Merge pull request #4723 from libgit2/ethomson/ci

CI: Refactor and introduce VSTS builds

20 files changed, 661 insertions, 251 deletions

diff --git a/.travis.yml b/.travis.yml
index 61edba135..16f6ca5a4 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,9 +16,12 @@ env:
  global:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
+  - MBEDTLS_DIR=/tmp/mbedtls
+  - SKIP_APT=1
+  - SKIP_MBEDTLS_INSTALL=1
  matrix:
-  - OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
-  - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
+  - CMAKE_OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
+  - CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
 
 dist: trusty
 sudo: false
@@ -46,36 +49,33 @@ matrix:
      compiler: gcc
  include:
    - compiler: gcc
-     env: COVERITY=1
-     os: linux
-     dist: trusty
-   - compiler: gcc
      env:
-       - VALGRIND=1
-         OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
+       - LEAK_CHECK=valgrind
+         CMAKE_OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
      os: linux
      dist: trusty
    - compiler: gcc
      env:
-         MBEDTLS=1
-         OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=../deps/mbedtls"
+       - MBEDTLS=1
+         CMAKE_OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=/tmp/mbedtls"
      os: linux
    - compiler: gcc
      env:
-         MBEDTLS=1
-         OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=../deps/mbedtls"
+       - MBEDTLS=1
+         CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=/tmp/mbedtls"
      os: linux
  allow_failures:
    - env: COVERITY=1
 
 install:
-  - if [ -f ./script/install-deps-${TRAVIS_OS_NAME}.sh ]; then ./script/install-deps-${TRAVIS_OS_NAME}.sh; fi
+  - if [ -f ./ci/setup-${TRAVIS_OS_NAME}.sh ]; then ./ci/setup-${TRAVIS_OS_NAME}.sh; fi
 
 # Run the Build script and tests
 script:
- - script/cibuild.sh
- - script/citest.sh
- - script/cileaks.sh
+ - mkdir build
+ - cd build
+ - if [ "$TRAVIS_EVENT_TYPE" = "cron" ]; then ../ci/coverity.sh; fi
+ - if [ "$TRAVIS_EVENT_TYPE" != "cron" ]; then ../ci/build.sh && ../ci/test.sh; fi
 
 # Only watch the development and master branches
 branches:
diff --git a/.vsts-ci.yml b/.vsts-ci.yml
new file mode 100644
index 000000000..ce215d80e
--- /dev/null
+++ b/.vsts-ci.yml
@@ -0,0 +1,208 @@
+resources:
+- repo: self
+
+phases:
+- phase: linux_trusty_gcc_openssl
+  displayName: 'Linux (Trusty; GCC; OpenSSL)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       CC=gcc
+       LEAK_CHECK=valgrind
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: linux_trusty_gcc_mbedtls
+  displayName: 'Linux (Trusty; GCC; mbedTLS)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-mbedtls:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       CC=gcc
+       CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS
+       LEAK_CHECK=valgrind
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-mbedtls:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: 'LEAK_CHECK=valgrind'
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: linux_trusty_clang_openssl
+  displayName: 'Linux (Trusty; Clang; OpenSSL)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       CC=clang
+       LEAK_CHECK=valgrind
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: linux_trusty_clang_mbedtls
+  displayName: 'Linux (Trusty; Clang; mbedTLS)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-mbedtls:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       CC=clang
+       CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS
+       LEAK_CHECK=valgrind
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-mbedtls:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: 'LEAK_CHECK=valgrind'
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: macos
+  displayName: 'macOS'
+  queue:
+    name: 'Hosted macOS Preview'
+  steps:
+  - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
+    displayName: Setup
+  - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
+    displayName: Build
+    env:
+      PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
+  - bash: . '$(Build.SourcesDirectory)/ci/test.sh'
+    displayName: Test
+    env:
+      TMPDIR: $(Agent.TempDirectory)
+      LEAK_CHECK: leaks
+
+- phase: windows_vs_amd64
+  displayName: 'Windows (Visual Studio; amd64)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_vs_x86
+  displayName: 'Windows (Visual Studio; x86)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_mingw_amd64
+  displayName: 'Windows (MinGW; amd64)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
+    displayName: Setup
+    env:
+      TEMP: $(Agent.TempDirectory)
+      ARCH: amd64
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"MinGW Makefiles"
+      PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_mingw_x86
+  displayName: 'Windows (MinGW; x86)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
+    displayName: Setup
+    env:
+      TEMP: $(Agent.TempDirectory)
+      ARCH: x86
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"MinGW Makefiles"
+      PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
diff --git a/.vsts-nightly.yml b/.vsts-nightly.yml
new file mode 100644
index 000000000..6c5d0ebb4
--- /dev/null
+++ b/.vsts-nightly.yml
@@ -0,0 +1,22 @@
+resources:
+- repo: self
+
+phases:
+- phase: coverity
+  displayName: 'Coverity'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       COVERITY_TOKEN=$(COVERITY_TOKEN)
+      workDir: '/build'
+      containerCommand: '/src/ci/coverity.sh'
+      detached: false
diff --git a/appveyor.yml b/appveyor.yml
index f76830cb4..d89e3fb6c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -10,51 +10,35 @@ environment:
 
   matrix:
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    GENERATOR: "Visual Studio 10 2010"
-    ARCH: 32
+    CMAKE_OPTIONS: -G"Visual Studio 10 2010"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    GENERATOR: "Visual Studio 10 2010 Win64"
-    ARCH: 64
+    CMAKE_OPTIONS: -G"Visual Studio 10 2010 Win64"
+    ARCH: amd64
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "Visual Studio 14 2015"
-    ARCH: 32
+    CMAKE_OPTIONS: -G"Visual Studio 14 2015"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "Visual Studio 14 2015 Win64"
-    ARCH: 64
+    CMAKE_OPTIONS: -G"Visual Studio 14 2015 Win64"
+    ARCH: amd64
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "MSYS Makefiles"
-    ARCH: i686 # this is for 32-bit MinGW-w64
+    CMAKE_OPTIONS: -G"MinGW Makefiles"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "MSYS Makefiles"
-    ARCH: 64
-cache:
-- i686-4.9.2-release-win32-sjlj-rt_v3-rev1.7z
-- x86_64-4.9.2-release-win32-seh-rt_v3-rev1.7z
+    CMAKE_OPTIONS: -G"MinGW Makefiles"
+    ARCH: amd64
 
-build_script:
+install:
+- set PATH=%TEMP%\mingw64\bin;%TEMP%\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
 - ps: |
     mkdir build
     cd build
-    if ($env:GENERATOR -ne "MSYS Makefiles") {
-      cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON -D MSVC_CRTDBG=ON .. -G"$env:GENERATOR"
-      cmake --build . --config Debug
+    if ($env:CMAKE_OPTIONS -eq '-G"MinGW Makefiles"') {
+      ../ci/setup-mingw.ps1
     }
-- cmd: |
-    if "%GENERATOR%"=="MSYS Makefiles" (C:\MinGW\msys\1.0\bin\sh --login /c/projects/libgit2/script/appveyor-mingw.sh)
+
+build_script:
+- cmd: powershell ../ci/build.ps1
+
 test_script:
-- ps: |
-    # Disable DHE key exchange to fix intermittent build failures ("A buffer
-    # provided was too small") due to SChannel bug. See e.g.
-    # - https://github.com/aws/aws-sdk-cpp/issues/671
-    # - https://github.com/dotnet/corefx/issues/7812
-    New-Item HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman -Force | New-ItemProperty -Name Enabled -Value 0 -Force
-    $ErrorActionPreference="Stop"
-    Start-FileDownload https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -FileName poxyproxy.jar
-    # Run this early so we know it's ready by the time we need it
-    $proxyJob = Start-Job { java -jar $Env:APPVEYOR_BUILD_FOLDER\build\poxyproxy.jar -d --port 8080 --credentials foo:bar }
-    ctest -V -R libgit2_clar
-    Receive-Job -Job $proxyJob
-    $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
-    $env:GITTEST_REMOTE_PROXY_USER = "foo"
-    $env:GITTEST_REMOTE_PROXY_PASS = "bar"
-    ctest -V -R libgit2_clar-proxy_credentials
+- cmd: powershell ../ci/test.ps1
diff --git a/ci/build.ps1 b/ci/build.ps1
new file mode 100644
index 000000000..159c1dd1b
--- /dev/null
+++ b/ci/build.ps1
@@ -0,0 +1,30 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+if ($Env:SOURCE_DIR) { $SourceDirectory = $Env:SOURCE_DIR } else { $SourceDirectory = Split-Path (Split-Path $MyInvocation.MyCommand.Path -Parent) -Parent }
+$BuildDirectory = $(Get-Location).Path
+
+Write-Host "Source directory: ${SourceDirectory}"
+Write-Host "Build directory:  ${BuildDirectory}"
+Write-Host ""
+Write-Host "Operating system version:"
+Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, BuildNumber, OSArchitecture | Format-List
+Write-Host "PATH: ${Env:PATH}"
+Write-Host ""
+
+Write-Host "##############################################################################"
+Write-Host "## Configuring build environment"
+Write-Host "##############################################################################"
+
+Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}"
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Building libgit2"
+Write-Host "##############################################################################"
+
+cmake --build .
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
diff --git a/ci/build.sh b/ci/build.sh
new file mode 100755
index 000000000..a1deab3f2
--- /dev/null
+++ b/ci/build.sh
@@ -0,0 +1,39 @@
+#!/usr/bin/env bash
+#
+# Environment variables:
+#
+# SOURCE_DIR: Set to the directory of the libgit2 source (optional)
+#     If not set, it will be derived relative to this script.
+
+set -e
+
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+CC=${CC:-cc}
+
+indent() { sed "s/^/    /"; }
+
+echo "Source directory: ${SOURCE_DIR}"
+echo "Build directory:  ${BUILD_DIR}"
+echo ""
+echo "Operating system version:"
+uname -a 2>&1 | indent
+echo "CMake version:"
+cmake --version 2>&1 | indent
+echo "Compiler version:"
+$CC --version 2>&1 | indent
+echo ""
+
+echo "##############################################################################"
+echo "## Configuring build environment"
+echo "##############################################################################"
+
+echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
+cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
+
+echo ""
+echo "##############################################################################"
+echo "## Building libgit2"
+echo "##############################################################################"
+
+cmake --build .
diff --git a/script/coverity.sh b/ci/coverity.sh
index 5fe16c031..ae6d46ef4 100755
--- a/script/coverity.sh
+++ b/ci/coverity.sh
@@ -1,17 +1,13 @@
 #!/bin/bash
-set -e
 
-# Only run this on our branches
-echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
-if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
-then
-	echo "Only analyzing the 'master' brach of the main repository."
-	exit 0
-fi
+set -e
 
 # Environment check
 [ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
 
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+
 case $(uname -m) in
 	i?86)				BITS=32 ;;
 	amd64|x86_64)	BITS=64 ;;
@@ -32,31 +28,29 @@ if [ ! -d "$TOOL_BASE" ]; then
 	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
 fi
 
-cp script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
+cp "${SOURCE_DIR}/script/user_nodefs.h" "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
 
 COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
 
 # Configure and build
-rm -rf _build
-mkdir _build
-cd _build
-cmake .. -DTHREADSAFE=ON
+cmake ${SOURCE_DIR}
+
 COVERITY_UNSUPPORTED=1 \
 	$COV_BUILD --dir cov-int \
 	cmake --build .
 
 # Upload results
 tar czf libgit2.tgz cov-int
-SHA=$(git rev-parse --short HEAD)
+SHA=$(cd ${SOURCE_DIR} && git rev-parse --short HEAD)
 
 HTML="$(curl \
 	--silent \
 	--write-out "\n%{http_code}" \
 	--form token="$COVERITY_TOKEN" \
-	--form email=bs@github.com \
+	--form email=libgit2@gmail.com \
 	--form file=@libgit2.tgz \
 	--form version="$SHA" \
-	--form description="Travis build" \
+	--form description="libgit2 build" \
 	https://scan.coverity.com/builds?project=libgit2)"
 # Body is everything up to the last line
 BODY="$(echo "$HTML" | head -n-1)"
@@ -65,7 +59,7 @@ STATUS_CODE="$(echo "$HTML" | tail -n1)"
 
 echo "${BODY}"
 
-if [ "${STATUS_CODE}" != "201" ]; then
+if [ "${STATUS_CODE}" != "200" -o "${STATUS_CODE}" != "201" ]; then
 	echo "Received error code ${STATUS_CODE} from Coverity"
 	exit 1
 fi
diff --git a/ci/setup-linux.sh b/ci/setup-linux.sh
new file mode 100755
index 000000000..c5ecb550b
--- /dev/null
+++ b/ci/setup-linux.sh
@@ -0,0 +1,27 @@
+#!/bin/sh
+
+set -e
+set -x
+
+TMPDIR=${TMPDIR:-/tmp}
+
+if [ -z "$SKIP_APT" ]; then
+	apt-get update
+	apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+fi
+
+mkdir -p /var/run/sshd
+
+if [ "$MBEDTLS" ]; then
+	MBEDTLS_DIR=${MBEDTLS_DIR:-$(mktemp -d ${TMPDIR}/mbedtls.XXXXXXXX)}
+
+	git clone --depth 10 --single-branch --branch mbedtls-2.6.1 https://github.com/ARMmbed/mbedtls.git ${MBEDTLS_DIR}
+	cd ${MBEDTLS_DIR}
+
+	CFLAGS=-fPIC cmake -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON .
+	cmake --build .
+
+	if [ -z "$SKIP_MBEDTLS_INSTALL" ]; then
+		make install
+	fi
+fi
diff --git a/ci/setup-mingw.ps1 b/ci/setup-mingw.ps1
new file mode 100644
index 000000000..76ecd3987
--- /dev/null
+++ b/ci/setup-mingw.ps1
@@ -0,0 +1,25 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
+
+Write-Host "##############################################################################"
+Write-Host "## Downloading mingw"
+Write-Host "##############################################################################"
+
+if ($env:ARCH -eq "amd64") {
+	$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-x86_64-8.1.0-release-win32-seh-rt_v6-rev0.zip"
+	$platform = "x86_64"
+} else {
+	$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-i686-8.1.0-release-win32-sjlj-rt_v6-rev0.zip"
+	$platform = "x86"
+}
+
+$wc = New-Object net.webclient
+$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${Env:ARCH}.zip")
+
+[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${Env:ARCH}.zip", $Env:TEMP)
diff --git a/ci/setup-osx.sh b/ci/setup-osx.sh
new file mode 100755
index 000000000..564910e41
--- /dev/null
+++ b/ci/setup-osx.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -x
+
+brew update
+brew install pkgconfig zlib curl openssl libssh2
+
+ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/ci/test.ps1 b/ci/test.ps1
new file mode 100644
index 000000000..843df7034
--- /dev/null
+++ b/ci/test.ps1
@@ -0,0 +1,45 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+if ($Env:SKIP_TESTS) { exit }
+
+Write-Host "##############################################################################"
+Write-Host "## Configuring test environment"
+Write-Host "##############################################################################"
+
+Write-Host ""
+Write-Host "Starting HTTP proxy..."
+Invoke-WebRequest -Method GET -Uri https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -OutFile poxyproxy.jar
+javaw -jar poxyproxy.jar -d --port 8080 --credentials foo:bar
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Running (offline) tests"
+Write-Host "##############################################################################"
+
+ctest -V -R offline
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Running (online) tests"
+Write-Host "##############################################################################"
+
+ctest -V -R online
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "Running proxy tests"
+Write-Host ""
+
+$Env:GITTEST_REMOTE_PROXY_URL="localhost:8080"
+$Env:GITTEST_REMOTE_PROXY_USER="foo"
+$Env:GITTEST_REMOTE_PROXY_PASS="bar"
+ctest -V -R proxy
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+taskkill /F /IM javaw.exe
diff --git a/ci/test.sh b/ci/test.sh
new file mode 100755
index 000000000..28f76029a
--- /dev/null
+++ b/ci/test.sh
@@ -0,0 +1,189 @@
+#!/usr/bin/env bash
+
+set -e
+
+if [ -n "$SKIP_TESTS" ]; then
+	exit 0
+fi
+
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+TMPDIR=${TMPDIR:-/tmp}
+USER=${USER:-$(whoami)}
+
+VALGRIND="valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=\"$SOURCE_DIR/libgit2_clar.supp\""
+LEAKS="MallocStackLogging=1 MallocScribble=1 leaks -quiet -atExit -- nohup"
+
+cleanup() {
+	echo "Cleaning up..."
+
+	if [ ! -z "$GITDAEMON_DIR" -a -f "${GITDAEMON_DIR}/pid" ]; then
+		echo "Stopping git daemon..."
+		kill $(cat "${GITDAEMON_DIR}/pid")
+	fi
+
+	if [ ! -z "$SSHD_DIR" -a -f "${SSHD_DIR}/pid" ]; then
+		echo "Stopping SSH..."
+		kill $(cat "${SSHD_DIR}/pid")
+	fi
+
+	echo "Done."
+}
+
+die() {
+	echo "Test exited with code: $1"
+
+	cleanup
+	exit $1
+}
+
+# Ask ctest what it would run if we were to invoke it directly.  This lets us manage the
+# test configuration in a single place (tests/CMakeLists.txt) instead of running clar
+# here as well.  But it allows us to wrap our test harness with a leak checker like valgrind.
+run_test() {
+	TEST_CMD=$(ctest -N -V -R $1 | sed -n 's/^[0-9]*: Test command: //p')
+
+	if [ "$LEAK_CHECK" = "valgrind" ]; then
+		RUNNER="$VALGRIND $TEST_CMD"
+	elif [ "$LEAK_CHECK" = "leaks" ]; then
+		RUNNER="$LEAKS $TEST_CMD"
+	else
+		RUNNER="$TEST_CMD"
+	fi
+
+	eval $RUNNER || die $?
+}
+
+# Configure the test environment; run them early so that we're certain
+# that they're started by the time we need them.
+
+echo "##############################################################################"
+echo "## Configuring test environment"
+echo "##############################################################################"
+
+if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+	echo "Starting git daemon..."
+	GITDAEMON_DIR=`mktemp -d ${TMPDIR}/gitdaemon.XXXXXXXX`
+	git init --bare "${GITDAEMON_DIR}/test.git"
+	git daemon --listen=localhost --export-all --enable=receive-pack --pid-file="${GITDAEMON_DIR}/pid" --base-path="${GITDAEMON_DIR}" "${GITDAEMON_DIR}" 2>/dev/null &
+fi
+
+if [ -z "$SKIP_PROXY_TESTS" ]; then
+	echo "Starting HTTP proxy..."
+	curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar
+	java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar >/dev/null 2>&1 &
+fi
+
+if [ -z "$SKIP_SSH_TESTS" ]; then
+	echo "Starting ssh daemon..."
+	HOME=`mktemp -d ${TMPDIR}/home.XXXXXXXX`
+	SSHD_DIR=`mktemp -d ${TMPDIR}/sshd.XXXXXXXX`
+	git init --bare "${SSHD_DIR}/test.git"
+	cat >"${SSHD_DIR}/sshd_config" <<-EOF
+	Port 2222
+	ListenAddress 0.0.0.0
+	Protocol 2
+	HostKey ${SSHD_DIR}/id_rsa
+	PidFile ${SSHD_DIR}/pid
+	AuthorizedKeysFile ${HOME}/.ssh/authorized_keys
+	LogLevel DEBUG
+	RSAAuthentication yes
+	PasswordAuthentication yes
+	PubkeyAuthentication yes
+	ChallengeResponseAuthentication no
+	StrictModes no
+	# Required here as sshd will simply close connection otherwise
+	UsePAM no
+	EOF
+	ssh-keygen -t rsa -f "${SSHD_DIR}/id_rsa" -N "" -q
+	/usr/sbin/sshd -f "${SSHD_DIR}/sshd_config" -E "${SSHD_DIR}/log"
+
+	# Set up keys
+	mkdir "${HOME}/.ssh"
+	ssh-keygen -t rsa -f "${HOME}/.ssh/id_rsa" -N "" -q
+	cat "${HOME}/.ssh/id_rsa.pub" >>"${HOME}/.ssh/authorized_keys"
+	while read algorithm key comment; do
+		echo "[localhost]:2222 $algorithm $key" >>"${HOME}/.ssh/known_hosts"
+	done <"${SSHD_DIR}/id_rsa.pub"
+
+	# Get the fingerprint for localhost and remove the colons so we can
+	# parse it as a hex number. Older versions have a different output
+	# format.
+	if [[ $(ssh -V 2>&1) == OpenSSH_6* ]]; then
+		SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -f "${HOME}/.ssh/known_hosts" -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+	else
+		SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -f "${HOME}/.ssh/known_hosts" -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
+	fi
+fi
+
+# Run the tests that do not require network connectivity.
+
+if [ -z "$SKIP_OFFLINE_TESTS" ]; then
+	echo ""
+	echo "##############################################################################"
+	echo "## Running (offline) tests"
+	echo "##############################################################################"
+
+	run_test offline
+fi
+
+if [ -z "$SKIP_ONLINE_TESTS" ]; then
+	# Run the various online tests.  The "online" test suite only includes the
+	# default online tests that do not require additional configuration.  The
+	# "proxy" and "ssh" test suites require further setup.
+
+	echo ""
+	echo "##############################################################################"
+	echo "## Running (online) tests"
+	echo "##############################################################################"
+
+	run_test online
+fi
+
+if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+	echo ""
+	echo "Running gitdaemon tests"
+	echo ""
+
+	export GITTEST_REMOTE_URL="git://localhost/test.git"
+	run_test gitdaemon
+	unset GITTEST_REMOTE_URL
+fi
+
+if [ -z "$SKIP_PROXY_TESTS" ]; then
+	echo ""
+	echo "Running proxy tests"
+	echo ""
+
+	export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+	export GITTEST_REMOTE_PROXY_USER="foo"
+	export GITTEST_REMOTE_PROXY_PASS="bar"
+	run_test proxy
+	unset GITTEST_REMOTE_PROXY_URL
+	unset GITTEST_REMOTE_PROXY_USER
+	unset GITTEST_REMOTE_PROXY_PASS
+fi
+
+if [ -z "$SKIP_SSH_TESTS" ]; then
+	echo ""
+	echo "Running ssh tests"
+	echo ""
+
+	export GITTEST_REMOTE_URL="ssh://localhost:2222/$SSHD_DIR/test.git"
+	export GITTEST_REMOTE_USER=$USER
+	export GITTEST_REMOTE_SSH_KEY="${HOME}/.ssh/id_rsa"
+	export GITTEST_REMOTE_SSH_PUBKEY="${HOME}/.ssh/id_rsa.pub"
+	export GITTEST_REMOTE_SSH_PASSPHRASE=""
+	export GITTEST_REMOTE_SSH_FINGERPRINT="${SSH_FINGERPRINT}"
+	run_test ssh
+	unset GITTEST_REMOTE_URL
+	unset GITTEST_REMOTE_USER
+	unset GITTEST_REMOTE_SSH_KEY
+	unset GITTEST_REMOTE_SSH_PUBKEY
+	unset GITTEST_REMOTE_SSH_PASSPHRASE
+	unset GITTEST_REMOTE_SSH_FINGERPRINT
+fi
+
+echo "Success."
+cleanup
+exit 0
diff --git a/script/appveyor-mingw.sh b/script/appveyor-mingw.sh
deleted file mode 100755
index 6b2a9425e..000000000
--- a/script/appveyor-mingw.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-set -e
-cd `dirname "$0"`/..
-if [ "$ARCH" = "i686" ]; then
-  f=i686-4.9.2-release-win32-sjlj-rt_v3-rev1.7z
-  if ! [ -e $f ]; then
-    curl -LsSO http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/4.9.2/threads-win32/sjlj/$f
-  fi
-  7z x $f > /dev/null
-  export PATH=`pwd`/mingw32/bin:$PATH
-else
-  f=x86_64-4.9.2-release-win32-seh-rt_v3-rev1.7z
-  if ! [ -e $f ]; then
-    curl -LsSO http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/4.9.2/threads-win32/seh/$f
-  fi
-  7z x $f > /dev/null
-  export PATH=`pwd`/mingw64/bin:$PATH
-fi
-cd build
-gcc --version
-cmake --version
-cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON .. -G"$GENERATOR"
-cmake --build . --config RelWithDebInfo
diff --git a/script/cibuild.sh b/script/cibuild.sh
deleted file mode 100755
index 8e6d68e37..000000000
--- a/script/cibuild.sh
+++ /dev/null
@@ -1,27 +0,0 @@
-#!/bin/sh
-
-set -x
-
-if [ -n "$COVERITY" ]; then
-	./script/coverity.sh
-	exit $?
-fi
-
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-	export PKG_CONFIG_PATH=$(ls -d /usr/local/Cellar/{curl,zlib}/*/lib/pkgconfig | paste -s -d':' -)
-
-	# Set up a ramdisk for us to put our test data on to speed up tests on macOS
-	export CLAR_TMP="$HOME"/_clar_tmp
-	mkdir -p $CLAR_TMP
-
-	# 5*2M sectors aka ~5GB of space
-	device=$(hdiutil attach -nomount ram://$((5 * 2 * 1024 * 1024)))
-	newfs_hfs $device
-	mount -t hfs $device $CLAR_TMP
-fi
-
-mkdir _build
-cd _build
-# shellcheck disable=SC2086
-cmake .. -DBUILD_EXAMPLES=ON -DENABLE_WERROR=ON -DCMAKE_INSTALL_PREFIX=../_install $OPTIONS || exit $?
-cmake --build . --target install || exit $?
diff --git a/script/cileaks.sh b/script/cileaks.sh
deleted file mode 100755
index 4163613af..000000000
--- a/script/cileaks.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -x
-
-# If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ];
-then
-	exit $?
-fi
-
-if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
-	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
-elif [ -n "$LEAKS" -a -e "$(which leaks)" ]; then
-	MallocStackLogging=1 MallocScribble=1 leaks -atExit -- _build/libgit2_clar -ionline
-fi
diff --git a/script/citest.sh b/script/citest.sh
deleted file mode 100755
index 7e6cdb7d7..000000000
--- a/script/citest.sh
+++ /dev/null
@@ -1,82 +0,0 @@
-#!/bin/sh
-
-set -x
-
-# If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ]; then
-	exit $?
-fi
-
-if [ ! -d _build ]; then
-	echo "no _build dir found; you should run cibuild.sh first"
-	exit 1
-fi
-cd _build
-
-# Should we ask Travis to cache this file?
-curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar || exit $?
-# Run this early so we know it's ready by the time we need it
-java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar &
-
-# Create a test repo which we can use for the online::push tests
-mkdir "$HOME"/_temp
-git init --bare "$HOME"/_temp/test.git
-git daemon --listen=localhost --export-all --enable=receive-pack --base-path="$HOME"/_temp "$HOME"/_temp 2>/dev/null &
-export GITTEST_REMOTE_URL="git://localhost/test.git"
-
-# Run the test suite
-ctest -V -R libgit2_clar || exit $?
-
-# Now that we've tested the raw git protocol, let's set up ssh to we
-# can do the push tests over it
-
-killall git-daemon
-
-# Set up sshd
-mkdir ~/sshd/
-cat >~/sshd/sshd_config<<-EOF
-	Port 2222
-	ListenAddress 0.0.0.0
-	Protocol 2
-	HostKey ${HOME}/sshd/id_rsa
-	PidFile ${HOME}/sshd/pid
-	RSAAuthentication yes
-	PasswordAuthentication yes
-	PubkeyAuthentication yes
-	ChallengeResponseAuthentication no
-	# Required here as sshd will simply close connection otherwise
-	UsePAM no
-EOF
-ssh-keygen -t rsa -f ~/sshd/id_rsa -N "" -q
-/usr/sbin/sshd -f ~/sshd/sshd_config
-
-# Set up keys
-ssh-keygen -t rsa -f ~/.ssh/id_rsa -N "" -q
-cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys
-while read algorithm key comment; do
-	echo "[localhost]:2222 $algorithm $key" >>~/.ssh/known_hosts
-done <~/sshd/id_rsa.pub
-
-# Get the fingerprint for localhost and remove the colons so we can parse it as
-# a hex number. The Mac version is newer so it has a different output format.
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
-else
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
-fi
-
-# Use the SSH server
-export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
-export GITTEST_REMOTE_USER=$USER
-export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
-export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
-export GITTEST_REMOTE_SSH_PASSPHRASE=""
-ctest -V -R libgit2_clar-ssh || exit $?
-
-# Use the proxy we started at the beginning
-export GITTEST_REMOTE_PROXY_URL="localhost:8080"
-export GITTEST_REMOTE_PROXY_USER="foo"
-export GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R libgit2_clar-proxy_credentials || exit $?
-
-kill $(cat "$HOME/sshd/pid")
diff --git a/script/install-deps-linux.sh b/script/install-deps-linux.sh
deleted file mode 100755
index 99cbde4e0..000000000
--- a/script/install-deps-linux.sh
+++ /dev/null
@@ -1,13 +0,0 @@
-#!/bin/sh
-
-set -x
-
-if [ "$MBEDTLS" ]; then
-  git clone --depth 10 --single-branch --branch mbedtls-2.6.1 https://github.com/ARMmbed/mbedtls.git ./deps/mbedtls
-  cd ./deps/mbedtls
-  # We pass -fPIC explicitely because we'll include it in libgit2.so
-  CFLAGS=-fPIC cmake -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON .
-  cmake --build .
-
-  echo "mbedTLS built in `pwd`"
-fi
diff --git a/script/install-deps-osx.sh b/script/install-deps-osx.sh
deleted file mode 100755
index 94314dbaa..000000000
--- a/script/install-deps-osx.sh
+++ /dev/null
@@ -1,9 +0,0 @@
-#!/bin/sh
-
-set -x
-
-brew update
-brew install zlib
-brew install curl
-brew install openssl
-brew install libssh2
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index d75114b5c..950250418 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -54,12 +54,8 @@ IF (MSVC_IDE)
 	SET_SOURCE_FILES_PROPERTIES("precompiled.c" COMPILE_FLAGS "/Ycprecompiled.h")
 ENDIF ()
 
-IF (USE_HTTPS)
-	ADD_TEST(libgit2_clar "${libgit2_BINARY_DIR}/libgit2_clar" -ionline -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
-ELSE ()
-	ADD_TEST(libgit2_clar "${libgit2_BINARY_DIR}/libgit2_clar" -v -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
-ENDIF ()
-
-# Add additional test targets that require special setup
-ADD_TEST(libgit2_clar-proxy_credentials "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
-ADD_TEST(libgit2_clar-ssh "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+ADD_TEST(offline   "${libgit2_BINARY_DIR}/libgit2_clar" -v -xonline)
+ADD_TEST(online    "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline)
+ADD_TEST(gitdaemon "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::push)
+ADD_TEST(ssh       "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+ADD_TEST(proxy     "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
diff --git a/tests/buf/oom.c b/tests/buf/oom.c
index 4294a907b..2741a8ddf 100644
--- a/tests/buf/oom.c
+++ b/tests/buf/oom.c
@@ -1,10 +1,22 @@
 #include "clar_libgit2.h"
 #include "buffer.h"
 
-#if defined(GIT_ARCH_64)
-#define TOOBIG 0xffffffffffffff00
+/*
+ * We want to use some ridiculous size that `malloc` will fail with
+ * but that does not otherwise interfere with testing.  On Linux, choose
+ * a number that is large enough to fail immediately but small enough
+ * that valgrind doesn't believe it to erroneously be a negative number.
+ * On macOS, choose a number that is large enough to fail immediately
+ * without having libc print warnings to stderr.
+ */
+#if defined(GIT_ARCH_64) && defined(__linux__)
+# define TOOBIG 0x0fffffffffffffff
+#elif defined(__linux__)
+# define TOOBIG 0x0fffffff
+#elif defined(GIT_ARCH_64)
+# define TOOBIG 0xffffffffffffff00
 #else
-#define TOOBIG 0xffffff00
+# define TOOBIG 0xffffff00
 #endif
 
 /**