ]; then
-	archname="armv7"
-fi
-go build -o "./CLI/ooniprobe-linux-$archname" -ldflags='-s -w -extldflags "-static"' "$@" ./cmd/ooniprobe
diff --git a/CLI/check-go-version b/CLI/check-go-version
new file mode 100755
index 0000000..73c8485
--- /dev/null
+++ b/CLI/check-go-version
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -euo pipefail
+
+EXPECTED_GOLANG_VERSION=go$(cat GOVERSION)
+
+printf "checking for go... "
+if ! command -v go; then
+	echo "not found"
+	exit 1
+fi
+
+printf "checking for go version... "
+GOLANG_VERSION=$(go version | awk '{print $3}')
+echo $GOLANG_VERSION
+if [[ $GOLANG_VERSION != $EXPECTED_GOLANG_VERSION ]]; then
+	echo "FATAL: go version must be $EXPECTED_GOLANG_VERSION instead of $GOLANG_VERSION"
+	exit 1
+fi
diff --git a/CLI/check-mingw-w64-version b/CLI/check-mingw-w64-version
new file mode 100755
index 0000000..4a40f2f
--- /dev/null
+++ b/CLI/check-mingw-w64-version
@@ -0,0 +1,37 @@
+#!/bin/bash
+
+set -euo pipefail
+
+EXPECTED_MINGW_W64_VERSION=${EXPECTED_MINGW_W64_VERSION:-12.1.0} # Allow overriding
+
+printf "checking for x86_64-w64-mingw32-gcc... "
+command -v x86_64-w64-mingw32-gcc || {
+	echo "not found"
+	exit 1
+}
+
+printf "checking for i686-w64-mingw32-gcc... "
+command -v i686-w64-mingw32-gcc || {
+	echo "not found"
+	exit 1
+}
+
+exitcode=0
+
+printf "checking for x86_64-w64-mingw32-gcc version... "
+__version_amd64=$(x86_64-w64-mingw32-gcc --version | sed -n 1p | awk '{print $3}')
+echo $__version_amd64
+[[ "$EXPECTED_MINGW_W64_VERSION" == "$__version_amd64" ]] || {
+	echo "fatal: x86_64-w64-mingw32-gcc version must be $EXPECTED_MINGW_W64_VERSION instead of $__version_amd64"
+	exitcode=1
+}
+
+printf "checking for i686-w64-mingw32-gcc version... "
+__version_386=$(i686-w64-mingw32-gcc --version | sed -n 1p | awk '{print $3}')
+echo $__version_386
+[[ "$EXPECTED_MINGW_W64_VERSION" == "$__version_386" ]] || {
+	echo "fatal: i686-w64-mingw32-gcc version must be $EXPECTED_MINGW_W64_VERSION instead of $__version_386"
+	exitcode=1
+}
+
+exit $exitcode
diff --git a/CLI/go-build-alpine b/CLI/go-build-alpine
new file mode 100755
index 0000000..52a2f26
--- /dev/null
+++ b/CLI/go-build-alpine
@@ -0,0 +1,14 @@
+#!/bin/sh
+set -euxo pipefail
+apk update
+apk upgrade
+apk add --no-progress gcc git linux-headers musl-dev
+# some of the following exports are redundant but are however
+# useful because they provide explicit logging
+export CGO_ENABLED=1
+export GOARM=$GOARM
+export GOOS=$GOOS
+export GOARCH=$GOARCH
+go build -o ./CLI/$PRODUCT-$GOOS-$OONIARCH \
+	-ldflags='-s -w -extldflags "-static"' \
+	$GOLANG_EXTRA_FLAGS $PACKAGE
diff --git a/CLI/go-build-cross b/CLI/go-build-cross
new file mode 100755
index 0000000..d9c0f81
--- /dev/null
+++ b/CLI/go-build-cross
@@ -0,0 +1,59 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -ne 3 ]]; then
+	echo "" 1>&2
+	echo "Cross-compiler for a Go PACKAGE producing GOOS/OONIARCH binaries." 1>&2
+	echo "" 1>&2
+	echo "usage: $0 GOOS OONIARCH PACKAGE" 1>&2
+	echo "" 1>&2
+	echo "GOOS must be one of: android, darwin, linux, windows." 1>&2
+	echo "" 1>&2
+	echo "OONIARCH must be one of: 386, amd64, arm64, armv6, armv7." 1>&2
+	echo "" 1>&2
+	echo "Features:" 1>&2
+	echo "" 1>&2
+	echo "* automatically sets -tags=ooni_psiphon_config when possible;" 1>&2
+	echo "" 1>&2
+	echo "* if GOLANG_EXTRA_FLAGS is set, pass it to the Go compiler." 1>&2
+	echo "" 1>&2
+	echo "Example:" 1>&2
+	echo "" 1>&2
+	echo "  ./CLI/go-build-cross linux armv7 ./internal/cmd/miniooni" 1>&2
+	echo "" 1>&2
+	exit 1
+fi
+
+GOOS=$1
+OONIARCH=$2
+PACKAGE=$3
+
+if [[ $OONIARCH == armv7 ]]; then
+	GOARCH=arm
+	GOARM=7
+elif [[ $OONIARCH == armv6 ]]; then
+	GOARCH=arm
+	GOARM=6
+else
+	GOARCH=$OONIARCH
+	GOARM=
+fi
+
+if [[ -f ./internal/engine/psiphon-config.json.age &&
+	-f ./internal/engine/psiphon-config.key ]]; then
+	OONI_PSIPHON_TAGS=ooni_psiphon_config
+else
+	OONI_PSIPHON_TAGS=""
+fi
+
+PRODUCT=$(basename $PACKAGE)
+
+set -x
+export CGO_ENABLED=0
+export GOOS=$GOOS
+export GOARCH=$GOARCH
+export GOARM=$GOARM
+go build -tags=$OONI_PSIPHON_TAGS -ldflags="-s -w" \
+	-o ./CLI/$PRODUCT-$GOOS-$OONIARCH ${GOLANG_EXTRA_FLAGS:-} \
+	$PACKAGE
diff --git a/CLI/go-build-darwin b/CLI/go-build-darwin
new file mode 100755
index 0000000..df75d47
--- /dev/null
+++ b/CLI/go-build-darwin
@@ -0,0 +1,45 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+	echo "" 1>&2
+	echo "Compiler for a Go PACKAGE producing darwin/GOARCH binaries." 1>&2
+	echo "" 1>&2
+	echo "usage: $0 GOARCH PACKAGE" 1>&2
+	echo "" 1>&2
+	echo "GOARCH must be one of: amd64, arm64." 1>&2
+	echo "" 1>&2
+	echo "Features:" 1>&2
+	echo "" 1>&2
+	echo "* automatically sets -tags=ooni_psiphon_config when possible;" 1>&2
+	echo "" 1>&2
+	echo "* if GOLANG_EXTRA_FLAGS is set, pass it to the Go compiler." 1>&2
+	echo "" 1>&2
+	echo "Example:" 1>&2
+	echo "" 1>&2
+	echo "  ./CLI/go-build-darwin arm64 ./internal/cmd/miniooni" 1>&2
+	echo "" 1>&2
+	exit 1
+fi
+
+GOOS=darwin
+GOARCH=$1
+PACKAGE=$2
+
+if [[ -f ./internal/engine/psiphon-config.json.age &&
+	-f ./internal/engine/psiphon-config.key ]]; then
+	OONI_PSIPHON_TAGS=ooni_psiphon_config
+else
+	OONI_PSIPHON_TAGS=""
+fi
+
+PRODUCT=$(basename $PACKAGE)
+
+set -x
+export CGO_ENABLED=1
+export GOOS=$GOOS
+export GOARCH=$GOARCH
+go build -tags=$OONI_PSIPHON_TAGS -ldflags="-s -w" \
+	-o ./CLI/$PRODUCT-$GOOS-$GOARCH ${GOLANG_EXTRA_FLAGS:-} \
+	$PACKAGE
diff --git a/CLI/go-build-linux-static b/CLI/go-build-linux-static
new file mode 100755
index 0000000..ad4c88b
--- /dev/null
+++ b/CLI/go-build-linux-static
@@ -0,0 +1,62 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+	echo "" 1>&2
+	echo "Compiler for a Go PACKAGE producing static linux/OONIARCH binaries." 1>&2
+	echo "" 1>&2
+	echo "usage: $0 OONIARCH PACKAGE" 1>&2
+	echo "" 1>&2
+	echo "OONIARCH must be one of: 386, amd64, arm64, armv6, armv7." 1>&2
+	echo "" 1>&2
+	echo "Features:" 1>&2
+	echo "" 1>&2
+	echo "* automatically sets -tags=ooni_psiphon_config when possible;" 1>&2
+	echo "" 1>&2
+	echo "* if GOLANG_EXTRA_FLAGS is set, pass it to the Go compiler." 1>&2
+	echo "" 1>&2
+	echo "Example:" 1>&2
+	echo "" 1>&2
+	echo "  ./CLI/go-build-linux-static arm64 ./internal/cmd/miniooni" 1>&2
+	echo "" 1>&2
+	exit 1
+fi
+
+GOLANG_DOCKER_IMAGE=golang:$(cat GOVERSION)-alpine
+GOOS=linux
+OONIARCH=$1
+PACKAGE=$2
+
+if [[ $OONIARCH == armv7 ]]; then
+	GOARCH=arm
+	GOARM=7
+	DOCKER_ARCH=arm/v7
+elif [[ $OONIARCH == armv6 ]]; then
+	GOARCH=arm
+	GOARM=6
+	DOCKER_ARCH=arm/v6
+else
+	GOARCH=$OONIARCH
+	GOARM=
+	DOCKER_ARCH=$OONIARCH
+fi
+
+if [[ -f ./internal/engine/psiphon-config.json.age &&
+	-f ./internal/engine/psiphon-config.key ]]; then
+	OONI_PSIPHON_TAGS=ooni_psiphon_config
+else
+	OONI_PSIPHON_TAGS=""
+fi
+
+PRODUCT=$(basename $PACKAGE)
+
+set -x
+
+docker pull --platform linux/$DOCKER_ARCH $GOLANG_DOCKER_IMAGE
+
+docker run --platform linux/$DOCKER_ARCH -e PRODUCT=$PRODUCT \
+	-e GOARM=$GOARM -e GOOS=$GOOS -e GOARCH=$GOARCH \
+	-e PACKAGE=$PACKAGE -e OONI_PSIPHON_TAGS=$OONI_PSIPHON_TAGS \
+	-e OONIARCH=$OONIARCH -e GOLANG_EXTRA_FLAGS="${GOLANG_EXTRA_FLAGS:-}" \
+	-v $(pwd):/ooni -w /ooni $GOLANG_DOCKER_IMAGE ./CLI/go-build-alpine
diff --git a/CLI/go-build-windows b/CLI/go-build-windows
new file mode 100755
index 0000000..8f7f15d
--- /dev/null
+++ b/CLI/go-build-windows
@@ -0,0 +1,55 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+	echo "" 1>&2
+	echo "Compiler for a Go PACKAGE producing windows/GOARCH binaries." 1>&2
+	echo "" 1>&2
+	echo "usage: $0 GOARCH PACKAGE" 1>&2
+	echo "" 1>&2
+	echo "GOARCH must be one of: 386, amd64." 1>&2
+	echo "" 1>&2
+	echo "Features:" 1>&2
+	echo "" 1>&2
+	echo "* automatically sets -tags=ooni_psiphon_config when possible;" 1>&2
+	echo "" 1>&2
+	echo "* if GOLANG_EXTRA_FLAGS is set, pass it to the Go compiler." 1>&2
+	echo "" 1>&2
+	echo "Example:" 1>&2
+	echo "" 1>&2
+	echo "  ./CLI/go-build-windows amd64 ./internal/cmd/miniooni" 1>&2
+	echo "" 1>&2
+	exit 1
+fi
+
+GOOS=windows
+GOARCH=$1
+PACKAGE=$2
+
+if [[ -f ./internal/engine/psiphon-config.json.age &&
+	-f ./internal/engine/psiphon-config.key ]]; then
+	OONI_PSIPHON_TAGS=ooni_psiphon_config
+else
+	OONI_PSIPHON_TAGS=""
+fi
+
+PRODUCT=$(basename $PACKAGE)
+
+if [[ $GOARCH == "amd64" ]]; then
+	CC=x86_64-w64-mingw32-gcc
+elif [[ $GOARCH == "386" ]]; then
+	CC=i686-w64-mingw32-gcc
+else
+	echo "FATAL: unsupported GOARCH: $GOARCH" 1>&2
+	exit 1
+fi
+
+set -x
+export CC=$CC
+export CGO_ENABLED=1
+export GOOS=$GOOS
+export GOARCH=$GOARCH
+go build -tags=$OONI_PSIPHON_TAGS -ldflags="-s -w" \
+	-o ./CLI/$PRODUCT-$GOOS-$GOARCH ${GOLANG_EXTRA_FLAGS:-} \
+	$PACKAGE
diff --git a/MOBILE/android/createpom b/MOBILE/android/createpom
new file mode 100755
index 0000000..582feca
--- /dev/null
+++ b/MOBILE/android/createpom
@@ -0,0 +1,4 @@
+#!/bin/bash
+set -euo pipefail
+__version=$(date -u +%Y.%m.%d-%H%M%S)
+cat ./MOBILE/android/template.pom | sed -e "s/@VERSION@/$__version/g" > ./MOBILE/android/oonimkall.pom
diff --git a/MOBILE/android/ensure b/MOBILE/android/ensure
new file mode 100755
index 0000000..9a31d5c
--- /dev/null
+++ b/MOBILE/android/ensure
@@ -0,0 +1,38 @@
+#!/bin/bash
+
+set -euo pipefail
+
+__install_extra="build-tools;32.0.0 platforms;android-31"
+
+__ndk_version="23.1.7779620"
+
+GOOS=$(go env GOOS)
+case $GOOS in
+linux)
+	__sdk_dir=$HOME/Android/Sdk
+	;;
+darwin)
+	__sdk_dir=$HOME/Library/Android/sdk
+	;;
+*)
+	echo "FATAL: unsupported operating system" 1>&2
+	exit 1
+	;;
+esac
+
+ANDROID_HOME=${ANDROID_HOME:-$__sdk_dir}
+if [[ ! -d $ANDROID_HOME ]]; then
+	echo "FATAL: expected to find android SDK at $ANDROID_HOME, but found nothing" 1>&2
+	echo "HINT: run ./MOBILE/android/setup to (re)install the SDK" 1>&2
+	exit 1
+fi
+
+__sdkmanager=$ANDROID_HOME/cmdline-tools/latest/bin/sdkmanager
+if [[ ! -x $__sdkmanager ]]; then
+	echo "FATAL: expected to find sdkmanager at $__sdkmanager, but found nothing" 1>&2
+	echo "HINT: run ./MOBILE/android/setup to (re)install the SDK" 1>&2
+	exit 1
+fi
+
+set -x
+echo "Yes" | $__sdkmanager --install $__install_extra "ndk;$__ndk_version"
diff --git a/MOBILE/android/setup b/MOBILE/android/setup
new file mode 100755
index 0000000..f751598
--- /dev/null
+++ b/MOBILE/android/setup
@@ -0,0 +1,52 @@
+#!/bin/bash
+
+set -euo pipefail
+
+GOOS=$(go env GOOS)
+case $GOOS in
+linux)
+	__sdk_dir=$HOME/Android/Sdk
+	;;
+darwin)
+	__sdk_dir=$HOME/Library/Android/sdk
+	;;
+*)
+	echo "FATAL: unsupported operating system" 1>&2
+	exit 1
+	;;
+esac
+
+ANDROID_HOME=${ANDROID_HOME:-$__sdk_dir}
+
+__clitools_version=8512546
+__clitools_file=commandlinetools-linux-${__clitools_version}_latest.zip
+__clitools_sha256=2ccbda4302db862a28ada25aa7425d99dce9462046003c1714b059b5c47970d8
+
+printf "checking for curl... "
+command -v curl || {
+	echo "not found"
+	exit 1
+}
+printf "checking for shasum... "
+command -v shasum || {
+	echo "not found"
+	exit 1
+}
+printf "checking for unzip... "
+command -v unzip || {
+	echo "not found"
+	exit 1
+}
+
+set -x
+rm -rf $ANDROID_HOME/cmdline-tools/latest
+curl -fsSLO https://dl.google.com/android/repository/$__clitools_file
+echo "$__clitools_sha256  $__clitools_file" >__SHA256
+shasum --check __SHA256
+rm -f __SHA256
+unzip $__clitools_file
+rm $__clitools_file
+mkdir -p $ANDROID_HOME/cmdline-tools
+# See https://stackoverflow.com/a/61176718 to understand why
+# we need to reorganize the directories like this:
+mv cmdline-tools $ANDROID_HOME/cmdline-tools/latest
diff --git a/MOBILE/gomobile b/MOBILE/gomobile
new file mode 100755
index 0000000..6f29573
--- /dev/null
+++ b/MOBILE/gomobile
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+set -euo pipefail
+
+if [[ $# -ne 2 ]]; then
+	echo "" 1>&2
+	echo "Calls gomobile for either Android or iOS to build PACKAGE." 1>&2
+	echo "" 1>&2
+	echo "usage: $0 TARGET PACKAGE" 1>&2
+	echo "" 1>&2
+	echo "TARGET must be one of: android, ios." 1>&2
+	echo "" 1>&2
+	echo "Features:" 1>&2
+	echo "" 1>&2
+	echo "* automatically sets -tags=ooni_psiphon_config when possible;" 1>&2
+	echo "" 1>&2
+	echo "* if GOLANG_EXTRA_FLAGS is set, pass it to the Go compiler." 1>&2
+	echo "" 1>&2
+	echo "Example:" 1>&2
+	echo "" 1>&2
+	echo "  ./MOBILE/gomobile android ./pkg/oonimkall" 1>&2
+	echo "" 1>&2
+	exit 1
+fi
+
+TARGET=$1
+PACKAGE=$2
+
+if [[ $TARGET == "android" ]]; then
+	EXT="aar"
+elif [[ $TARGET == "ios" ]]; then
+	EXT="xcframework"
+else
+	echo "FATAL: unsupported target: $TARGET" 1>&2
+	exit 1
+fi
+
+if [[ -f ./internal/engine/psiphon-config.json.age &&
+	-f ./internal/engine/psiphon-config.key ]]; then
+	OONI_PSIPHON_TAGS=ooni_psiphon_config
+else
+	OONI_PSIPHON_TAGS=""
+fi
+
+PRODUCT=$(basename $PACKAGE)
+
+function cleanup() {
+	# Undoes the effects of go-getting golang.org/x/mobile/cmd/gomobile
+	go mod tidy
+}
+trap cleanup EXIT
+
+set -x
+go install golang.org/x/mobile/cmd/gomobile@latest
+$(go env GOPATH)/bin/gomobile init
+# Adding gomobile to go.mod as documented by golang.org/wiki/Mobile
+go get -d golang.org/x/mobile/cmd/gomobile
+
+$(go env GOPATH)/bin/gomobile bind -target $TARGET \
+	-o ./MOBILE/$TARGET/$PRODUCT.$EXT -tags="$OONI_PSIPHON_TAGS" \
+	-ldflags '-s -w' ${GOLANG_EXTRA_FLAGS:-} $PACKAGE
diff --git a/MOBILE/ios/check-xcode-version b/MOBILE/ios/check-xcode-version
new file mode 100755
index 0000000..d86f76c
--- /dev/null
+++ b/MOBILE/ios/check-xcode-version
@@ -0,0 +1,19 @@
+#!/bin/bash
+
+set -euo pipefail
+
+EXPECTED_XCODE_VERSION=${EXPECTED_XCODE_VERSION:-13.4.1}
+
+printf "checking for xcodebuild... "
+command -v xcodebuild || {
+	echo "not found"
+	exit 1
+}
+
+printf "checking for Xcode version... "
+__XCODEVERSION_REAL=$(xcodebuild -version | grep ^Xcode | awk '{print $2}')
+echo $__XCODEVERSION_REAL
+[[ "$EXPECTED_XCODE_VERSION" = "$__XCODEVERSION_REAL" ]] || {
+	echo "fatal: Xcode version must be $EXPECTED_XCODE_VERSION instead of $__XCODEVERSION_REAL"
+	exit 1
+}
diff --git a/MOBILE/ios/createpodspec b/MOBILE/ios/createpodspec
new file mode 100755
index 0000000..b756259
--- /dev/null
+++ b/MOBILE/ios/createpodspec
@@ -0,0 +1,6 @@
+#!/bin/bash
+set -euo pipefail
+__version=$(date -u +%Y.%m.%d-%H%M%S)
+__release=$(git describe --tags || echo '0.0.0-dev')
+cat ./MOBILE/ios/template.podspec | sed -e "s/@VERSION@/$__version/g" \
+	-e "s/@RELEASE@/$__release/g" >./MOBILE/ios/oonimkall.podspec
diff --git a/MOBILE/ios/zipframework b/MOBILE/ios/zipframework
new file mode 100755
index 0000000..b03601f
--- /dev/null
+++ b/MOBILE/ios/zipframework
@@ -0,0 +1,7 @@
+#!/bin/bash
+set -euxo pipefail
+(
+	cd ./MOBILE/ios
+	rm -rf oonimkall.xcframework.zip
+	zip -yr oonimkall.xcframework.zip oonimkall.xcframework
+)
diff --git a/mk b/mk
index d2b6f74..c990c28 100755
--- a/mk
+++ b/mk
@@ -14,7 +14,7 @@ usage:
 #quickhelp: The `./mk list-targets` command lists all available targets.
 .PHONY: list-targets
 list-targets:
-	@cat mk | grep '^\.PHONY:' | sed -e 's/^\.PHONY://'
+	@cat mk | grep '^\.PHONY:' | sed -e 's/^\.PHONY://' | grep -v '^ search' | grep -v '^ maybe'
 
 #quickhelp:
 #quickhelp: The `./mk help` command provides detailed usage instructions. We
@@ -27,49 +27,11 @@ help:
 #help: The following variables control the build. You can specify them
 #help: on the command line as a key-value pairs (see usage above).
 
-#help:
-#help: * ANDROID_CLI_SHA256    : the SHA256 of the Android CLI tools file. We always
-#help:                           download the Linux version, which seems to work
-#help:                           also on macOS (thank you, Java! :pray:).
-ANDROID_CLI_SHA256 = 5e7bf2dd563d34917d32f3c5920a85562a795c93
-
-#help:
-#help: * ANDROID_CLI_VERSION   : the version of the Android CLI tools.
-ANDROID_CLI_VERSION = 8512546
-
-#help:
-#help: * ANDROID_INSTALL_EXTRA : contains the android tools we install in addition
-#help:                           to the NDK in order to build oonimkall.aar.
-ANDROID_INSTALL_EXTRA = 'build-tools;32.0.0' 'platforms;android-31'
-
-#help:
-#help: * ANDROID_NDK_VERSION   : Android NDK version.
-ANDROID_NDK_VERSION = 23.1.7779620
-
 #help:
 #help: * GIT_CLONE_DIR         : directory where to clone repositories, by default
 #help:                           set to `$HOME/.ooniprobe-build/src`.
 GIT_CLONE_DIR = $(HOME)/.ooniprobe-build/src
 
-# $(GIT_CLONE_DIR) is an internal target that creates $(GIT_CLONE_DIR).
-$(GIT_CLONE_DIR):
-	mkdir -p $(GIT_CLONE_DIR)
-
-#help:
-#help: * GOLANG_EXTRA_FLAGS    : extra flags passed to `go build ...`, empty by
-#help:                           default. Useful to pass flags to `go`, e.g.:
-#help:
-#help:                               ./mk GOLANG_EXTRA_FLAGS="-x -v" ./CLI/miniooni
-GOLANG_EXTRA_FLAGS =
-
-#help:
-#help: * GOLANG_VERSION_NUMBER : the expected version number for golang.
-GOLANG_VERSION_NUMBER = $(shell cat GOVERSION)
-
-#help:
-#help: * MINGW_W64_VERSION     : the expected mingw-w64 version.
-MINGW_W64_VERSION = 10.3.1
-
 #help:
 #help: * OONI_PSIPHON_TAGS     : build tags for `go build -tags ...` that cause
 #help:                           the build to embed a psiphon configuration file
@@ -81,47 +43,14 @@ MINGW_W64_VERSION = 10.3.1
 #help:                               ./mk OONI_PSIPHON_TAGS="" ./CLI/miniooni
 OONI_PSIPHON_TAGS = ooni_psiphon_config
 
-#help:
-#help: * OONI_ANDROID_HOME     : directory where the Android SDK is downloaded
-#help:                           and installed. You can point this to an existing
-#help:                           copy of the SDK as long as (1) you have the
-#help:                           right version of the command line tools, and
-#help:                           (2) it's okay for us to install packages.
-OONI_ANDROID_HOME = $(HOME)/.ooniprobe-build/sdk/android
-
-#help:
-#help: * XCODE_VERSION         : the version of Xcode we expect.
-XCODE_VERSION = 13.3.1
-
 #quickhelp:
 #quickhelp: The `./mk show-config` command shows the current value of the
 #quickhelp: variables controlling the build.
 .PHONY: show-config
 show-config:
-	@echo "ANDROID_CLI_VERSION=$(ANDROID_CLI_VERSION)"
-	@echo "ANDROID_CLI_SHA256=$(ANDROID_CLI_SHA256)"
-	@echo "ANDROID_INSTALL_EXTRA=$(ANDROID_INSTALL_EXTRA)"
-	@echo "ANDROID_NDK_VERSION=$(ANDROID_NDK_VERSION)"
 	@echo "GIT_CLONE_DIR=$(GIT_CLONE_DIR)"
-	@echo "GOLANG_EXTRA_FLAGS=$(GOLANG_EXTRA_FLAGS)"
-	@echo "GOLANG_VERSION_NUMBER=$(GOLANG_VERSION_NUMBER)"
-	@echo "MINGW_W64_VERSION=$(MINGW_W64_VERSION)"
 	@echo "OONI_PSIPHON_TAGS=$(OONI_PSIPHON_TAGS)"
-	@echo "OONI_ANDROID_HOME=$(OONI_ANDROID_HOME)"
-	@echo "XCODE_VERSION=$(XCODE_VERSION)"
 
-# GOLANG_VERSION_STRING is the expected version string. If we
-# run a golang binary that does not emit this version string
-# when running `go version`, we stop the build.
-GOLANG_VERSION_STRING = go$(GOLANG_VERSION_NUMBER)
-
-# GOLANG_DOCKER_IMAGE is the golang docker image we use for
-# building for Linux systems. It is an Alpine based container
-# so that we can easily build static binaries.
-GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
-
-# Cross-compiling miniooni from any system with Go installed is
-# very easy, because it does not use any C code.
 #help:
 #help: The `./mk ./CLI/miniooni` command builds the miniooni experimental
 #help: command line client for all the supported GOOS/GOARCH.
@@ -133,65 +62,65 @@ GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
 	./CLI/miniooni-darwin-arm64 \
 	./CLI/miniooni-linux-386 \
 	./CLI/miniooni-linux-amd64 \
+	./CLI/miniooni-linux-armv6 \
 	./CLI/miniooni-linux-armv7 \
 	./CLI/miniooni-linux-arm64 \
 	./CLI/miniooni-windows-386.exe \
 	./CLI/miniooni-windows-amd64.exe
 
-# All the miniooni targets build with CGO_ENABLED=0 such that the build
-# succeeds when the GOOS/GOARCH is such that we aren't crosscompiling
-# (e.g., targeting darwin/amd64 on darwin/amd64) _and_ there's no C compiler
-# installed on the system. We can afford that since miniooni is pure Go.
 #help:
 #help: * `./mk ./CLI/miniooni-darwin-amd64`: darwin/amd64
 .PHONY:   ./CLI/miniooni-darwin-amd64
 ./CLI/miniooni-darwin-amd64: search/for/go maybe/copypsiphon
-	GOOS=darwin GOARCH=amd64 CGO_ENABLED=0 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross darwin amd64 ./internal/cmd/miniooni
 
 #help:
 #help: * `./mk ./CLI/miniooni-darwin-arm64`: darwin/arm64
 .PHONY:   ./CLI/miniooni-darwin-arm64
 ./CLI/miniooni-darwin-arm64: search/for/go maybe/copypsiphon
-	GOOS=darwin GOARCH=arm64 CGO_ENABLED=0 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross darwin arm64 ./internal/cmd/miniooni
 
-# When building for Linux we use `-tags netgo` and `-extldflags -static` to produce
-# a statically linked binary that completely bypasses libc.
 #help:
 #help: * `./mk ./CLI/miniooni-linux-386`: linux/386
 .PHONY:   ./CLI/miniooni-linux-386
 ./CLI/miniooni-linux-386: search/for/go maybe/copypsiphon
-	GOOS=linux GOARCH=386 CGO_ENABLED=0 go build -tags="netgo,$(OONI_PSIPHON_TAGS)" -ldflags="-s -w -extldflags -static" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross linux 386 ./internal/cmd/miniooni
 
 #help:
 #help: * `./mk ./CLI/miniooni-linux-amd64`: linux/amd64
 .PHONY:   ./CLI/miniooni-linux-amd64
 ./CLI/miniooni-linux-amd64: search/for/go maybe/copypsiphon
-	GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -tags="netgo,$(OONI_PSIPHON_TAGS)" -ldflags="-s -w -extldflags -static" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross linux amd64 ./internal/cmd/miniooni
+
+#help:
+#help: * `./mk ./CLI/miniooni-linux-armv6`: linux/armv6
+.PHONY:   ./CLI/miniooni-linux-armv6
+./CLI/miniooni-linux-armv6: search/for/go maybe/copypsiphon
+	./CLI/go-build-cross linux armv6 ./internal/cmd/miniooni
 
-# When building for GOARCH=arm, we always force GOARM=7 (i.e., armhf/armv7).
 #help:
 #help: * `./mk ./CLI/miniooni-linux-armv7`: linux/armv7
 .PHONY:   ./CLI/miniooni-linux-armv7
 ./CLI/miniooni-linux-armv7: search/for/go maybe/copypsiphon
-	GOOS=linux GOARCH=arm CGO_ENABLED=0 GOARM=7 go build -tags="netgo,$(OONI_PSIPHON_TAGS)" -ldflags="-s -w -extldflags -static" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross linux armv7 ./internal/cmd/miniooni
 
 #help:
 #help: * `./mk ./CLI/miniooni-linux-arm64`: linux/arm64
 .PHONY:   ./CLI/miniooni-linux-arm64
 ./CLI/miniooni-linux-arm64: search/for/go maybe/copypsiphon
-	GOOS=linux GOARCH=arm64 CGO_ENABLED=0 go build -tags="netgo,$(OONI_PSIPHON_TAGS)" -ldflags="-s -w -extldflags -static" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross linux arm64 ./internal/cmd/miniooni
 
 #help:
 #help: * `./mk ./CLI/miniooni-windows-386.exe`: windows/386
 .PHONY:   ./CLI/miniooni-windows-386.exe
 ./CLI/miniooni-windows-386.exe: search/for/go maybe/copypsiphon
-	GOOS=windows GOARCH=386 CGO_ENABLED=0 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross windows 386 ./internal/cmd/miniooni
 
 #help:
 #help: * `./mk ./CLI/miniooni-windows-amd64.exe`: windows/amd64
 .PHONY:   ./CLI/miniooni-windows-amd64.exe
 ./CLI/miniooni-windows-amd64.exe: search/for/go maybe/copypsiphon
-	GOOS=windows GOARCH=amd64 CGO_ENABLED=0 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./internal/cmd/miniooni
+	./CLI/go-build-cross windows amd64 ./internal/cmd/miniooni
 
 #help:
 #help: The `./mk ./CLI/ooniprobe-darwin` command builds the ooniprobe official
@@ -201,19 +130,17 @@ GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
 .PHONY: ./CLI/ooniprobe-darwin
 ./CLI/ooniprobe-darwin: ./CLI/ooniprobe-darwin-amd64 ./CLI/ooniprobe-darwin-arm64
 
-# We force CGO_ENABLED=1 because in principle we may be cross compiling. In
-# reality it's hard to see a macOS/darwin build not made on macOS.
 #help:
 #help: * `./mk ./CLI/ooniprobe-darwin-amd64`: darwin/amd64
 .PHONY:     ./CLI/ooniprobe-darwin-amd64
 ./CLI/ooniprobe-darwin-amd64: search/for/go maybe/copypsiphon
-	GOOS=darwin GOARCH=amd64 CGO_ENABLED=1 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./cmd/ooniprobe
+	./CLI/go-build-darwin amd64 ./cmd/ooniprobe
 
 #help:
 #help: * `./mk ./CLI/ooniprobe-darwin-arm64`: darwin/arm64
 .PHONY:     ./CLI/ooniprobe-darwin-arm64
 ./CLI/ooniprobe-darwin-arm64: search/for/go maybe/copypsiphon
-	GOOS=darwin GOARCH=arm64 CGO_ENABLED=1 go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./cmd/ooniprobe
+	./CLI/go-build-darwin arm64 ./cmd/ooniprobe
 
 #help:
 #help: The `./mk ./CLI/ooniprobe-linux` command builds the ooniprobe official command
@@ -227,35 +154,29 @@ GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
 	./CLI/ooniprobe-linux-armv7 \
 	./CLI/ooniprobe-linux-arm64
 
-# Linux builds use Alpine and Docker so we are sure that we are statically
-# linking to musl libc, thus making our binaries extremely portable.
 #help:
 #help: * `./mk ./CLI/ooniprobe-linux-386`: linux/386
 .PHONY:     ./CLI/ooniprobe-linux-386
 ./CLI/ooniprobe-linux-386: search/for/docker maybe/copypsiphon
-	docker pull --platform linux/386 $(GOLANG_DOCKER_IMAGE)
-	docker run --platform linux/386 -e GOPATH=/gopath -e GOARCH=386 -v $(shell pwd):/ooni -w /ooni $(GOLANG_DOCKER_IMAGE) ./CLI/build-linux -tags=netgo,$(OONI_PSIPHON_TAGS) $(GOLANG_EXTRA_FLAGS)
+	./CLI/go-build-linux-static 386 ./cmd/ooniprobe
 
 #help:
 #help: * `./mk ./CLI/ooniprobe-linux-amd64`: linux/amd64
 .PHONY:     ./CLI/ooniprobe-linux-amd64
 ./CLI/ooniprobe-linux-amd64: search/for/docker maybe/copypsiphon
-	docker pull --platform linux/amd64 $(GOLANG_DOCKER_IMAGE)
-	docker run --platform linux/amd64 -e GOPATH=/gopath -e GOARCH=amd64 -v $(shell pwd):/ooni -w /ooni $(GOLANG_DOCKER_IMAGE) ./CLI/build-linux -tags=netgo,$(OONI_PSIPHON_TAGS) $(GOLANG_EXTRA_FLAGS)
+	./CLI/go-build-linux-static amd64 ./cmd/ooniprobe
 
 #help:
 #help: * `./mk ./CLI/ooniprobe-linux-armv7`: linux/arm
 .PHONY:     ./CLI/ooniprobe-linux-armv7
 ./CLI/ooniprobe-linux-armv7: search/for/docker maybe/copypsiphon
-	docker pull --platform linux/arm/v7 $(GOLANG_DOCKER_IMAGE)
-	docker run --platform linux/arm/v7 -e GOPATH=/gopath -e GOARCH=arm -e GOARM=7 -v $(shell pwd):/ooni -w /ooni $(GOLANG_DOCKER_IMAGE) ./CLI/build-linux -tags=netgo,$(OONI_PSIPHON_TAGS) $(GOLANG_EXTRA_FLAGS)
+	./CLI/go-build-linux-static armv7 ./cmd/ooniprobe
 
 #help:
 #help: * `./mk ./CLI/ooniprobe-linux-arm64`: linux/arm64
 .PHONY:     ./CLI/ooniprobe-linux-arm64
 ./CLI/ooniprobe-linux-arm64: search/for/docker maybe/copypsiphon
-	docker pull --platform linux/arm64 $(GOLANG_DOCKER_IMAGE)
-	docker run --platform linux/arm64 -e GOPATH=/gopath -e GOARCH=arm64 -v $(shell pwd):/ooni -w /ooni $(GOLANG_DOCKER_IMAGE) ./CLI/build-linux -tags=netgo,$(OONI_PSIPHON_TAGS) $(GOLANG_EXTRA_FLAGS)
+	./CLI/go-build-linux-static arm64 ./cmd/ooniprobe
 
 #help:
 #help: The `./mk ./CLI/ooniprobe-windows` command builds the ooniprobe official
@@ -271,13 +192,13 @@ GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
 #help: * `./mk ./CLI/ooniprobe-windows-386.exe`: windows/386
 .PHONY:     ./CLI/ooniprobe-windows-386.exe
 ./CLI/ooniprobe-windows-386.exe: search/for/go search/for/mingw-w64 maybe/copypsiphon
-	GOOS=windows GOARCH=386 CGO_ENABLED=1 CC=i686-w64-mingw32-gcc go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./cmd/ooniprobe
+	./CLI/go-build-windows 386 ./cmd/ooniprobe
 
 #help:
 #help: * `./mk ./CLI/ooniprobe-windows-amd64.exe`: windows/amd64
 .PHONY:     ./CLI/ooniprobe-windows-amd64.exe
 ./CLI/ooniprobe-windows-amd64.exe: search/for/go search/for/mingw-w64 maybe/copypsiphon
-	GOOS=windows GOARCH=amd64 CGO_ENABLED=1 CC=x86_64-w64-mingw32-gcc go build -tags="$(OONI_PSIPHON_TAGS)" -ldflags="-s -w" $(GOLANG_EXTRA_FLAGS) -o $@ ./cmd/ooniprobe
+	./CLI/go-build-windows amd64 ./cmd/ooniprobe
 
 #help:
 #help: The `./mk ./MOBILE/android` command builds the oonimkall library for Android.
@@ -290,22 +211,15 @@ GOLANG_DOCKER_IMAGE = golang:$(GOLANG_VERSION_NUMBER)-alpine
 #help: * `./mk ./MOBILE/android/oonimkall.pom`: the POM
 .PHONY:   ./MOBILE/android/oonimkall.pom
 ./MOBILE/android/oonimkall.pom:
-	cat ./MOBILE/android/template.pom | sed -e "s/@VERSION@/$(OONIMKALL_V)/g" > ./MOBILE/android/oonimkall.pom
-
-# GOMOBILE is the full path location to the gomobile binary. We want to
-# execute this command every time, because its output may depend on context,
-# for this reason WE ARE NOT using `:=`.
-GOMOBILE = $(shell go env GOPATH)/bin/gomobile
+	./MOBILE/android/createpom
 
 #help:
 #help: * `./mk ./MOBILE/android/oonimkall.aar`: the AAR
 .PHONY:   ./MOBILE/android/oonimkall.aar
-./MOBILE/android/oonimkall.aar: android/sdk maybe/copypsiphon
+./MOBILE/android/oonimkall.aar: search/for/android/sdk maybe/copypsiphon
 	@echo "Android build disabled - TODO(https://github.com/ooni/probe/issues/2122)"
 	@exit 1
-	go get -u golang.org/x/mobile/cmd/gomobile
-	$(GOMOBILE) init
-	PATH=$(shell go env GOPATH)/bin:$$PATH ANDROID_HOME=$(OONI_ANDROID_HOME) ANDROID_NDK_HOME=$(OONI_ANDROID_HOME)/ndk/$(ANDROID_NDK_VERSION) $(GOMOBILE) bind -x -target android -o ./MOBILE/android/oonimkall.aar -tags="$(OONI_PSIPHON_TAGS)" -ldflags '-s -w' $(GOLANG_EXTRA_FLAGS) ./pkg/oonimkall
+	./MOBILE/gomobile android ./pkg/oonimkall
 
 #help:
 #help: The `./mk ./MOBILE/ios` command builds the oonimkall library for iOS.
@@ -318,129 +232,47 @@ GOMOBILE = $(shell go env GOPATH)/bin/gomobile
 #help: * `./mk ./MOBILE/ios/oonimkall.xcframework.zip`: zip the xcframework
 .PHONY:   ./MOBILE/ios/oonimkall.xcframework.zip
 ./MOBILE/ios/oonimkall.xcframework.zip: search/for/zip ./MOBILE/ios/oonimkall.xcframework
-	cd ./MOBILE/ios && rm -rf oonimkall.xcframework.zip
-	cd ./MOBILE/ios && zip -yr oonimkall.xcframework.zip oonimkall.xcframework
+	./MOBILE/ios/zipframework
 
 #help:
 #help: * `./mk ./MOBILE/ios/xcframework`: the xcframework
 .PHONY:     ./MOBILE/ios/oonimkall.xcframework
 ./MOBILE/ios/oonimkall.xcframework: search/for/go search/for/xcode maybe/copypsiphon
-	go get -u golang.org/x/mobile/cmd/gomobile
-	$(GOMOBILE) init
-	PATH=$(shell go env GOPATH)/bin:$$PATH $(GOMOBILE) bind -target ios -o $@ -tags="$(OONI_PSIPHON_TAGS)" -ldflags '-s -w' $(GOLANG_EXTRA_FLAGS) ./pkg/oonimkall
+	./MOBILE/gomobile ios ./pkg/oonimkall
 
 #help:
 #help: * `./mk ./MOBILE/ios/oonimkall.podspec`: the podspec
 .PHONY:   ./MOBILE/ios/oonimkall.podspec
 ./MOBILE/ios/oonimkall.podspec: ./MOBILE/ios/template.podspec
-	cat $< | sed -e "s/@VERSION@/$(OONIMKALL_V)/g" -e "s/@RELEASE@/$(OONIMKALL_R)/g" > $@
+	./MOBILE/ios/createpodspec
 
-# important: OONIMKALL_V and OONIMKALL_R MUST be expanded just once so we use `:=`
-OONIMKALL_V := $(shell date -u +%Y.%m.%d-%H%M%S)
-OONIMKALL_R := $(shell git describe --tags || echo '0.0.0-dev')
-
-#help:
-#help: The following commands check for the availability of dependencies:
-# TODO(bassosimone): make checks more robust?
-
-#help:
-#help: * `./mk search/for/bash`: checks for bash
-.PHONY: search/for/bash
-search/for/bash:
-	@printf "checking for bash... "
-	@command -v bash || { echo "not found"; exit 1; }
-
-#help:
-#help: * `./mk search/for/curl`: checks for curl
-.PHONY: search/for/curl
-search/for/curl:
-	@printf "checking for curl... "
-	@command -v curl || { echo "not found"; exit 1; }
-
-#help:
-#help: * `./mk search/for/docker`: checks for docker
 .PHONY: search/for/docker
 search/for/docker:
 	@printf "checking for docker... "
 	@command -v docker || { echo "not found"; exit 1; }
 
-#help:
-#help: * `./mk search/for/git`: checks for git
 .PHONY: search/for/git
 search/for/git:
 	@printf "checking for git... "
 	@command -v git || { echo "not found"; exit 1; }
 
-#help:
-#help: * `./mk search/for/go`: checks for go
 .PHONY: search/for/go
 search/for/go:
-	@printf "checking for go... "
-	@command -v go || { echo "not found"; exit 1; }
-	@printf "checking for go version... "
-	@echo $(__GOVERSION_REAL)
-	@[ "$(GOLANG_VERSION_STRING)" = "$(__GOVERSION_REAL)" ] || { echo "fatal: go version must be $(GOLANG_VERSION_STRING) instead of $(__GOVERSION_REAL)"; exit 1; }
+	./CLI/check-go-version
 
-# __GOVERSION_REAL is the go version reported by the go binary (we
-# SHOULD NOT cache this value so we ARE NOT using `:=`)
-__GOVERSION_REAL = $(shell go version | awk '{print $$3}')
-
-#help:
-#help: * `./mk search/for/java`: checks for java
 .PHONY: search/for/java
 search/for/java:
 	@printf "checking for java... "
 	@command -v java || { echo "not found"; exit 1; }
 
-#help:
-#help: * `./mk search/for/mingw-w64`: checks for mingw-w64
 .PHONY: search/for/mingw-w64
 search/for/mingw-w64:
-	@printf "checking for x86_64-w64-mingw32-gcc... "
-	@command -v x86_64-w64-mingw32-gcc || { echo "not found"; exit 1; }
-	@printf "checking for x86_64-w64-mingw32-gcc version... "
-	@echo $(__MINGW32_AMD64_VERSION)
-	@[ "$(MINGW_W64_VERSION)" = "$(__MINGW32_AMD64_VERSION)" ] || { echo "fatal: x86_64-w64-mingw32-gcc version must be $(MINGW_W64_VERSION) instead of $(__MINGW32_AMD64_VERSION)"; exit 1; }
-	@printf "checking for i686-w64-mingw32-gcc... "
-	@command -v i686-w64-mingw32-gcc || { echo "not found"; exit 1; }
-	@printf "checking for i686-w64-mingw32-gcc version... "
-	@echo $(__MINGW32_386_VERSION)
-	@[ "$(MINGW_W64_VERSION)" = "$(__MINGW32_386_VERSION)" ] || { echo "fatal: i686-w64-mingw32-gcc version must be $(MINGW_W64_VERSION) instead of $(__MINGW32_386_VERSION)"; exit 1; }
+	./CLI/check-mingw-w64-version
 
-# __MINGW32_AMD64_VERSION and __MINGW32_386_VERSION are the versions
-# reported by the amd64 and 386 mingw binaries.
-__MINGW32_AMD64_VERSION = $(shell x86_64-w64-mingw32-gcc --version | sed -n 1p | awk '{print $$3}')
-__MINGW32_386_VERSION = $(shell i686-w64-mingw32-gcc --version | sed -n 1p | awk '{print $$3}')
-
-#help:
-#help: * `./mk search/for/shasum`: checks for shasum
-.PHONY: search/for/shasum
-search/for/shasum:
-	@printf "checking for shasum... "
-	@command -v shasum || { echo "not found"; exit 1; }
-
-#help:
-#help: * `./mk search/for/xcode`: checks for Xcode
 .PHONY: search/for/xcode
 search/for/xcode:
-	@printf "checking for xcodebuild... "
-	@command -v xcodebuild || { echo "not found"; exit 1; }
-	@printf "checking for Xcode version... "
-	@echo $(__XCODEVERSION_REAL)
-	@[ "$(XCODE_VERSION)" = "$(__XCODEVERSION_REAL)" ] || { echo "fatal: Xcode version must be $(XCODE_VERSION) instead of $(__XCODEVERSION_REAL)"; exit 1; }
+	./MOBILE/ios/check-xcode-version
 
-# __XCODEVERSION_REAL is the version of Xcode obtained using xcodebuild
-__XCODEVERSION_REAL = `xcodebuild -version | grep ^Xcode | awk '{print $$2}'`
-
-#help:
-#help: * `./mk search/for/unzip`: checks for unzip
-.PHONY: search/for/unzip
-search/for/unzip:
-	@printf "checking for unzip... "
-	@command -v unzip || { echo "not found"; exit 1; }
-
-#help:
-#help: * `./mk search/for/zip`: checks for zip
 .PHONY: search/for/zip
 search/for/zip:
 	@printf "checking for zip... "
@@ -461,56 +293,16 @@ search/for/zip:
 #
 # Cloning the private repository, instead, is the way in which
 # local builds get access to the psiphon config files.
+#
 .PHONY: maybe/copypsiphon
 maybe/copypsiphon: search/for/git
 	@if test "$(OONI_PSIPHON_TAGS)" = "ooni_psiphon_config"; then \
 		if test ! -f ./internal/engine/psiphon-config.json.age -a \
 		        ! -f ./internal/engine/psiphon-config.key; then \
-			echo "copying psiphon configuration file into ./internal/engine"; \
-			$(MAKE) -f mk $(OONIPRIVATE) || exit 1; \
-			cp $(OONIPRIVATE)/psiphon-config.key ./internal/engine || exit 1; \
-			cp $(OONIPRIVATE)/psiphon-config.json.age ./internal/engine || exit 1; \
+			./script/copy-psiphon-files.bash $(GIT_CLONE_DIR) || exit 1; \
 		fi; \
 	fi
 
-# OONIPRIVATE is the directory where we clone the private repository.
-OONIPRIVATE = $(GIT_CLONE_DIR)/github.com/ooni/probe-private
-
-# OONIPRIVATE_REPO is the private repository URL.
-OONIPRIVATE_REPO = git@github.com:ooni/probe-private
-
-# $(OONIPRIVATE) clones the private repository in $(GIT_CLONE_DIR)
-$(OONIPRIVATE): search/for/git $(GIT_CLONE_DIR)
-	rm -rf $(OONIPRIVATE)
-	git clone $(OONIPRIVATE_REPO) $(OONIPRIVATE)
-
-#help:
-#help: The `./mk android/sdk` command ensures we are using the
-#help: correct version of the Android sdk.
-.PHONY: android/sdk
-android/sdk: search/for/java
-	rm -rf $(OONI_ANDROID_HOME)
-	$(MAKE) -f mk android/sdk/download
-	test -f $(__ANDROID_SDKMANAGER) || { echo "please run './mk android/sdk/download'"; exit 1; }
-	echo "Yes" | $(__ANDROID_SDKMANAGER) --install $(ANDROID_INSTALL_EXTRA) 'ndk;$(ANDROID_NDK_VERSION)'
-
-# __ANDROID_SKDMANAGER is the path to android's sdkmanager tool
-__ANDROID_SDKMANAGER = $(OONI_ANDROID_HOME)/cmdline-tools/$(ANDROID_CLI_VERSION)/bin/sdkmanager
-
-# See https://stackoverflow.com/a/61176718 to understand why
-# we need to reorganize the directories like this:
-#help:
-#help: The `./mk android/sdk/download` unconditionally downloads the
-#help: Android SDK at `$(OONI_ANDROID_HOME)`.
-android/sdk/download: search/for/curl search/for/java search/for/shasum search/for/unzip
-	curl -fsSLO https://dl.google.com/android/repository/$(__ANDROID_CLITOOLS_FILE)
-	echo "$(ANDROID_CLI_SHA256)  $(__ANDROID_CLITOOLS_FILE)" > __SHA256
-	shasum --check __SHA256
-	rm -f __SHA256
-	unzip $(__ANDROID_CLITOOLS_FILE)
-	rm $(__ANDROID_CLITOOLS_FILE)
-	mkdir -p $(OONI_ANDROID_HOME)/cmdline-tools
-	mv cmdline-tools $(OONI_ANDROID_HOME)/cmdline-tools/$(ANDROID_CLI_VERSION)
-
-# __ANDROID_CLITOOLS_FILE is the file name of the android cli tools zip
-__ANDROID_CLITOOLS_FILE = commandlinetools-linux-$(ANDROID_CLI_VERSION)_latest.zip
+.PHONY: search/for/android/sdk
+search/for/android/sdk: search/for/java
+	./MOBILE/android/ensure
diff --git a/script/copy-psiphon-files.bash b/script/copy-psiphon-files.bash
new file mode 100755
index 0000000..aa9bb63
--- /dev/null
+++ b/script/copy-psiphon-files.bash
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -euo pipefail
+
+if [[ $# -ne 1 ]]; then
+	echo "usage: $0 DIRECTORY" 1>&2
+	exit 1
+fi
+
+GIT_CLONE_DIR=$1
+mkdir -p $GIT_CLONE_DIR
+
+OONIPRIVATE_DIR=$GIT_CLONE_DIR/github.com/ooni/probe-private
+OONIPRIVATE_REPO=git@github.com:ooni/probe-private
+
+if [[ ! -d $OONIPRIVATE_DIR ]]; then
+	git clone $OONIPRIVATE_REPO $OONIPRIVATE_DIR
+fi
+
+cp $OONIPRIVATE_DIR/psiphon-config.key ./internal/engine
+cp $OONIPRIVATE_DIR/psiphon-config.json.age ./internal/engine