diff --git a/.circleci/Dockerfile.centos b/.circleci/Dockerfile.centos
index febb61545..9070d71d9 100644
--- a/.circleci/Dockerfile.centos
+++ b/.circleci/Dockerfile.centos
@@ -1,5 +1,6 @@
 ARG TAG
 FROM centos:${TAG}
+ARG PYTHON_VERSION
 
 ENV WHEELHOUSE_PATH /tmp/wheelhouse
 ENV VIRTUALENV_PATH /tmp/venv
@@ -11,8 +12,8 @@ RUN yum install --assumeyes \
     git \
     sudo \
     make automake gcc gcc-c++ \
-    python2 \
-    python2-devel \
+    python${PYTHON_VERSION} \
+    python${PYTHON_VERSION}-devel \
     libffi-devel \
     openssl-devel \
     libyaml \
@@ -23,4 +24,4 @@ RUN yum install --assumeyes \
 # *update* this checkout on each job run, saving us more time per-job.
 COPY . ${BUILD_SRC_ROOT}
 
-RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python2.7"
+RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python${PYTHON_VERSION}"
diff --git a/.circleci/Dockerfile.debian b/.circleci/Dockerfile.debian
index de16148e0..96c54736c 100644
--- a/.circleci/Dockerfile.debian
+++ b/.circleci/Dockerfile.debian
@@ -1,5 +1,6 @@
 ARG TAG
 FROM debian:${TAG}
+ARG PYTHON_VERSION
 
 ENV WHEELHOUSE_PATH /tmp/wheelhouse
 ENV VIRTUALENV_PATH /tmp/venv
@@ -8,22 +9,22 @@ ENV BUILD_SRC_ROOT /tmp/project
 
 RUN apt-get --quiet update && \
     apt-get --quiet --yes install \
-    	git \
-	lsb-release \
+        git \
+        lsb-release \
         sudo \
-    	build-essential \
-	python2.7 \
-    	python2.7-dev \
-    	libffi-dev \
-    	libssl-dev \
-    	libyaml-dev \
-    	virtualenv
+        build-essential \
+        python${PYTHON_VERSION} \
+        python${PYTHON_VERSION}-dev \
+        libffi-dev \
+        libssl-dev \
+        libyaml-dev \
+        virtualenv
 
 # Get the project source.  This is better than it seems.  CircleCI will
 # *update* this checkout on each job run, saving us more time per-job.
 COPY . ${BUILD_SRC_ROOT}
 
-RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python2.7"
+RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python${PYTHON_VERSION}"
 
 # Only the integration tests currently need this but it doesn't hurt to always
 # have it present and it's simpler than building a whole extra image just for
diff --git a/.circleci/Dockerfile.fedora b/.circleci/Dockerfile.fedora
index 6ad22d676..e60dbb85d 100644
--- a/.circleci/Dockerfile.fedora
+++ b/.circleci/Dockerfile.fedora
@@ -1,5 +1,6 @@
 ARG TAG
 FROM fedora:${TAG}
+ARG PYTHON_VERSION
 
 ENV WHEELHOUSE_PATH /tmp/wheelhouse
 ENV VIRTUALENV_PATH /tmp/venv
@@ -11,8 +12,8 @@ RUN yum install --assumeyes \
     git \
     sudo \
     make automake gcc gcc-c++ \
-    python \
-    python-devel \
+    python${PYTHON_VERSION} \
+    python${PYTHON_VERSION}-devel \
     libffi-devel \
     openssl-devel \
     libyaml-devel \
@@ -23,4 +24,4 @@ RUN yum install --assumeyes \
 # *update* this checkout on each job run, saving us more time per-job.
 COPY . ${BUILD_SRC_ROOT}
 
-RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python2.7"
+RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python${PYTHON_VERSION}"
diff --git a/.circleci/Dockerfile.ubuntu b/.circleci/Dockerfile.ubuntu
index 882dfe308..2fcc60f5a 100644
--- a/.circleci/Dockerfile.ubuntu
+++ b/.circleci/Dockerfile.ubuntu
@@ -1,5 +1,6 @@
 ARG TAG
 FROM ubuntu:${TAG}
+ARG PYTHON_VERSION
 
 ENV WHEELHOUSE_PATH /tmp/wheelhouse
 ENV VIRTUALENV_PATH /tmp/venv
@@ -13,8 +14,8 @@ RUN apt-get --quiet update && \
     apt-get --quiet --yes install \
         sudo \
         build-essential \
-        python2.7 \
-        python2.7-dev \
+        python${PYTHON_VERSION} \
+        python${PYTHON_VERSION}-dev \
         libffi-dev \
         libssl-dev \
         libyaml-dev \
@@ -26,4 +27,4 @@ RUN apt-get --quiet update && \
 # *update* this checkout on each job run, saving us more time per-job.
 COPY . ${BUILD_SRC_ROOT}
 
-RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python2.7"
+RUN "${BUILD_SRC_ROOT}"/.circleci/prepare-image.sh "${WHEELHOUSE_PATH}" "${VIRTUALENV_PATH}" "${BUILD_SRC_ROOT}" "python${PYTHON_VERSION}"
diff --git a/.circleci/config.yml b/.circleci/config.yml
index 327366378..e75a6ba0f 100644
--- a/.circleci/config.yml
+++ b/.circleci/config.yml
@@ -31,6 +31,9 @@ workflows:
       # Test against PyPy 2.7
       - "pypy2.7-buster"
 
+      # Just one Python 3.6 configuration while the port is in-progress.
+      - "python3.6"
+
       # Other assorted tasks and configurations
       - "lint"
       - "pyinstaller"
@@ -71,6 +74,7 @@ workflows:
       - "build-image-fedora-29"
       - "build-image-centos-8"
       - "build-image-pypy-2.7-buster"
+      - "build-image-python36-ubuntu"
 
 
 jobs:
@@ -118,7 +122,7 @@ jobs:
 
   debian-9: &DEBIAN
     docker:
-      - image: "tahoelafsci/debian:9"
+      - image: "tahoelafsci/debian:9-py2.7"
         user: "nobody"
 
     environment: &UTF_8_ENVIRONMENT
@@ -195,14 +199,14 @@ jobs:
   debian-8:
     <<: *DEBIAN
     docker:
-      - image: "tahoelafsci/debian:8"
+      - image: "tahoelafsci/debian:8-py2.7"
         user: "nobody"
 
 
   pypy2.7-buster:
     <<: *DEBIAN
     docker:
-      - image: "tahoelafsci/pypy:2.7-buster"
+      - image: "tahoelafsci/pypy:buster-py2"
         user: "nobody"
 
     environment:
@@ -258,17 +262,28 @@ jobs:
   ubuntu-16.04:
     <<: *DEBIAN
     docker:
-      - image: "tahoelafsci/ubuntu:16.04"
+      - image: "tahoelafsci/ubuntu:16.04-py2.7"
         user: "nobody"
 
 
-  ubuntu-18.04:
+  ubuntu-18.04: &UBUNTU_18_04
     <<: *DEBIAN
     docker:
-      - image: "tahoelafsci/ubuntu:18.04"
+      - image: "tahoelafsci/ubuntu:18.04-py2.7"
         user: "nobody"
 
 
+  python3.6:
+    <<: *UBUNTU_18_04
+    docker:
+      - image: "tahoelafsci/ubuntu:18.04-py3"
+        user: "nobody"
+
+    environment:
+      <<: *UTF_8_ENVIRONMENT
+      TAHOE_LAFS_TOX_ENVIRONMENT: "py36"
+
+
   ubuntu-20.04:
     <<: *DEBIAN
     docker:
@@ -278,7 +293,7 @@ jobs:
 
   centos-8: &RHEL_DERIV
     docker:
-      - image: "tahoelafsci/centos:8"
+      - image: "tahoelafsci/centos:8-py2"
         user: "nobody"
 
     environment: *UTF_8_ENVIRONMENT
@@ -300,14 +315,14 @@ jobs:
   fedora-28:
     <<: *RHEL_DERIV
     docker:
-      - image: "tahoelafsci/fedora:28"
+      - image: "tahoelafsci/fedora:28-py"
         user: "nobody"
 
 
   fedora-29:
     <<: *RHEL_DERIV
     docker:
-      - image: "tahoelafsci/fedora:29"
+      - image: "tahoelafsci/fedora:29-py"
         user: "nobody"
 
 
@@ -374,8 +389,9 @@ jobs:
       - image: "docker:17.05.0-ce-git"
 
     environment:
-      DISTRO: "tahoelafsci/<DISTRO>:foo"
-      TAG: "tahoelafsci/distro:<TAG>"
+      DISTRO: "tahoelafsci/<DISTRO>:foo-py2"
+      TAG: "tahoelafsci/distro:<TAG>-py2"
+      PYTHON_VERSION: "tahoelafsci/distro:tag-py<PYTHON_VERSION}"
 
     steps:
       - "checkout"
@@ -427,13 +443,14 @@ jobs:
             docker \
                 build \
                 --build-arg TAG=${TAG} \
-                -t tahoelafsci/${DISTRO}:${TAG} \
+                --build-arg PYTHON_VERSION=${PYTHON_VERSION} \
+                -t tahoelafsci/${DISTRO}:${TAG}-py${PYTHON_VERSION} \
                 -f ~/project/.circleci/Dockerfile.${DISTRO} \
                 ~/project/
       - run:
           name: "Push image"
           command: |
-            docker push tahoelafsci/${DISTRO}:${TAG}
+            docker push tahoelafsci/${DISTRO}:${TAG}-py${PYTHON_VERSION}
 
 
   build-image-debian-8:
@@ -442,6 +459,7 @@ jobs:
     environment:
       DISTRO: "debian"
       TAG: "8"
+      PYTHON_VERSION: "2.7"
 
 
   build-image-debian-9:
@@ -450,6 +468,7 @@ jobs:
     environment:
       DISTRO: "debian"
       TAG: "9"
+      PYTHON_VERSION: "2.7"
 
 
   build-image-ubuntu-16.04:
@@ -458,6 +477,7 @@ jobs:
     environment:
       DISTRO: "ubuntu"
       TAG: "16.04"
+      PYTHON_VERSION: "2.7"
 
 
   build-image-ubuntu-18.04:
@@ -466,6 +486,16 @@ jobs:
     environment:
       DISTRO: "ubuntu"
       TAG: "18.04"
+      PYTHON_VERSION: "2.7"
+
+
+  build-image-python36-ubuntu:
+    <<: *BUILD_IMAGE
+
+    environment:
+      DISTRO: "ubuntu"
+      TAG: "18.04"
+      PYTHON_VERSION: "3"
 
 
   build-image-ubuntu-20.04:
@@ -482,6 +512,7 @@ jobs:
     environment:
       DISTRO: "centos"
       TAG: "8"
+      PYTHON_VERSION: "2"
 
 
   build-image-fedora-28:
@@ -490,6 +521,8 @@ jobs:
     environment:
       DISTRO: "fedora"
       TAG: "28"
+      # The default on Fedora (this version anyway) is still Python 2.
+      PYTHON_VERSION: ""
 
 
   build-image-fedora-29:
@@ -505,4 +538,8 @@ jobs:
 
     environment:
       DISTRO: "pypy"
-      TAG: "2.7-buster"
+      TAG: "buster"
+      # We only have Python 2 for PyPy right now so there's no support for
+      # setting up PyPy 3 in the image building toolchain.  This value is just
+      # for constructing the right Docker image tag.
+      PYTHON_VERSION: "2"
diff --git a/.circleci/populate-wheelhouse.sh b/.circleci/populate-wheelhouse.sh
index 75afb6f6f..519a80cac 100755
--- a/.circleci/populate-wheelhouse.sh
+++ b/.circleci/populate-wheelhouse.sh
@@ -36,8 +36,9 @@ PIP="${BOOTSTRAP_VENV}/bin/pip"
 # Tell pip where it can find any existing wheels.
 export PIP_FIND_LINKS="file://${WHEELHOUSE_PATH}"
 
-# Populate the wheelhouse, if necessary.
-"${PIP}" \
+# Populate the wheelhouse, if necessary.  zfec 1.5.3 can only be built with a
+# UTF-8 environment so make sure we have one, at least for this invocation.
+LANG="en_US.UTF-8" "${PIP}" \
     wheel \
     --wheel-dir "${WHEELHOUSE_PATH}" \
     "${PROJECT_ROOT}"[test] \
diff --git a/.circleci/run-tests.sh b/.circleci/run-tests.sh
index c26acdcbc..8894b9691 100755
--- a/.circleci/run-tests.sh
+++ b/.circleci/run-tests.sh
@@ -81,7 +81,16 @@ ${TIMEOUT} ${BOOTSTRAP_VENV}/bin/tox \
     ${TAHOE_LAFS_TOX_ARGS} || "${alternative}"
 
 if [ -n "${ARTIFACTS}" ]; then
+    if [ ! -e "${SUBUNIT2}" ]; then
+	echo "subunitv2 output file does not exist: ${SUBUNIT2}"
+	exit 1
+    fi
+
     # Create a junitxml results area.
     mkdir -p "$(dirname "${JUNITXML}")"
-    ${BOOTSTRAP_VENV}/bin/subunit2junitxml < "${SUBUNIT2}" > "${JUNITXML}" || "${alternative}"
+    # Always succeed even if subunit2junitxml fails.  subunit2junitxml signals
+    # failure if the stream it is processing contains test failures.  This is
+    # not what we care about.  If we cared about it, the test command above
+    # would have signalled failure already and we wouldn't be here.
+    "${BOOTSTRAP_VENV}"/bin/subunit2junitxml < "${SUBUNIT2}" > "${JUNITXML}" || true
 fi
diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index 40f351ae6..000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,40 +0,0 @@
-sudo: false
-language: python
-cache: pip
-dist: xenial
-before_cache:
-  - rm -f $HOME/.cache/pip/log/debug.log
-git:
-  depth: 1000
-
-env:
-  global:
-    - TAHOE_LAFS_HYPOTHESIS_PROFILE=ci
-
-install:
-  - pip install --upgrade tox setuptools virtualenv
-  - echo $PATH; which python; which pip; which tox
-  - python misc/build_helpers/show-tool-versions.py
-
-script:
-  - |
-    set -eo pipefail
-    tox -e ${T}
-
-notifications:
-  email: false
-  irc:
-    channels: "chat.freenode.net#tahoe-lafs"
-    on_success: always # for testing
-    on_failure: always
-    template:
-      - "%{repository}#%{build_number} [%{branch}: %{commit} by %{author}] %{message}"
-      - "Changes: %{compare_url} | Details: %{build_url}"
-
-matrix:
-  include:
-  - os: linux
-    python: '3.6'
-    env: T=py36
-
-  fast_finish: true
diff --git a/misc/python3/ratchet.sh b/misc/python3/ratchet.sh
index a6a2c53c3..aa768cd06 100755
--- a/misc/python3/ratchet.sh
+++ b/misc/python3/ratchet.sh
@@ -11,8 +11,8 @@ cd "../.."
 
 # Since both of the next calls are expected to exit non-0, relax our guard.
 set +e
-SUBUNITREPORTER_OUTPUT_PATH="$base/results.subunit2" trial --reporter subunitv2-file allmydata
-subunit2junitxml < "$base/results.subunit2" > "$base/results.xml"
+trial --reporter=subunitv2-file allmydata
+subunit2junitxml < "${SUBUNITREPORTER_OUTPUT_PATH}" > "$base/results.xml"
 set -e
 
 # Okay, now we're clear.
@@ -32,6 +32,14 @@ set -e
 if [ $TERM = 'dumb' ]; then
   export TERM=ansi
 fi
-git diff "$tracking_filename"
 
-exit $code
+echo "The ${tracking_filename} diff is:"
+echo "================================="
+# "git diff" gets pretty confused in this execution context when trying to
+# write to stdout.  Somehow it fails with SIGTTOU.
+git diff -- "${tracking_filename}" > tracking.diff
+cat tracking.diff
+echo "================================="
+
+echo "Exiting with code ${code} from ratchet.py."
+exit ${code}
diff --git a/newsfragments/3336.minor b/newsfragments/3336.minor
new file mode 100644
index 000000000..e69de29bb
diff --git a/tox.ini b/tox.ini
index 908d24d54..0376ab28e 100644
--- a/tox.ini
+++ b/tox.ini
@@ -50,7 +50,7 @@ commands =
 
 [testenv:py36]
 # On macOS, git inside of ratchet.sh needs $HOME.
-passenv = HOME
+passenv = {[testenv]passenv} HOME
 commands = {toxinidir}/misc/python3/ratchet.sh
 
 [testenv:integration]