Merge pull request #5327 from libgit2/ethomson/assert

Introduce GIT_ASSERT macros

129 files changed, 1744 insertions, 1120 deletions

diff --git a/include/git2/blob.h b/include/git2/blob.h
index 7e2a745d1..8e977267d 100644
--- a/include/git2/blob.h
+++ b/include/git2/blob.h
@@ -84,7 +84,7 @@ GIT_EXTERN(git_repository *) git_blob_owner(const git_blob *blob);
  * time.
  *
  * @param blob pointer to the blob
- * @return the pointer
+ * @return the pointer, or NULL on error
  */
 GIT_EXTERN(const void *) git_blob_rawcontent(const git_blob *blob);
 
diff --git a/src/annotated_commit.c b/src/annotated_commit.c
index 5d4f37082..e48947679 100644
--- a/src/annotated_commit.c
+++ b/src/annotated_commit.c
@@ -26,7 +26,8 @@ static int annotated_commit_init(
 	git_annotated_commit *annotated_commit;
 	int error = 0;
 
-	assert(out && commit);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(commit);
 
 	*out = NULL;
 
@@ -63,7 +64,9 @@ static int annotated_commit_init_from_id(
 	git_commit *commit = NULL;
 	int error = 0;
 
-	assert(out && repo && id);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(id);
 
 	*out = NULL;
 
@@ -100,7 +103,9 @@ int git_annotated_commit_from_revspec(
 	git_object *obj, *commit;
 	int error;
 
-	assert(out && repo && revspec);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(revspec);
 
 	if ((error = git_revparse_single(&obj, repo, revspec)) < 0)
 		return error;
@@ -126,7 +131,9 @@ int git_annotated_commit_from_ref(
 	git_object *peeled;
 	int error = 0;
 
-	assert(out && repo && ref);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(ref);
 
 	*out = NULL;
 
@@ -154,11 +161,12 @@ int git_annotated_commit_from_head(
 	git_reference *head;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
-    if ((error = git_reference_lookup(&head, repo, GIT_HEAD_FILE)) < 0)
+	if ((error = git_reference_lookup(&head, repo, GIT_HEAD_FILE)) < 0)
 		return -1;
 
 	error = git_annotated_commit_from_ref(out, repo, head);
@@ -174,7 +182,11 @@ int git_annotated_commit_from_fetchhead(
 	const char *remote_url,
 	const git_oid *id)
 {
-	assert(repo && id && branch_name && remote_url);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(branch_name);
+	GIT_ASSERT_ARG(remote_url);
+	GIT_ASSERT_ARG(id);
 
 	if (annotated_commit_init_from_id(out, repo, id, branch_name) < 0)
 		return -1;
@@ -192,14 +204,14 @@ int git_annotated_commit_from_fetchhead(
 const git_oid *git_annotated_commit_id(
 	const git_annotated_commit *annotated_commit)
 {
-	assert(annotated_commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(annotated_commit, NULL);
 	return git_commit_id(annotated_commit->commit);
 }
 
 const char *git_annotated_commit_ref(
 	const git_annotated_commit *annotated_commit)
 {
-	assert(annotated_commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(annotated_commit, NULL);
 	return annotated_commit->ref_name;
 }
 
diff --git a/src/apply.c b/src/apply.c
index b0be2d8e6..7c65cd79d 100644
--- a/src/apply.c
+++ b/src/apply.c
@@ -5,8 +5,6 @@
  * a Linking Exception. For full terms see the included COPYING file.
  */
 
-#include "apply.h"
-
 #include "git2/apply.h"
 #include "git2/patch.h"
 #include "git2/filter.h"
@@ -21,6 +19,7 @@
 #include "zstream.h"
 #include "reader.h"
 #include "index.h"
+#include "apply.h"
 
 typedef struct {
 	/* The lines that we allocate ourself are allocated out of the pool.
@@ -399,7 +398,11 @@ int git_apply__patch(
 	unsigned int mode = 0;
 	int error = 0;
 
-	assert(contents_out && filename_out && mode_out && (source || !source_len) && patch);
+	GIT_ASSERT_ARG(contents_out);
+	GIT_ASSERT_ARG(filename_out);
+	GIT_ASSERT_ARG(mode_out);
+	GIT_ASSERT_ARG(source || !source_len);
+	GIT_ASSERT_ARG(patch);
 
 	if (given_opts)
 		memcpy(&ctx.opts, given_opts, sizeof(git_apply_options));
@@ -624,7 +627,10 @@ int git_apply_to_tree(
 	size_t i;
 	int error = 0;
 
-	assert(out && repo && preimage && diff);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(preimage);
+	GIT_ASSERT_ARG(diff);
 
 	*out = NULL;
 
@@ -772,6 +778,8 @@ done:
 
 int git_apply_options_init(git_apply_options *opts, unsigned int version)
 {
+	GIT_ASSERT_ARG(opts);
+
 	GIT_INIT_STRUCTURE_FROM_TEMPLATE(
 		opts, version, git_apply_options, GIT_APPLY_OPTIONS_INIT);
 	return 0;
@@ -805,7 +813,8 @@ int git_apply(
 	git_apply_options opts = GIT_APPLY_OPTIONS_INIT;
 	int error = GIT_EINVALID;
 
-	assert(repo && diff);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(diff);
 
 	GIT_ERROR_CHECK_VERSION(
 		given_opts, GIT_APPLY_OPTIONS_VERSION, "git_apply_options");
@@ -829,7 +838,7 @@ int git_apply(
 		error = git_reader_for_workdir(&pre_reader, repo, false);
 		break;
 	default:
-		assert(false);
+		GIT_ASSERT(false);
 	}
 
 	if (error < 0)
@@ -869,7 +878,7 @@ int git_apply(
 		error = git_apply__to_workdir(repo, diff, preimage, postimage, location, &opts);
 		break;
 	default:
-		assert(false);
+		GIT_ASSERT(false);
 	}
 
 	if (error < 0)
diff --git a/src/attr.c b/src/attr.c
index bd517cde3..e85e27162 100644
--- a/src/attr.c
+++ b/src/attr.c
@@ -58,7 +58,9 @@ int git_attr_get(
 	git_attr_rule *rule;
 	git_dir_flag dir_flag = GIT_DIR_FLAG_UNKNOWN;
 
-	assert(value && repo && name);
+	GIT_ASSERT_ARG(value);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	*value = NULL;
 
@@ -123,7 +125,10 @@ int git_attr_get_many_with_session(
 	if (!num_attr)
 		return 0;
 
-	assert(values && repo && names);
+	GIT_ASSERT_ARG(values);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(pathname);
+	GIT_ASSERT_ARG(names);
 
 	if (git_repository_is_bare(repo))
 		dir_flag = GIT_DIR_FLAG_FALSE;
@@ -206,7 +211,8 @@ int git_attr_foreach(
 	git_strmap *seen = NULL;
 	git_dir_flag dir_flag = GIT_DIR_FLAG_UNKNOWN;
 
-	assert(repo && callback);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(callback);
 
 	if (git_repository_is_bare(repo))
 		dir_flag = GIT_DIR_FLAG_FALSE;
@@ -378,6 +384,9 @@ int git_attr_add_macro(
 	git_attr_rule *macro = NULL;
 	git_pool *pool;
 
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
+
 	if ((error = git_attr_cache__init(repo)) < 0)
 		return error;
 
diff --git a/src/attr_file.c b/src/attr_file.c
index 3f69b5ffc..0781c1d61 100644
--- a/src/attr_file.c
+++ b/src/attr_file.c
@@ -351,7 +351,9 @@ uint32_t git_attr_file__name_hash(const char *name)
 {
 	uint32_t h = 5381;
 	int c;
-	assert(name);
+
+	GIT_ASSERT_ARG(name);
+
 	while ((c = (int)*name++) != 0)
 		h = ((h << 5) + h) + c;
 	return h;
@@ -660,7 +662,8 @@ int git_attr_fnmatch__parse(
 	int slash_count, allow_space;
 	bool escaped;
 
-	assert(spec && base && *base);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(base && *base);
 
 	if (parse_optimized_patterns(spec, pool, *base))
 		return 0;
@@ -828,7 +831,7 @@ int git_attr_assignment__parse(
 	const char *scan = *base;
 	git_attr_assignment *assign = NULL;
 
-	assert(assigns && !assigns->length);
+	GIT_ASSERT_ARG(assigns && !assigns->length);
 
 	git_vector_set_cmp(assigns, sort_by_hash_and_name);
 
@@ -954,7 +957,7 @@ void git_attr_rule__free(git_attr_rule *rule)
 
 int git_attr_session__init(git_attr_session *session, git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	memset(session, 0, sizeof(*session));
 	session->key = git_atomic_inc(&repo->attr_session_key);
diff --git a/src/blame.c b/src/blame.c
index 1046dab55..651b7a003 100644
--- a/src/blame.c
+++ b/src/blame.c
@@ -171,20 +171,21 @@ void git_blame_free(git_blame *blame)
 
 uint32_t git_blame_get_hunk_count(git_blame *blame)
 {
-	assert(blame);
+	GIT_ASSERT_ARG(blame);
 	return (uint32_t)blame->hunks.length;
 }
 
 const git_blame_hunk *git_blame_get_hunk_byindex(git_blame *blame, uint32_t index)
 {
-	assert(blame);
+	GIT_ASSERT_ARG_WITH_RETVAL(blame, NULL);
 	return (git_blame_hunk*)git_vector_get(&blame->hunks, index);
 }
 
 const git_blame_hunk *git_blame_get_hunk_byline(git_blame *blame, size_t lineno)
 {
 	size_t i, new_lineno = lineno;
-	assert(blame);
+
+	GIT_ASSERT_ARG_WITH_RETVAL(blame, NULL);
 
 	if (!git_vector_bsearch2(&i, &blame->hunks, hunk_byfinalline_search_cmp, &new_lineno)) {
 		return git_blame_get_hunk_byindex(blame, (uint32_t)i);
@@ -388,7 +389,10 @@ int git_blame_file(
 	git_blame_options normOptions = GIT_BLAME_OPTIONS_INIT;
 	git_blame *blame = NULL;
 
-	assert(out && repo && path);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(path);
+
 	if ((error = normalize_options(&normOptions, options, repo)) < 0)
 		goto on_error;
 
@@ -509,7 +513,9 @@ int git_blame_buffer(
 
 	diffopts.context_lines = 0;
 
-	assert(out && reference && buffer && buffer_len);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(reference);
+	GIT_ASSERT_ARG(buffer && buffer_len);
 
 	blame = git_blame__alloc(reference->repository, reference->options, reference->path);
 	GIT_ERROR_CHECK_ALLOC(blame);
diff --git a/src/blob.c b/src/blob.c
index da4e6ffa5..97069645c 100644
--- a/src/blob.c
+++ b/src/blob.c
@@ -18,7 +18,8 @@
 
 const void *git_blob_rawcontent(const git_blob *blob)
 {
-	assert(blob);
+	GIT_ASSERT_ARG_WITH_RETVAL(blob, NULL);
+
 	if (blob->raw)
 		return blob->data.raw.data;
 	else
@@ -27,7 +28,8 @@ const void *git_blob_rawcontent(const git_blob *blob)
 
 git_object_size_t git_blob_rawsize(const git_blob *blob)
 {
-	assert(blob);
+	GIT_ASSERT_ARG(blob);
+
 	if (blob->raw)
 		return blob->data.raw.size;
 	else
@@ -53,7 +55,9 @@ void git_blob__free(void *_blob)
 int git_blob__parse_raw(void *_blob, const char *data, size_t size)
 {
 	git_blob *blob = (git_blob *) _blob;
-	assert(blob);
+
+	GIT_ASSERT_ARG(blob);
+
 	blob->raw = 1;
 	blob->data.raw.data = data;
 	blob->data.raw.size = size;
@@ -63,7 +67,9 @@ int git_blob__parse_raw(void *_blob, const char *data, size_t size)
 int git_blob__parse(void *_blob, git_odb_object *odb_obj)
 {
 	git_blob *blob = (git_blob *) _blob;
-	assert(blob);
+
+	GIT_ASSERT_ARG(blob);
+
 	git_cached_obj_incref((git_cached_obj *)odb_obj);
 	blob->raw = 0;
 	blob->data.odb = odb_obj;
@@ -77,7 +83,8 @@ int git_blob_create_from_buffer(
 	git_odb *odb;
 	git_odb_stream *stream;
 
-	assert(id && repo);
+	GIT_ASSERT_ARG(id);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = git_repository_odb__weakptr(&odb, repo)) < 0 ||
 		(error = git_odb_open_wstream(&stream, odb, len, GIT_OBJECT_BLOB)) < 0)
@@ -188,7 +195,7 @@ int git_blob__create_from_paths(
 	mode_t mode;
 	git_buf path = GIT_BUF_INIT;
 
-	assert(hint_path || !try_load_filters);
+	GIT_ASSERT_ARG(hint_path || !try_load_filters);
 
 	if (!content_path) {
 		if (git_repository__ensure_not_bare(repo, "create blob from file") < 0)
@@ -331,7 +338,8 @@ int git_blob_create_from_stream(git_writestream **out, git_repository *repo, con
 	git_buf path = GIT_BUF_INIT;
 	blob_writestream *stream;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	stream = git__calloc(1, sizeof(blob_writestream));
 	GIT_ERROR_CHECK_ALLOC(stream);
@@ -391,7 +399,7 @@ int git_blob_is_binary(const git_blob *blob)
 	git_buf content = GIT_BUF_INIT;
 	git_object_size_t size;
 
-	assert(blob);
+	GIT_ASSERT_ARG(blob);
 
 	size = git_blob_rawsize(blob);
 
@@ -411,13 +419,16 @@ int git_blob_filter(
 	git_blob_filter_options opts = GIT_BLOB_FILTER_OPTIONS_INIT;
 	git_filter_flag_t flags = GIT_FILTER_DEFAULT;
 
-	assert(blob && path && out);
-
-	git_buf_sanitize(out);
+	GIT_ASSERT_ARG(blob);
+	GIT_ASSERT_ARG(path);
+	GIT_ASSERT_ARG(out);
 
 	GIT_ERROR_CHECK_VERSION(
 		given_opts, GIT_BLOB_FILTER_OPTIONS_VERSION, "git_blob_filter_options");
 
+	if (git_buf_sanitize(out) < 0)
+		return -1;
+
 	if (given_opts != NULL)
 		memcpy(&opts, given_opts, sizeof(git_blob_filter_options));
 
diff --git a/src/branch.c b/src/branch.c
index 000a63ad8..29ff0b9d9 100644
--- a/src/branch.c
+++ b/src/branch.c
@@ -67,8 +67,10 @@ static int create_branch(
 	int error = -1;
 	int bare = git_repository_is_bare(repository);
 
-	assert(branch_name && commit && ref_out);
-	assert(git_object_owner((const git_object *)commit) == repository);
+	GIT_ASSERT_ARG(branch_name);
+	GIT_ASSERT_ARG(commit);
+	GIT_ASSERT_ARG(ref_out);
+	GIT_ASSERT_ARG(git_commit_owner(commit) == repository);
 
 	if (!git__strcmp(branch_name, "HEAD")) {
 		git_error_set(GIT_ERROR_REFERENCE, "'HEAD' is not a valid branch name");
@@ -161,6 +163,8 @@ out:
 
 int git_branch_is_checked_out(const git_reference *branch)
 {
+	GIT_ASSERT_ARG(branch);
+
 	if (!git_reference_is_branch(branch))
 		return 0;
 	return git_repository_foreach_worktree(git_reference_owner(branch),
@@ -173,7 +177,7 @@ int git_branch_delete(git_reference *branch)
 	git_buf config_section = GIT_BUF_INIT;
 	int error = -1;
 
-	assert(branch);
+	GIT_ASSERT_ARG(branch);
 
 	if (!git_reference_is_branch(branch) && !git_reference_is_remote(branch)) {
 		git_error_set(GIT_ERROR_INVALID, "reference '%s' is not a valid branch.",
@@ -288,7 +292,8 @@ int git_branch_move(
 	        log_message = GIT_BUF_INIT;
 	int error;
 
-	assert(branch && new_branch_name);
+	GIT_ASSERT_ARG(branch);
+	GIT_ASSERT_ARG(new_branch_name);
 
 	if (!git_reference_is_branch(branch))
 		return not_a_local_branch(git_reference_name(branch));
@@ -333,7 +338,10 @@ int git_branch_lookup(
 	git_branch_t branch_type)
 {
 	int error = -1;
-	assert(ref_out && repo && branch_name);
+
+	GIT_ASSERT_ARG(ref_out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(branch_name);
 
 	switch (branch_type) {
 	case GIT_BRANCH_LOCAL:
@@ -346,7 +354,7 @@ int git_branch_lookup(
 			error = retrieve_branch_reference(ref_out, repo, branch_name, true);
 		break;
 	default:
-		assert(false);
+		GIT_ASSERT(false);
 	}
 	return error;
 }
@@ -357,7 +365,8 @@ int git_branch_name(
 {
 	const char *branch_name;
 
-	assert(out && ref);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ref);
 
 	branch_name = ref->name;
 
@@ -405,9 +414,11 @@ int git_branch_upstream_name(
 	const git_refspec *refspec;
 	git_config *config;
 
-	assert(out && refname);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(refname);
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	if (!git_reference__is_branch(refname))
 		return not_a_local_branch(refname);
@@ -468,9 +479,8 @@ int git_branch_upstream_remote(git_buf *buf, git_repository *repo, const char *r
 	if ((error = git_repository_config__weakptr(&cfg, repo)) < 0)
 		return error;
 
-	git_buf_sanitize(buf);
-
-	if ((error = retrieve_upstream_configuration(buf, cfg, refname, "branch.%s.remote")) < 0)
+	if ((error = git_buf_sanitize(buf)) < 0 ||
+	    (error = retrieve_upstream_configuration(buf, cfg, refname, "branch.%s.remote")) < 0)
 		return error;
 
 	if (git_buf_len(buf) == 0) {
@@ -491,9 +501,12 @@ int git_branch_remote_name(git_buf *buf, git_repository *repo, const char *refna
 	int error = 0;
 	char *remote_name = NULL;
 
-	assert(buf && repo && refname);
+	GIT_ASSERT_ARG(buf);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(refname);
 
-	git_buf_sanitize(buf);
+	if ((error = git_buf_sanitize(buf)) < 0)
+		return error;
 
 	/* Verify that this is a remote branch */
 	if (!git_reference__is_remote(refname)) {
@@ -702,7 +715,7 @@ int git_branch_is_head(
 	bool is_same = false;
 	int error;
 
-	assert(branch);
+	GIT_ASSERT_ARG(branch);
 
 	if (!git_reference_is_branch(branch))
 		return false;
diff --git a/src/buf_text.c b/src/buf_text.c
index 88fcb87dd..0fd22319f 100644
--- a/src/buf_text.c
+++ b/src/buf_text.c
@@ -69,7 +69,7 @@ int git_buf_text_crlf_to_lf(git_buf *tgt, const git_buf *src)
 	size_t new_size;
 	char *out;
 
-	assert(tgt != src);
+	GIT_ASSERT(tgt != src);
 
 	if (!next)
 		return git_buf_set(tgt, src->ptr, src->size);
@@ -116,7 +116,7 @@ int git_buf_text_lf_to_crlf(git_buf *tgt, const git_buf *src)
 	const char *next = memchr(scan, '\n', src->size);
 	size_t alloclen;
 
-	assert(tgt != src);
+	GIT_ASSERT(tgt != src);
 
 	if (!next)
 		return git_buf_set(tgt, src->ptr, src->size);
diff --git a/src/buffer.c b/src/buffer.c
index c203650c7..f6ecc6e41 100644
--- a/src/buffer.c
+++ b/src/buffer.c
@@ -140,13 +140,17 @@ void git_buf_free(git_buf *buf)
 }
 #endif
 
-void git_buf_sanitize(git_buf *buf)
+int git_buf_sanitize(git_buf *buf)
 {
 	if (buf->ptr == NULL) {
-		assert(buf->size == 0 && buf->asize == 0);
+		GIT_ASSERT_ARG(buf->size == 0 && buf->asize == 0);
+
 		buf->ptr = git_buf__initbuf;
-	} else if (buf->asize > buf->size)
+	} else if (buf->asize > buf->size) {
 		buf->ptr[buf->size] = '\0';
+	}
+
+	return 0;
 }
 
 void git_buf_clear(git_buf *buf)
@@ -225,7 +229,7 @@ int git_buf_put(git_buf *buf, const char *data, size_t len)
 	if (len) {
 		size_t new_size;
 
-		assert(data);
+		GIT_ASSERT_ARG(data);
 
 		GIT_ERROR_CHECK_ALLOC_ADD(&new_size, buf->size, len);
 		GIT_ERROR_CHECK_ALLOC_ADD(&new_size, new_size, 1);
@@ -239,7 +243,8 @@ int git_buf_put(git_buf *buf, const char *data, size_t len)
 
 int git_buf_puts(git_buf *buf, const char *string)
 {
-	assert(string);
+	GIT_ASSERT_ARG(string);
+
 	return git_buf_put(buf, string, strlen(string));
 }
 
@@ -319,7 +324,7 @@ int git_buf_decode_base64(git_buf *buf, const char *base64, size_t len)
 		return -1;
 	}
 
-	assert(len % 4 == 0);
+	GIT_ASSERT_ARG(len % 4 == 0);
 	GIT_ERROR_CHECK_ALLOC_ADD(&new_size, (len / 4 * 3), buf->size);
 	GIT_ERROR_CHECK_ALLOC_ADD(&new_size, new_size, 1);
 	ENSURE_SIZE(buf, new_size);
@@ -551,22 +556,26 @@ int git_buf_printf(git_buf *buf, const char *format, ...)
 	return r;
 }
 
-void git_buf_copy_cstr(char *data, size_t datasize, const git_buf *buf)
+int git_buf_copy_cstr(char *data, size_t datasize, const git_buf *buf)
 {
 	size_t copylen;
 
-	assert(data && datasize && buf);
+	GIT_ASSERT_ARG(data);
+	GIT_ASSERT_ARG(datasize);
+	GIT_ASSERT_ARG(buf);
 
 	data[0] = '\0';
 
 	if (buf->size == 0 || buf->asize <= 0)
-		return;
+		return 0;
 
 	copylen = buf->size;
 	if (copylen > datasize - 1)
 		copylen = datasize - 1;
 	memmove(data, buf->ptr, copylen);
 	data[copylen] = '\0';
+
+	return 0;
 }
 
 void git_buf_consume_bytes(git_buf *buf, size_t len)
@@ -760,7 +769,7 @@ int git_buf_join(
 
 	/* not safe to have str_b point internally to the buffer */
 	if (buf->size)
-		assert(str_b < buf->ptr || str_b >= buf->ptr + buf->size);
+		GIT_ASSERT_ARG(str_b < buf->ptr || str_b >= buf->ptr + buf->size);
 
 	/* figure out if we need to insert a separator */
 	if (separator && strlen_a) {
@@ -810,9 +819,9 @@ int git_buf_join3(
 	char *tgt;
 
 	/* for this function, disallow pointers into the existing buffer */
-	assert(str_a < buf->ptr || str_a >= buf->ptr + buf->size);
-	assert(str_b < buf->ptr || str_b >= buf->ptr + buf->size);
-	assert(str_c < buf->ptr || str_c >= buf->ptr + buf->size);
+	GIT_ASSERT(str_a < buf->ptr || str_a >= buf->ptr + buf->size);
+	GIT_ASSERT(str_b < buf->ptr || str_b >= buf->ptr + buf->size);
+	GIT_ASSERT(str_c < buf->ptr || str_c >= buf->ptr + buf->size);
 
 	if (separator) {
 		if (len_a > 0) {
@@ -885,7 +894,9 @@ int git_buf_splice(
 	char *splice_loc;
 	size_t new_size, alloc_size;
 
-	assert(buf && where <= buf->size && nb_to_remove <= buf->size - where);
+	GIT_ASSERT(buf);
+	GIT_ASSERT(where <= buf->size);
+	GIT_ASSERT(nb_to_remove <= buf->size - where);
 
 	splice_loc = buf->ptr + where;
 
diff --git a/src/buffer.h b/src/buffer.h
index 6b717d2e9..8c2096bce 100644
--- a/src/buffer.h
+++ b/src/buffer.h
@@ -69,7 +69,7 @@ extern int git_buf_try_grow(
  * git_buf__initbuf. If a buffer with a non-NULL ptr is passed in, this method
  * assures that the buffer is '\0'-terminated.
  */
-extern void git_buf_sanitize(git_buf *buf);
+extern int git_buf_sanitize(git_buf *buf);
 
 extern void git_buf_swap(git_buf *buf_a, git_buf *buf_b);
 extern char *git_buf_detach(git_buf *buf);
@@ -145,7 +145,7 @@ GIT_INLINE(size_t) git_buf_len(const git_buf *buf)
 	return buf->size;
 }
 
-void git_buf_copy_cstr(char *data, size_t datasize, const git_buf *buf);
+int git_buf_copy_cstr(char *data, size_t datasize, const git_buf *buf);
 
 #define git_buf_PUTS(buf, str) git_buf_put(buf, str, sizeof(str) - 1)
 
diff --git a/src/checkout.c b/src/checkout.c
index 94a2cb9fa..65487993b 100644
--- a/src/checkout.c
+++ b/src/checkout.c
@@ -1243,7 +1243,7 @@ static int checkout_conflict_append_remove(
 	checkout_data *data = payload;
 	const char *name;
 
-	assert(ancestor || ours || theirs);
+	GIT_ASSERT_ARG(ancestor || ours || theirs);
 
 	if (ancestor)
 		name = git__strdup(ancestor->path);
@@ -1487,7 +1487,9 @@ static int checkout_stream_write(
 static int checkout_stream_close(git_writestream *s)
 {
 	struct checkout_stream *stream = (struct checkout_stream *)s;
-	assert(stream && stream->open);
+
+	GIT_ASSERT_ARG(stream);
+	GIT_ASSERT_ARG(stream->open);
 
 	stream->open = 0;
 	return p_close(stream->fd);
@@ -1554,7 +1556,7 @@ static int blob_content_to_file(
 
 	error = git_filter_list_stream_blob(fl, blob, &writer.base);
 
-	assert(writer.open == 0);
+	GIT_ASSERT(writer.open == 0);
 
 	git_filter_list_free(fl);
 
@@ -1976,7 +1978,7 @@ static int checkout_write_entry(
 	struct stat st;
 	int error;
 
-	assert (side == conflict->ours || side == conflict->theirs);
+	GIT_ASSERT(side == conflict->ours || side == conflict->theirs);
 
 	if (checkout_target_fullpath(&fullpath, data, side->path) < 0)
 		return -1;
@@ -2588,7 +2590,7 @@ int git_checkout_iterator(
 	}
 
 	/* Should not have case insensitivity mismatch */
-	assert(git_iterator_ignore_case(workdir) == git_iterator_ignore_case(baseline));
+	GIT_ASSERT(git_iterator_ignore_case(workdir) == git_iterator_ignore_case(baseline));
 
 	/* Generate baseline-to-target diff which will include an entry for
 	 * every possible update that might need to be made.
@@ -2639,7 +2641,7 @@ int git_checkout_iterator(
 		(error = checkout_extensions_update_index(&data)) < 0)
 		goto cleanup;
 
-	assert(data.completed_steps == data.total_steps);
+	GIT_ASSERT(data.completed_steps == data.total_steps);
 
 	if (data.opts.perfdata_cb)
 		data.opts.perfdata_cb(&data.perfdata, data.opts.perfdata_payload);
@@ -2767,7 +2769,8 @@ int git_checkout_head(
 	git_repository *repo,
 	const git_checkout_options *opts)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
+
 	return git_checkout_tree(repo, NULL, opts);
 }
 
diff --git a/src/cherrypick.c b/src/cherrypick.c
index 103897aae..4287956c9 100644
--- a/src/cherrypick.c
+++ b/src/cherrypick.c
@@ -126,7 +126,10 @@ int git_cherrypick_commit(
 	git_tree *parent_tree = NULL, *our_tree = NULL, *cherrypick_tree = NULL;
 	int parent = 0, error = 0;
 
-	assert(out && repo && cherrypick_commit && our_commit);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(cherrypick_commit);
+	GIT_ASSERT_ARG(our_commit);
 
 	if (git_commit_parentcount(cherrypick_commit) > 1) {
 		if (!mainline)
@@ -177,7 +180,8 @@ int git_cherrypick(
 	git_indexwriter indexwriter = GIT_INDEXWRITER_INIT;
 	int error = 0;
 
-	assert(repo && commit);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(commit);
 
 	GIT_ERROR_CHECK_VERSION(given_opts, GIT_CHERRYPICK_OPTIONS_VERSION, "git_cherrypick_options");
 
diff --git a/src/clone.c b/src/clone.c
index a93ec475f..7ae90b09e 100644
--- a/src/clone.c
+++ b/src/clone.c
@@ -231,7 +231,7 @@ static int update_head_to_remote(
 
 	/* We know we have HEAD, let's see where it points */
 	remote_head = refs[0];
-	assert(remote_head);
+	GIT_ASSERT(remote_head);
 
 	remote_head_id = &remote_head->oid;
 
@@ -267,7 +267,8 @@ static int update_head_to_branch(
 	git_buf remote_branch_name = GIT_BUF_INIT;
 	git_reference* remote_ref = NULL;
 
-	assert(remote_name && branch);
+	GIT_ASSERT_ARG(remote_name);
+	GIT_ASSERT_ARG(branch);
 
 	if ((retcode = git_buf_printf(&remote_branch_name, GIT_REFS_REMOTES_DIR "%s/%s",
 		remote_name, branch)) < 0 )
@@ -385,7 +386,8 @@ static int clone_into(git_repository *repo, git_remote *_remote, const git_fetch
 	git_fetch_options fetch_opts;
 	git_remote *remote;
 
-	assert(repo && _remote);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(_remote);
 
 	if (!git_repository_is_empty(repo)) {
 		git_error_set(GIT_ERROR_INVALID, "the repository is not empty");
@@ -452,7 +454,9 @@ static int git__clone(
 	uint32_t rmdir_flags = GIT_RMDIR_REMOVE_FILES;
 	git_repository_create_cb repository_cb;
 
-	assert(out && url && local_path);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(url);
+	GIT_ASSERT_ARG(local_path);
 
 	if (_options)
 		memcpy(&options, _options, sizeof(git_clone_options));
@@ -575,7 +579,8 @@ static int clone_local_into(git_repository *repo, git_remote *remote, const git_
 	git_buf src_odb = GIT_BUF_INIT, dst_odb = GIT_BUF_INIT, src_path = GIT_BUF_INIT;
 	git_buf reflog_message = GIT_BUF_INIT;
 
-	assert(repo && remote);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(remote);
 
 	if (!git_repository_is_empty(repo)) {
 		git_error_set(GIT_ERROR_INVALID, "the repository is not empty");
diff --git a/src/commit.c b/src/commit.c
index cf9902d02..96259d5bb 100644
--- a/src/commit.c
+++ b/src/commit.c
@@ -53,7 +53,8 @@ static int git_commit__create_buffer_internal(
 	size_t i = 0;
 	const git_oid *parent;
 
-	assert(out && tree);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(tree);
 
 	git_oid__writebuf(out, "tree ", tree);
 
@@ -229,7 +230,8 @@ int git_commit_create_v(
 	int error = 0;
 	commit_parent_varargs data;
 
-	assert(tree && git_tree_owner(tree) == repo);
+	GIT_ASSERT_ARG(tree);
+	GIT_ASSERT_ARG(git_tree_owner(tree) == repo);
 
 	data.total = parent_count;
 	va_start(data.args, parent_count);
@@ -306,7 +308,8 @@ int git_commit_create(
 {
 	commit_parent_data data = { parent_count, parents, repo };
 
-	assert(tree && git_tree_owner(tree) == repo);
+	GIT_ASSERT_ARG(tree);
+	GIT_ASSERT_ARG(git_tree_owner(tree) == repo);
 
 	return git_commit__create_internal(
 		id, repo, update_ref, author, committer,
@@ -337,7 +340,8 @@ int git_commit_amend(
 	git_reference *ref;
 	int error;
 
-	assert(id && commit_to_amend);
+	GIT_ASSERT_ARG(id);
+	GIT_ASSERT_ARG(commit_to_amend);
 
 	repo = git_commit_owner(commit_to_amend);
 
@@ -356,7 +360,7 @@ int git_commit_amend(
 		git_oid_cpy(&tree_id, git_tree_id(old_tree));
 		git_tree_free(old_tree);
 	} else {
-		assert(git_tree_owner(tree) == repo);
+		GIT_ASSERT_ARG(git_tree_owner(tree) == repo);
 		git_oid_cpy(&tree_id, git_tree_id(tree));
 	}
 
@@ -392,7 +396,8 @@ static int commit_parse(git_commit *commit, const char *data, size_t size, unsig
 	size_t header_len;
 	git_signature dummy_sig;
 
-	assert(commit && data);
+	GIT_ASSERT_ARG(commit);
+	GIT_ASSERT_ARG(data);
 
 	buffer = buffer_start;
 
@@ -506,28 +511,28 @@ int git_commit__parse(void *_commit, git_odb_object *odb_obj)
 	return git_commit__parse_ext(_commit, odb_obj, 0);
 }
 
-#define GIT_COMMIT_GETTER(_rvalue, _name, _return) \
+#define GIT_COMMIT_GETTER(_rvalue, _name, _return, _invalid) \
 	_rvalue git_commit_##_name(const git_commit *commit) \
 	{\
-		assert(commit); \
+		GIT_ASSERT_ARG_WITH_RETVAL(commit, _invalid); \
 		return _return; \
 	}
 
-GIT_COMMIT_GETTER(const git_signature *, author, commit->author)
-GIT_COMMIT_GETTER(const git_signature *, committer, commit->committer)
-GIT_COMMIT_GETTER(const char *, message_raw, commit->raw_message)
-GIT_COMMIT_GETTER(const char *, message_encoding, commit->message_encoding)
-GIT_COMMIT_GETTER(const char *, raw_header, commit->raw_header)
-GIT_COMMIT_GETTER(git_time_t, time, commit->committer->when.time)
-GIT_COMMIT_GETTER(int, time_offset, commit->committer->when.offset)
-GIT_COMMIT_GETTER(unsigned int, parentcount, (unsigned int)git_array_size(commit->parent_ids))
-GIT_COMMIT_GETTER(const git_oid *, tree_id, &commit->tree_id)
+GIT_COMMIT_GETTER(const git_signature *, author, commit->author, NULL)
+GIT_COMMIT_GETTER(const git_signature *, committer, commit->committer, NULL)
+GIT_COMMIT_GETTER(const char *, message_raw, commit->raw_message, NULL)
+GIT_COMMIT_GETTER(const char *, message_encoding, commit->message_encoding, NULL)
+GIT_COMMIT_GETTER(const char *, raw_header, commit->raw_header, NULL)
+GIT_COMMIT_GETTER(git_time_t, time, commit->committer->when.time, INT64_MIN)
+GIT_COMMIT_GETTER(int, time_offset, commit->committer->when.offset, -1)
+GIT_COMMIT_GETTER(unsigned int, parentcount, (unsigned int)git_array_size(commit->parent_ids), 0)
+GIT_COMMIT_GETTER(const git_oid *, tree_id, &commit->tree_id, NULL)
 
 const char *git_commit_message(const git_commit *commit)
 {
 	const char *message;
 
-	assert(commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(commit, NULL);
 
 	message = commit->raw_message;
 
@@ -544,7 +549,7 @@ const char *git_commit_summary(git_commit *commit)
 	const char *msg, *space;
 	bool space_contains_newline = false;
 
-	assert(commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(commit, NULL);
 
 	if (!commit->summary) {
 		for (msg = git_commit_message(commit), space = NULL; *msg; ++msg) {
@@ -587,7 +592,7 @@ const char *git_commit_body(git_commit *commit)
 {
 	const char *msg, *end;
 
-	assert(commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(commit, NULL);
 
 	if (!commit->body) {
 		/* search for end of summary */
@@ -612,14 +617,14 @@ const char *git_commit_body(git_commit *commit)
 
 int git_commit_tree(git_tree **tree_out, const git_commit *commit)
 {
-	assert(commit);
+	GIT_ASSERT_ARG(commit);
 	return git_tree_lookup(tree_out, commit->object.repo, &commit->tree_id);
 }
 
 const git_oid *git_commit_parent_id(
 	const git_commit *commit, unsigned int n)
 {
-	assert(commit);
+	GIT_ASSERT_ARG_WITH_RETVAL(commit, NULL);
 
 	return git_array_get(commit->parent_ids, n);
 }
@@ -628,7 +633,7 @@ int git_commit_parent(
 	git_commit **parent, const git_commit *commit, unsigned int n)
 {
 	const git_oid *parent_id;
-	assert(commit);
+	GIT_ASSERT_ARG(commit);
 
 	parent_id = git_commit_parent_id(commit, n);
 	if (parent_id == NULL) {
@@ -647,7 +652,8 @@ int git_commit_nth_gen_ancestor(
 	git_commit *current, *parent = NULL;
 	int error;
 
-	assert(ancestor && commit);
+	GIT_ASSERT_ARG(ancestor);
+	GIT_ASSERT_ARG(commit);
 
 	if (git_commit_dup(&current, (git_commit *)commit) < 0)
 		return -1;
@@ -840,7 +846,8 @@ int git_commit_create_buffer(git_buf *out,
 	git_array_oid_t parents_arr = GIT_ARRAY_INIT;
 	const git_oid *tree_id;
 
-	assert(tree && git_tree_owner(tree) == repo);
+	GIT_ASSERT_ARG(tree);
+	GIT_ASSERT_ARG(git_tree_owner(tree) == repo);
 
 	tree_id = git_tree_id(tree);
 
@@ -859,11 +866,13 @@ int git_commit_create_buffer(git_buf *out,
 /**
  * Append to 'out' properly marking continuations when there's a newline in 'content'
  */
-static void format_header_field(git_buf *out, const char *field, const char *content)
+static int format_header_field(git_buf *out, const char *field, const char *content)
 {
 	const char *lf;
 
-	assert(out && field && content);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(field);
+	GIT_ASSERT_ARG(content);
 
 	git_buf_puts(out, field);
 	git_buf_putc(out, ' ');
@@ -876,6 +885,8 @@ static void format_header_field(git_buf *out, const char *field, const char *con
 
 	git_buf_puts(out, content);
 	git_buf_putc(out, '\n');
+
+	return git_buf_oom(out) ? -1 : 0;
 }
 
 static const git_oid *commit_parent_from_commit(size_t n, void *payload)
@@ -926,7 +937,9 @@ int git_commit_create_with_signature(
 
 	if (signature != NULL) {
 		field = signature_field ? signature_field : "gpgsig";
-		format_header_field(&commit, field, signature);
+
+		if ((error = format_header_field(&commit, field, signature)) < 0)
+			goto cleanup;
 	}
 
 	git_buf_puts(&commit, header_end);
diff --git a/src/config.c b/src/config.c
index 42f46e6cf..a6a8cb246 100644
--- a/src/config.c
+++ b/src/config.c
@@ -108,7 +108,8 @@ int git_config_add_file_ondisk(
 	struct stat st;
 	int res;
 
-	assert(cfg && path);
+	GIT_ASSERT_ARG(cfg);
+	GIT_ASSERT_ARG(path);
 
 	res = p_stat(path, &st);
 	if (res < 0 && errno != ENOENT && errno != ENOTDIR) {
@@ -316,7 +317,8 @@ int git_config_add_backend(
 	backend_internal *internal;
 	int result;
 
-	assert(cfg && backend);
+	GIT_ASSERT_ARG(cfg);
+	GIT_ASSERT_ARG(backend);
 
 	GIT_ERROR_CHECK_VERSION(backend, GIT_CONFIG_BACKEND_VERSION, "git_config_backend");
 
@@ -514,7 +516,8 @@ int git_config_backend_foreach_match(
 	git_regexp regex;
 	int error = 0;
 
-	assert(backend && cb);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(cb);
 
 	if (regexp && git_regexp_compile(&regex, regexp, 0) < 0)
 		return -1;
@@ -886,7 +889,8 @@ int git_config_get_string_buf(
 	int ret;
 	const char *str;
 
-	git_buf_sanitize(out);
+	if ((ret = git_buf_sanitize(out)) < 0)
+		return ret;
 
 	ret  = get_entry(&entry, cfg, name, true, GET_ALL_ERRORS);
 	str = !ret ? (entry->value ? entry->value : "") : NULL;
@@ -1084,19 +1088,31 @@ void git_config_iterator_free(git_config_iterator *iter)
 
 int git_config_find_global(git_buf *path)
 {
-	git_buf_sanitize(path);
+	int error;
+
+	if ((error = git_buf_sanitize(path)) < 0)
+		return error;
+
 	return git_sysdir_find_global_file(path, GIT_CONFIG_FILENAME_GLOBAL);
 }
 
 int git_config_find_xdg(git_buf *path)
 {
-	git_buf_sanitize(path);
+	int error;
+
+	if ((error = git_buf_sanitize(path)) < 0)
+		return error;
+
 	return git_sysdir_find_xdg_file(path, GIT_CONFIG_FILENAME_XDG);
 }
 
 int git_config_find_system(git_buf *path)
 {
-	git_buf_sanitize(path);
+	int error;
+
+	if ((error = git_buf_sanitize(path)) < 0)
+		return error;
+
 	return git_sysdir_find_system_file(path, GIT_CONFIG_FILENAME_SYSTEM);
 }
 
@@ -1104,7 +1120,9 @@ int git_config_find_programdata(git_buf *path)
 {
 	int ret;
 
-	git_buf_sanitize(path);
+	if ((ret = git_buf_sanitize(path)) < 0)
+		return ret;
+
 	ret = git_sysdir_find_programdata_file(path,
 					       GIT_CONFIG_FILENAME_PROGRAMDATA);
 	if (ret != GIT_OK)
@@ -1182,7 +1200,7 @@ int git_config_lock(git_transaction **out, git_config *cfg)
 	git_config_backend *backend;
 	backend_internal *internal;
 
-	assert(cfg);
+	GIT_ASSERT_ARG(cfg);
 
 	internal = git_vector_get(&cfg->backends, 0);
 	if (!internal || !internal->backend) {
@@ -1202,7 +1220,7 @@ int git_config_unlock(git_config *cfg, int commit)
 	git_config_backend *backend;
 	backend_internal *internal;
 
-	assert(cfg);
+	GIT_ASSERT_ARG(cfg);
 
 	internal = git_vector_get(&cfg->backends, 0);
 	if (!internal || !internal->backend) {
@@ -1360,9 +1378,13 @@ fail_parse:
 
 int git_config_parse_path(git_buf *out, const char *value)
 {
-	assert(out && value);
+	int error;
 
-	git_buf_sanitize(out);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(value);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	if (value[0] == '~') {
 		if (value[1] != '\0' && value[1] != '/') {
@@ -1405,7 +1427,8 @@ int git_config__normalize_name(const char *in, char **out)
 {
 	char *name, *fdot, *ldot;
 
-	assert(in && out);
+	GIT_ASSERT_ARG(in);
+	GIT_ASSERT_ARG(out);
 
 	name = git__strdup(in);
 	GIT_ERROR_CHECK_ALLOC(name);
diff --git a/src/config_file.c b/src/config_file.c
index b1e002836..7fba71a98 100644
--- a/src/config_file.c
+++ b/src/config_file.c
@@ -365,7 +365,7 @@ static int config_file_set_multivar(
 	int result;
 	char *key;
 
-	assert(regexp);
+	GIT_ASSERT_ARG(regexp);
 
 	if ((result = git_config__normalize_name(name, &key)) < 0)
 		return result;
@@ -531,7 +531,7 @@ static char *escape_value(const char *ptr)
 	size_t len;
 	const char *esc;
 
-	assert(ptr);
+	GIT_ASSERT_ARG_WITH_RETVAL(ptr, NULL);
 
 	len = strlen(ptr);
 	if (!len)
diff --git a/src/config_parse.c b/src/config_parse.c
index ed2c87f6b..7da92d3e7 100644
--- a/src/config_parse.c
+++ b/src/config_parse.c
@@ -187,7 +187,7 @@ static int parse_section_header(git_config_parser *reader, char **section_out)
 
 	/* Make sure we were given a section header */
 	c = line[pos++];
-	assert(c == '[');
+	GIT_ASSERT(c == '[');
 
 	c = line[pos++];
 
diff --git a/src/date.c b/src/date.c
index 0e1b31aee..f8594ed4e 100644
--- a/src/date.c
+++ b/src/date.c
@@ -881,7 +881,8 @@ int git__date_rfc2822_fmt(char *out, size_t len, const git_time *date)
 	struct tm gmt;
 	time_t t;
 
-	assert(out && date);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(date);
 
 	t = (time_t) (date->time + date->offset * 60);
 
diff --git a/src/delta.c b/src/delta.c
index 1ff7752c7..2d2c5fa85 100644
--- a/src/delta.c
+++ b/src/delta.c
@@ -256,7 +256,7 @@ void git_delta_index_free(git_delta_index *index)
 
 size_t git_delta_index_size(git_delta_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	return index->memsize;
 }
diff --git a/src/describe.c b/src/describe.c
index 8beffdeba..3648ccef6 100644
--- a/src/describe.c
+++ b/src/describe.c
@@ -655,7 +655,8 @@ int git_describe_commit(
 	int error = -1;
 	git_describe_options normalized;
 
-	assert(committish);
+	GIT_ASSERT_ARG(result);
+	GIT_ASSERT_ARG(committish);
 
 	data.result = git__calloc(1, sizeof(git_describe_result));
 	GIT_ERROR_CHECK_ALLOC(data.result);
@@ -775,12 +776,14 @@ int git_describe_format(git_buf *out, const git_describe_result *result, const g
 	struct commit_name *name;
 	git_describe_format_options opts;
 
-	assert(out && result);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(result);
 
 	GIT_ERROR_CHECK_VERSION(given, GIT_DESCRIBE_FORMAT_OPTIONS_VERSION, "git_describe_format_options");
 	normalize_format_options(&opts, given);
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 
 	if (opts.always_use_long_format && opts.abbreviated_size == 0) {
diff --git a/src/diff.c b/src/diff.c
index 3e52e3f18..4085c5f78 100644
--- a/src/diff.c
+++ b/src/diff.c
@@ -77,7 +77,7 @@ void git_diff_addref(git_diff *diff)
 
 size_t git_diff_num_deltas(const git_diff *diff)
 {
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 	return diff->deltas.length;
 }
 
@@ -86,7 +86,7 @@ size_t git_diff_num_deltas_of_type(const git_diff *diff, git_delta_t type)
 	size_t i, count = 0;
 	const git_diff_delta *delta;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	git_vector_foreach(&diff->deltas, i, delta) {
 		count += (delta->status == type);
@@ -97,7 +97,7 @@ size_t git_diff_num_deltas_of_type(const git_diff *diff, git_delta_t type)
 
 const git_diff_delta *git_diff_get_delta(const git_diff *diff, size_t idx)
 {
-	assert(diff);
+	GIT_ASSERT_ARG_WITH_RETVAL(diff, NULL);
 	return git_vector_get(&diff->deltas, idx);
 }
 
@@ -108,7 +108,7 @@ int git_diff_is_sorted_icase(const git_diff *diff)
 
 int git_diff_get_perfdata(git_diff_perfdata *out, const git_diff *diff)
 {
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	GIT_ERROR_CHECK_VERSION(out, GIT_DIFF_PERFDATA_VERSION, "git_diff_perfdata");
 	out->stat_calls = diff->perf.stat_calls;
 	out->oid_calculations = diff->perf.oid_calculations;
@@ -127,7 +127,7 @@ int git_diff_foreach(
 	git_diff_delta *delta;
 	size_t idx;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	git_vector_foreach(&diff->deltas, idx, delta) {
 		git_patch *patch;
@@ -243,8 +243,9 @@ int git_diff_format_email(
 	size_t allocsize;
 	int error;
 
-	assert(out && diff && opts);
-	assert(opts->summary && opts->id && opts->author);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diff);
+	GIT_ASSERT_ARG(opts && opts->summary && opts->id && opts->author);
 
 	GIT_ERROR_CHECK_VERSION(opts,
 		GIT_DIFF_FORMAT_EMAIL_OPTIONS_VERSION,
@@ -326,7 +327,9 @@ int git_diff_commit_as_email(
 		GIT_DIFF_FORMAT_EMAIL_OPTIONS_INIT;
 	int error;
 
-	assert (out && repo && commit);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(commit);
 
 	opts.flags = flags;
 	opts.patch_no = patch_no;
diff --git a/src/diff_driver.c b/src/diff_driver.c
index 831d3262d..606c391e4 100644
--- a/src/diff_driver.c
+++ b/src/diff_driver.c
@@ -358,7 +358,7 @@ int git_diff_driver_lookup(
 	int error = 0;
 	const char *values[1], *attrs[] = { "diff" };
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	*out = NULL;
 
 	if (!repo || !path || !strlen(path))
diff --git a/src/diff_generate.c b/src/diff_generate.c
index e7bfd6223..745e5ae1b 100644
--- a/src/diff_generate.c
+++ b/src/diff_generate.c
@@ -128,7 +128,7 @@ static int diff_delta__from_one(
 	git_diff_delta *delta;
 	const char *matched_pathspec;
 
-	assert((oitem != NULL) ^ (nitem != NULL));
+	GIT_ASSERT_ARG((oitem != NULL) ^ (nitem != NULL));
 
 	if (oitem) {
 		entry = oitem;
@@ -160,7 +160,7 @@ static int diff_delta__from_one(
 	GIT_ERROR_CHECK_ALLOC(delta);
 
 	/* This fn is just for single-sided diffs */
-	assert(status != GIT_DELTA_MODIFIED);
+	GIT_ASSERT(status != GIT_DELTA_MODIFIED);
 	delta->nfiles = 1;
 
 	if (has_old) {
@@ -408,7 +408,9 @@ static git_diff_generated *diff_generated_alloc(
 	git_diff_generated *diff;
 	git_diff_options dflt = GIT_DIFF_OPTIONS_INIT;
 
-	assert(repo && old_iter && new_iter);
+	GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(old_iter, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(new_iter, NULL);
 
 	if ((diff = git__calloc(1, sizeof(git_diff_generated))) == NULL)
 		return NULL;
@@ -589,7 +591,7 @@ int git_diff__oid_for_entry(
 	git_filter_list *fl = NULL;
 	int error = 0;
 
-	assert(d->type == GIT_DIFF_TYPE_GENERATED);
+	GIT_ASSERT(d->type == GIT_DIFF_TYPE_GENERATED);
 	diff = (git_diff_generated *)d;
 
 	memset(out, 0, sizeof(*out));
@@ -1204,8 +1206,9 @@ int git_diff__from_iterators(
 
 	/* make iterators have matching icase behavior */
 	if (DIFF_FLAG_IS_SET(diff, GIT_DIFF_IGNORE_CASE)) {
-		git_iterator_set_ignore_case(old_iter, true);
-		git_iterator_set_ignore_case(new_iter, true);
+		if ((error = git_iterator_set_ignore_case(old_iter, true)) < 0 ||
+		    (error = git_iterator_set_ignore_case(new_iter, true)) < 0)
+			goto cleanup;
 	}
 
 	/* finish initialization */
@@ -1302,7 +1305,8 @@ int git_diff_tree_to_tree(
 	char *prefix = NULL;
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -1358,7 +1362,8 @@ int git_diff_tree_to_index(
 	bool index_ignore_case = false;
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -1401,7 +1406,8 @@ int git_diff_index_to_workdir(
 	char *prefix = NULL;
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -1444,7 +1450,8 @@ int git_diff_tree_to_workdir(
 	git_index *index;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -1477,7 +1484,8 @@ int git_diff_tree_to_workdir_with_index(
 	git_index *index = NULL;
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -1513,7 +1521,9 @@ int git_diff_index_to_index(
 	char *prefix = NULL;
 	int error;
 
-	assert(out && old_index && new_index);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(old_index);
+	GIT_ASSERT_ARG(new_index);
 
 	*out = NULL;
 
diff --git a/src/diff_print.c b/src/diff_print.c
index 9ce04d70e..062e267b0 100644
--- a/src/diff_print.c
+++ b/src/diff_print.c
@@ -95,7 +95,7 @@ static int diff_print_info_init_frompatch(
 	git_diff_line_cb cb,
 	void *payload)
 {
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	memset(pi, 0, sizeof(diff_print_info));
 
@@ -764,8 +764,14 @@ int git_diff_print_callback__to_file_handle(
 /* print a git_diff to a git_buf */
 int git_diff_to_buf(git_buf *out, git_diff *diff, git_diff_format_t format)
 {
-	assert(out && diff);
-	git_buf_sanitize(out);
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diff);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
+
 	return git_diff_print(diff, format, git_diff_print_callback__to_buf, out);
 }
 
@@ -779,7 +785,8 @@ int git_patch_print(
 	diff_print_info pi;
 	int error;
 
-	assert(patch && print_cb);
+	GIT_ASSERT_ARG(patch);
+	GIT_ASSERT_ARG(print_cb);
 
 	if ((error = diff_print_info_init_frompatch(&pi, &temp, patch,
 						    GIT_DIFF_FORMAT_PATCH, print_cb, payload)) < 0)
@@ -799,7 +806,13 @@ out:
 /* print a git_patch to a git_buf */
 int git_patch_to_buf(git_buf *out, git_patch *patch)
 {
-	assert(out && patch);
-	git_buf_sanitize(out);
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(patch);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
+
 	return git_patch_print(patch, git_diff_print_callback__to_buf, out);
 }
diff --git a/src/diff_stats.c b/src/diff_stats.c
index f5fda7925..41a25bf8a 100644
--- a/src/diff_stats.c
+++ b/src/diff_stats.c
@@ -183,7 +183,8 @@ int git_diff_get_stats(
 	git_diff_stats *stats = NULL;
 	int error = 0;
 
-	assert(out && diff);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diff);
 
 	stats = git__calloc(1, sizeof(git_diff_stats));
 	GIT_ERROR_CHECK_ALLOC(stats);
@@ -251,7 +252,7 @@ int git_diff_get_stats(
 size_t git_diff_stats_files_changed(
 	const git_diff_stats *stats)
 {
-	assert(stats);
+	GIT_ASSERT_ARG(stats);
 
 	return stats->files_changed;
 }
@@ -259,7 +260,7 @@ size_t git_diff_stats_files_changed(
 size_t git_diff_stats_insertions(
 	const git_diff_stats *stats)
 {
-	assert(stats);
+	GIT_ASSERT_ARG(stats);
 
 	return stats->insertions;
 }
@@ -267,7 +268,7 @@ size_t git_diff_stats_insertions(
 size_t git_diff_stats_deletions(
 	const git_diff_stats *stats)
 {
-	assert(stats);
+	GIT_ASSERT_ARG(stats);
 
 	return stats->deletions;
 }
@@ -282,7 +283,8 @@ int git_diff_stats_to_buf(
 	size_t i;
 	const git_diff_delta *delta;
 
-	assert(out && stats);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(stats);
 
 	if (format & GIT_DIFF_STATS_NUMBER) {
 		for (i = 0; i < stats->files_changed; ++i) {
diff --git a/src/diff_tform.c b/src/diff_tform.c
index 7de88bd0d..03fc2b0a6 100644
--- a/src/diff_tform.c
+++ b/src/diff_tform.c
@@ -87,7 +87,7 @@ git_diff_delta *git_diff__merge_like_cgit(
 		a->status == GIT_DELTA_UNREADABLE)
 		return dup;
 
-	assert(b->status != GIT_DELTA_UNMODIFIED);
+	GIT_ASSERT_WITH_RETVAL(b->status != GIT_DELTA_UNMODIFIED, NULL);
 
 	/* A cgit exception is that the diff of a file that is only in the
 	 * index (i.e. not in HEAD nor workdir) is given as empty.
@@ -121,7 +121,8 @@ int git_diff__merge(
 	bool ignore_case, reversed;
 	unsigned int i, j;
 
-	assert(onto && from);
+	GIT_ASSERT_ARG(onto);
+	GIT_ASSERT_ARG(from);
 
 	if (!from->deltas.length)
 		return 0;
@@ -815,7 +816,7 @@ int git_diff_find_similar(
 	diff_find_match *best_match;
 	git_diff_file swap;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	if ((error = normalize_find_opts(diff, &opts, given_opts)) < 0)
 		return error;
@@ -978,7 +979,7 @@ find_best_matches:
 				src->flags |= GIT_DIFF_FLAG__TO_DELETE;
 				num_rewrites++;
 			} else {
-				assert(delta_is_split(tgt));
+				GIT_ASSERT(delta_is_split(tgt));
 
 				if (best_match->similarity < opts.rename_from_rewrite_threshold)
 					continue;
@@ -988,7 +989,7 @@ find_best_matches:
 				delta_make_rename(tgt, src, best_match->similarity);
 				num_rewrites--;
 
-				assert(src->status == GIT_DELTA_DELETED);
+				GIT_ASSERT(src->status == GIT_DELTA_DELETED);
 				memcpy(&src->old_file, &swap, sizeof(src->old_file));
 				memset(&src->new_file, 0, sizeof(src->new_file));
 				src->new_file.path = src->old_file.path;
@@ -1024,7 +1025,7 @@ find_best_matches:
 
 				num_updates++;
 			} else {
-				assert(delta_is_split(src));
+				GIT_ASSERT(delta_is_split(src));
 
 				if (best_match->similarity < opts.rename_from_rewrite_threshold)
 					continue;
diff --git a/src/errors.c b/src/errors.c
index d4da50da8..5b68dd9cb 100644
--- a/src/errors.c
+++ b/src/errors.c
@@ -99,7 +99,7 @@ int git_error_set_str(int error_class, const char *string)
 {
 	git_buf *buf = &GIT_THREADSTATE->error_buf;
 
-	assert(string);
+	GIT_ASSERT_ARG(string);
 
 	if (!string) {
 		git_error_set(GIT_ERROR_INVALID, "unspecified caller error");
diff --git a/src/fetchhead.c b/src/fetchhead.c
index ea610f39a..88c567e48 100644
--- a/src/fetchhead.c
+++ b/src/fetchhead.c
@@ -73,7 +73,8 @@ int git_fetchhead_ref_create(
 {
 	git_fetchhead_ref *fetchhead_ref;
 
-	assert(out && oid);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(oid);
 
 	*out = NULL;
 
@@ -108,7 +109,8 @@ static int fetchhead_ref_write(
 	const char *type, *name;
 	int head = 0;
 
-	assert(file && fetchhead_ref);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(fetchhead_ref);
 
 	git_oid_fmt(oid, &fetchhead_ref->oid);
 	oid[GIT_OID_HEXSZ] = '\0';
@@ -145,7 +147,8 @@ int git_fetchhead_write(git_repository *repo, git_vector *fetchhead_refs)
 	unsigned int i;
 	git_fetchhead_ref *fetchhead_ref;
 
-	assert(repo && fetchhead_refs);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(fetchhead_refs);
 
 	if (git_buf_joinpath(&path, repo->gitdir, GIT_FETCH_HEAD_FILE) < 0)
 		return -1;
@@ -279,7 +282,8 @@ int git_repository_fetchhead_foreach(git_repository *repo,
 	size_t line_num = 0;
 	int error = 0;
 
-	assert(repo && cb);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(cb);
 
 	if (git_buf_joinpath(&path, repo->gitdir, GIT_FETCH_HEAD_FILE) < 0)
 		return -1;
diff --git a/src/filebuf.c b/src/filebuf.c
index e12a9eabf..a3f6b1483 100644
--- a/src/filebuf.c
+++ b/src/filebuf.c
@@ -184,7 +184,7 @@ static int write_deflate(git_filebuf *file, void *source, size_t len)
 
 		} while (zs->avail_out == 0);
 
-		assert(zs->avail_in == 0);
+		GIT_ASSERT(zs->avail_in == 0);
 
 		if (file->compute_digest)
 			git_hash_update(&file->digest, source, len);
@@ -278,10 +278,9 @@ int git_filebuf_open_withsize(git_filebuf *file, const char *path, int flags, mo
 	int compression, error = -1;
 	size_t path_len, alloc_len;
 
-	/* opening an already open buffer is a programming error;
-	 * assert that this never happens instead of returning
-	 * an error code */
-	assert(file && path && file->buffer == NULL);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(path);
+	GIT_ASSERT(file->buffer == NULL);
 
 	memset(file, 0x0, sizeof(git_filebuf));
 
@@ -389,7 +388,9 @@ cleanup:
 
 int git_filebuf_hash(git_oid *oid, git_filebuf *file)
 {
-	assert(oid && file && file->compute_digest);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(file->compute_digest);
 
 	flush_buffer(file);
 
@@ -415,7 +416,8 @@ int git_filebuf_commit_at(git_filebuf *file, const char *path)
 int git_filebuf_commit(git_filebuf *file)
 {
 	/* temporary files cannot be committed */
-	assert(file && file->path_original);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT(file->path_original);
 
 	file->flush_mode = Z_FINISH;
 	flush_buffer(file);
diff --git a/src/filter.c b/src/filter.c
index 86db5a5e3..ccabdcdc8 100644
--- a/src/filter.c
+++ b/src/filter.c
@@ -266,7 +266,8 @@ int git_filter_register(
 {
 	int error;
 
-	assert(name && filter);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(filter);
 
 	if (git_rwlock_wrlock(&filter_registry.lock) < 0) {
 		git_error_set(GIT_ERROR_OS, "failed to lock filter registry");
@@ -293,7 +294,7 @@ int git_filter_unregister(const char *name)
 	git_filter_def *fdef;
 	int error = 0;
 
-	assert(name);
+	GIT_ASSERT_ARG(name);
 
 	/* cannot unregister default filters */
 	if (!strcmp(GIT_FILTER_CRLF, name) || !strcmp(GIT_FILTER_IDENT, name)) {
@@ -618,7 +619,7 @@ int git_filter_list_contains(
 {
 	size_t i;
 
-	assert(name);
+	GIT_ASSERT_ARG(name);
 
 	if (!fl)
 		return 0;
@@ -639,7 +640,8 @@ int git_filter_list_push(
 	git_filter_def *fdef = NULL;
 	git_filter_entry *fe;
 
-	assert(fl && filter);
+	GIT_ASSERT_ARG(fl);
+	GIT_ASSERT_ARG(filter);
 
 	if (git_rwlock_rdlock(&filter_registry.lock) < 0) {
 		git_error_set(GIT_ERROR_OS, "failed to lock filter registry");
@@ -684,9 +686,8 @@ static int buf_stream_write(
 	git_writestream *s, const char *buffer, size_t len)
 {
 	struct buf_stream *buf_stream = (struct buf_stream *)s;
-	assert(buf_stream);
-
-	assert(buf_stream->complete == 0);
+	GIT_ASSERT_ARG(buf_stream);
+	GIT_ASSERT(buf_stream->complete == 0);
 
 	return git_buf_put(buf_stream->target, buffer, len);
 }
@@ -694,9 +695,9 @@ static int buf_stream_write(
 static int buf_stream_close(git_writestream *s)
 {
 	struct buf_stream *buf_stream = (struct buf_stream *)s;
-	assert(buf_stream);
+	GIT_ASSERT_ARG(buf_stream);
 
-	assert(buf_stream->complete == 0);
+	GIT_ASSERT(buf_stream->complete == 0);
 	buf_stream->complete = 1;
 
 	return 0;
@@ -725,8 +726,9 @@ int git_filter_list_apply_to_data(
 	struct buf_stream writer;
 	int error;
 
-	git_buf_sanitize(tgt);
-	git_buf_sanitize(src);
+	if ((error = git_buf_sanitize(tgt)) < 0 ||
+	    (error = git_buf_sanitize(src)) < 0)
+	    return error;
 
 	if (!filters) {
 		git_buf_attach_notowned(tgt, src->ptr, src->size);
@@ -739,7 +741,7 @@ int git_filter_list_apply_to_data(
 		&writer.parent)) < 0)
 			return error;
 
-	assert(writer.complete);
+	GIT_ASSERT(writer.complete);
 	return error;
 }
 
@@ -758,7 +760,7 @@ int git_filter_list_apply_to_file(
 		filters, repo, path, &writer.parent)) < 0)
 			return error;
 
-	assert(writer.complete);
+	GIT_ASSERT(writer.complete);
 	return error;
 }
 
@@ -789,7 +791,7 @@ int git_filter_list_apply_to_blob(
 		filters, blob, &writer.parent)) < 0)
 			return error;
 
-	assert(writer.complete);
+	GIT_ASSERT(writer.complete);
 	return error;
 }
 
@@ -808,7 +810,7 @@ static int proxy_stream_write(
 	git_writestream *s, const char *buffer, size_t len)
 {
 	struct proxy_stream *proxy_stream = (struct proxy_stream *)s;
-	assert(proxy_stream);
+	GIT_ASSERT_ARG(proxy_stream);
 
 	return git_buf_put(&proxy_stream->input, buffer, len);
 }
@@ -820,7 +822,7 @@ static int proxy_stream_close(git_writestream *s)
 	git_error_state error_state = {0};
 	int error;
 
-	assert(proxy_stream);
+	GIT_ASSERT_ARG(proxy_stream);
 
 	error = proxy_stream->filter->apply(
 		proxy_stream->filter,
@@ -832,7 +834,9 @@ static int proxy_stream_close(git_writestream *s)
 	if (error == GIT_PASSTHROUGH) {
 		writebuf = &proxy_stream->input;
 	} else if (error == 0) {
-		git_buf_sanitize(proxy_stream->output);
+		if ((error = git_buf_sanitize(proxy_stream->output)) < 0)
+			return error;
+
 		writebuf = proxy_stream->output;
 	} else {
 		/* close stream before erroring out taking care
@@ -853,11 +857,12 @@ static int proxy_stream_close(git_writestream *s)
 static void proxy_stream_free(git_writestream *s)
 {
 	struct proxy_stream *proxy_stream = (struct proxy_stream *)s;
-	assert(proxy_stream);
 
-	git_buf_dispose(&proxy_stream->input);
-	git_buf_dispose(&proxy_stream->temp_buf);
-	git__free(proxy_stream);
+	if (proxy_stream) {
+		git_buf_dispose(&proxy_stream->input);
+		git_buf_dispose(&proxy_stream->temp_buf);
+		git__free(proxy_stream);
+	}
 }
 
 static int proxy_stream_init(
@@ -911,7 +916,7 @@ static int stream_list_init(
 		git_filter_entry *fe = git_array_get(filters->filters, filter_idx);
 		git_writestream *filter_stream;
 
-		assert(fe->filter->stream || fe->filter->apply);
+		GIT_ASSERT(fe->filter->stream || fe->filter->apply);
 
 		/* If necessary, create a stream that proxies the traditional
 		 * application.
@@ -1004,7 +1009,8 @@ int git_filter_list_stream_data(
 	git_writestream *stream_start;
 	int error, initialized = 0;
 
-	git_buf_sanitize(data);
+	if ((error = git_buf_sanitize(data)) < 0)
+		return error;
 
 	if ((error = stream_list_init(&stream_start, &filter_streams, filters, target)) < 0)
 		goto out;
diff --git a/src/futils.c b/src/futils.c
index 2ad8a1b80..a44820875 100644
--- a/src/futils.c
+++ b/src/futils.c
@@ -185,7 +185,8 @@ int git_futils_readbuffer_updated(
 	git_buf buf = GIT_BUF_INIT;
 	git_oid checksum_new;
 
-	assert(out && path && *path);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(path && *path);
 
 	if (updated != NULL)
 		*updated = 0;
@@ -493,7 +494,7 @@ int git_futils_mkdir(
 			goto done;
 		}
 
-		assert(len);
+		GIT_ASSERT(len);
 
 		/*
 		 * We've walked all the given path's parents and it's either relative
@@ -1128,8 +1129,6 @@ int git_futils_filestamp_check(
 void git_futils_filestamp_set(
 	git_futils_filestamp *target, const git_futils_filestamp *source)
 {
-	assert(target);
-
 	if (source)
 		memcpy(target, source, sizeof(*target));
 	else
diff --git a/src/hash.c b/src/hash.c
index 405c46a9a..963c28137 100644
--- a/src/hash.c
+++ b/src/hash.c
@@ -31,7 +31,7 @@ void git_hash_ctx_cleanup(git_hash_ctx *ctx)
 			git_hash_sha1_ctx_cleanup(&ctx->sha1);
 			return;
 		default:
-			assert(0);
+			/* unreachable */ ;
 	}
 }
 
@@ -41,8 +41,7 @@ int git_hash_init(git_hash_ctx *ctx)
 		case GIT_HASH_ALGO_SHA1:
 			return git_hash_sha1_init(&ctx->sha1);
 		default:
-			assert(0);
-			return -1;
+			GIT_ASSERT(0);
 	}
 }
 
@@ -52,8 +51,7 @@ int git_hash_update(git_hash_ctx *ctx, const void *data, size_t len)
 		case GIT_HASH_ALGO_SHA1:
 			return git_hash_sha1_update(&ctx->sha1, data, len);
 		default:
-			assert(0);
-			return -1;
+			GIT_ASSERT(0);
 	}
 }
 
@@ -63,8 +61,7 @@ int git_hash_final(git_oid *out, git_hash_ctx *ctx)
 		case GIT_HASH_ALGO_SHA1:
 			return git_hash_sha1_final(out, &ctx->sha1);
 		default:
-			assert(0);
-			return -1;
+			GIT_ASSERT(0);
 	}
 }
 
@@ -80,7 +77,7 @@ int git_hash_buf(git_oid *out, const void *data, size_t len)
 		error = git_hash_final(out, &ctx);
 
 	git_hash_ctx_cleanup(&ctx);
-	
+
 	return error;
 }
 
diff --git a/src/hash/sha1/collisiondetect.c b/src/hash/sha1/collisiondetect.c
index e6a126780..722ebf36f 100644
--- a/src/hash/sha1/collisiondetect.c
+++ b/src/hash/sha1/collisiondetect.c
@@ -24,21 +24,21 @@ void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
 
 int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	SHA1DCInit(&ctx->c);
 	return 0;
 }
 
 int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	SHA1DCUpdate(&ctx->c, data, len);
 	return 0;
 }
 
 int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	if (SHA1DCFinal(out->id, &ctx->c)) {
 		git_error_set(GIT_ERROR_SHA1, "SHA1 collision attack detected");
 		return -1;
diff --git a/src/hash/sha1/common_crypto.c b/src/hash/sha1/common_crypto.c
index 0449a3c9d..4250e0b61 100644
--- a/src/hash/sha1/common_crypto.c
+++ b/src/hash/sha1/common_crypto.c
@@ -26,7 +26,7 @@ void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
 
 int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	CC_SHA1_Init(&ctx->c);
 	return 0;
 }
@@ -35,7 +35,7 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *_data, size_t len)
 {
 	const unsigned char *data = _data;
 
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	while (len > 0) {
 		CC_LONG chunk = (len > CC_LONG_MAX) ? CC_LONG_MAX : (CC_LONG)len;
@@ -51,7 +51,7 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *_data, size_t len)
 
 int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	CC_SHA1_Final(out->id, &ctx->c);
 	return 0;
 }
diff --git a/src/hash/sha1/mbedtls.c b/src/hash/sha1/mbedtls.c
index e44343fcf..04e7da5fa 100644
--- a/src/hash/sha1/mbedtls.c
+++ b/src/hash/sha1/mbedtls.c
@@ -19,28 +19,28 @@ int git_hash_sha1_ctx_init(git_hash_sha1_ctx *ctx)
 
 void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
 {
-    assert(ctx);
-    mbedtls_sha1_free(&ctx->c);
+	if (ctx)
+		mbedtls_sha1_free(&ctx->c);
 }
 
 int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 {
-    assert(ctx);
-    mbedtls_sha1_init(&ctx->c);
-    mbedtls_sha1_starts(&ctx->c);
-    return 0;
+	GIT_ASSERT_ARG(ctx);
+	mbedtls_sha1_init(&ctx->c);
+	mbedtls_sha1_starts(&ctx->c);
+	return 0;
 }
 
 int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 {
-    assert(ctx);
-    mbedtls_sha1_update(&ctx->c, data, len);
-    return 0;
+	GIT_ASSERT_ARG(ctx);
+	mbedtls_sha1_update(&ctx->c, data, len);
+	return 0;
 }
 
 int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 {
-    assert(ctx);
-    mbedtls_sha1_finish(&ctx->c, out->id);
-    return 0;
+	GIT_ASSERT_ARG(ctx);
+	mbedtls_sha1_finish(&ctx->c, out->id);
+	return 0;
 }
diff --git a/src/hash/sha1/openssl.c b/src/hash/sha1/openssl.c
index ba3212ff2..68d9611d4 100644
--- a/src/hash/sha1/openssl.c
+++ b/src/hash/sha1/openssl.c
@@ -24,7 +24,7 @@ void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
 
 int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	if (SHA1_Init(&ctx->c) != 1) {
 		git_error_set(GIT_ERROR_SHA1, "hash_openssl: failed to initialize hash context");
@@ -36,7 +36,7 @@ int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 
 int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	if (SHA1_Update(&ctx->c, data, len) != 1) {
 		git_error_set(GIT_ERROR_SHA1, "hash_openssl: failed to update hash");
@@ -48,7 +48,7 @@ int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 
 int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	if (SHA1_Final(out->id, &ctx->c) != 1) {
 		git_error_set(GIT_ERROR_SHA1, "hash_openssl: failed to finalize hash");
diff --git a/src/hash/sha1/win32.c b/src/hash/sha1/win32.c
index b1266cca0..a6e7061c6 100644
--- a/src/hash/sha1/win32.c
+++ b/src/hash/sha1/win32.c
@@ -164,7 +164,7 @@ GIT_INLINE(int) hash_cryptoapi_update(git_hash_sha1_ctx *ctx, const void *_data,
 {
 	const BYTE *data = (BYTE *)_data;
 
-	assert(ctx->ctx.cryptoapi.valid);
+	GIT_ASSERT(ctx->ctx.cryptoapi.valid);
 
 	while (len > 0) {
 		DWORD chunk = (len > MAXDWORD) ? MAXDWORD : (DWORD)len;
@@ -186,7 +186,7 @@ GIT_INLINE(int) hash_cryptoapi_final(git_oid *out, git_hash_sha1_ctx *ctx)
 	DWORD len = 20;
 	int error = 0;
 
-	assert(ctx->ctx.cryptoapi.valid);
+	GIT_ASSERT(ctx->ctx.cryptoapi.valid);
 
 	if (!CryptGetHashParam(ctx->ctx.cryptoapi.hash_handle, HP_HASHVAL, out->id, &len, 0)) {
 		git_error_set(GIT_ERROR_OS, "legacy hash data could not be finished");
@@ -286,7 +286,7 @@ int git_hash_sha1_ctx_init(git_hash_sha1_ctx *ctx)
 {
 	int error = 0;
 
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	/*
 	 * When compiled with GIT_THREADS, the global hash_prov data is
@@ -303,27 +303,30 @@ int git_hash_sha1_ctx_init(git_hash_sha1_ctx *ctx)
 
 int git_hash_sha1_init(git_hash_sha1_ctx *ctx)
 {
-	assert(ctx && ctx->type);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(ctx->type);
 	return (ctx->type == CNG) ? hash_cng_init(ctx) : hash_cryptoapi_init(ctx);
 }
 
 int git_hash_sha1_update(git_hash_sha1_ctx *ctx, const void *data, size_t len)
 {
-	assert(ctx && ctx->type);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(ctx->type);
 	return (ctx->type == CNG) ? hash_cng_update(ctx, data, len) : hash_cryptoapi_update(ctx, data, len);
 }
 
 int git_hash_sha1_final(git_oid *out, git_hash_sha1_ctx *ctx)
 {
-	assert(ctx && ctx->type);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(ctx->type);
 	return (ctx->type == CNG) ? hash_cng_final(out, ctx) : hash_cryptoapi_final(out, ctx);
 }
 
 void git_hash_sha1_ctx_cleanup(git_hash_sha1_ctx *ctx)
 {
-	assert(ctx);
-
-	if (ctx->type == CNG)
+	if (!ctx)
+		return;
+	else if (ctx->type == CNG)
 		hash_ctx_cng_cleanup(ctx);
 	else if(ctx->type == CRYPTOAPI)
 		hash_ctx_cryptoapi_cleanup(ctx);
diff --git a/src/hashsig.c b/src/hashsig.c
index 14ec34b2f..a5fbeee10 100644
--- a/src/hashsig.c
+++ b/src/hashsig.c
@@ -133,13 +133,13 @@ typedef struct {
 	uint8_t ignore_ch[256];
 } hashsig_in_progress;
 
-static void hashsig_in_progress_init(
+static int hashsig_in_progress_init(
 	hashsig_in_progress *prog, git_hashsig *sig)
 {
 	int i;
 
 	/* no more than one can be set */
-	assert(!(sig->opt & GIT_HASHSIG_IGNORE_WHITESPACE) ||
+	GIT_ASSERT(!(sig->opt & GIT_HASHSIG_IGNORE_WHITESPACE) ||
 		   !(sig->opt & GIT_HASHSIG_SMART_WHITESPACE));
 
 	if (sig->opt & GIT_HASHSIG_IGNORE_WHITESPACE) {
@@ -153,6 +153,8 @@ static void hashsig_in_progress_init(
 	} else {
 		memset(prog, 0, sizeof(*prog));
 	}
+
+	return 0;
 }
 
 static int hashsig_add_hashes(
@@ -251,7 +253,8 @@ int git_hashsig_create(
 	git_hashsig *sig = hashsig_alloc(opts);
 	GIT_ERROR_CHECK_ALLOC(sig);
 
-	hashsig_in_progress_init(&prog, sig);
+	if ((error = hashsig_in_progress_init(&prog, sig)) < 0)
+		return error;
 
 	error = hashsig_add_hashes(sig, (const uint8_t *)buf, buflen, &prog);
 
@@ -283,7 +286,8 @@ int git_hashsig_create_fromfile(
 		return fd;
 	}
 
-	hashsig_in_progress_init(&prog, sig);
+	if ((error = hashsig_in_progress_init(&prog, sig)) < 0)
+		return error;
 
 	while (!error) {
 		if ((buflen = p_read(fd, buf, sizeof(buf))) <= 0) {
@@ -318,7 +322,7 @@ static int hashsig_heap_compare(const hashsig_heap *a, const hashsig_heap *b)
 {
 	int matches = 0, i, j, cmp;
 
-	assert(a->cmp == b->cmp);
+	GIT_ASSERT_WITH_RETVAL(a->cmp == b->cmp, 0);
 
 	/* hash heaps are sorted - just look for overlap vs total */
 
@@ -354,9 +358,16 @@ int git_hashsig_compare(const git_hashsig *a, const git_hashsig *b)
 	/* if we have fewer than the maximum number of elements, then just use
 	 * one array since the two arrays will be the same
 	 */
-	if (a->mins.size < HASHSIG_HEAP_SIZE)
+	if (a->mins.size < HASHSIG_HEAP_SIZE) {
 		return hashsig_heap_compare(&a->mins, &b->mins);
-	else
-		return (hashsig_heap_compare(&a->mins, &b->mins) +
-				hashsig_heap_compare(&a->maxs, &b->maxs)) / 2;
+	} else {
+		int mins, maxs;
+
+		if ((mins = hashsig_heap_compare(&a->mins, &b->mins)) < 0)
+			return mins;
+		if ((maxs = hashsig_heap_compare(&a->maxs, &b->maxs)) < 0)
+			return maxs;
+
+		return (mins + maxs) / 2;
+	}
 }
diff --git a/src/ignore.c b/src/ignore.c
index f5fb507e6..27a650b1b 100644
--- a/src/ignore.c
+++ b/src/ignore.c
@@ -287,7 +287,9 @@ int git_ignore__for_path(
 	const char *workdir = git_repository_workdir(repo);
 	git_buf infopath = GIT_BUF_INIT;
 
-	assert(repo && ignores && path);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(ignores);
+	GIT_ASSERT_ARG(path);
 
 	memset(ignores, 0, sizeof(*ignores));
 	ignores->repo = repo;
@@ -521,7 +523,9 @@ int git_ignore_path_is_ignored(
 	git_attr_file *file;
 	git_dir_flag dir_flag = GIT_DIR_FLAG_UNKNOWN;
 
-	assert(repo && ignored && pathname);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(ignored);
+	GIT_ASSERT_ARG(pathname);
 
 	workdir = git_repository_workdir(repo);
 
diff --git a/src/index.c b/src/index.c
index d5afc9bb6..d9116c412 100644
--- a/src/index.c
+++ b/src/index.c
@@ -406,7 +406,7 @@ int git_index_open(git_index **index_out, const char *index_path)
 	git_index *index;
 	int error = -1;
 
-	assert(index_out);
+	GIT_ASSERT_ARG(index_out);
 
 	index = git__calloc(1, sizeof(git_index));
 	GIT_ERROR_CHECK_ALLOC(index);
@@ -461,7 +461,8 @@ static void index_free(git_index *index)
 	/* index iterators increment the refcount of the index, so if we
 	 * get here then there should be no outstanding iterators.
 	 */
-	assert(!git_atomic_get(&index->readers));
+	if (git_atomic_get(&index->readers))
+		return;
 
 	git_index_clear(index);
 	git_idxmap_free(index->entries_map);
@@ -531,7 +532,7 @@ int git_index_clear(git_index *index)
 {
 	int error = 0;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	index->dirty = 1;
 	index->tree = NULL;
@@ -566,7 +567,7 @@ int git_index_set_caps(git_index *index, int caps)
 {
 	unsigned int old_ignore_case;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	old_ignore_case = index->ignore_case;
 
@@ -778,14 +779,14 @@ done:
 
 unsigned git_index_version(git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	return index->version;
 }
 
 int git_index_set_version(git_index *index, unsigned int version)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	if (version < INDEX_VERSION_NUMBER_LB ||
 	    version > INDEX_VERSION_NUMBER_UB) {
@@ -814,9 +815,9 @@ int git_index_write(git_index *index)
 	return error;
 }
 
-const char * git_index_path(const git_index *index)
+const char *git_index_path(const git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
 	return index->index_file_path;
 }
 
@@ -824,7 +825,8 @@ int git_index_write_tree(git_oid *oid, git_index *index)
 {
 	git_repository *repo;
 
-	assert(oid && index);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(index);
 
 	repo = INDEX_OWNER(index);
 
@@ -838,20 +840,25 @@ int git_index_write_tree(git_oid *oid, git_index *index)
 int git_index_write_tree_to(
 	git_oid *oid, git_index *index, git_repository *repo)
 {
-	assert(oid && index && repo);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(repo);
+
 	return git_tree__write_index(oid, index, repo);
 }
 
 size_t git_index_entrycount(const git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
+
 	return index->entries.length;
 }
 
 const git_index_entry *git_index_get_byindex(
 	git_index *index, size_t n)
 {
-	assert(index);
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
+
 	git_vector_sort(&index->entries);
 	return git_vector_get(&index->entries, n);
 }
@@ -862,7 +869,7 @@ const git_index_entry *git_index_get_bypath(
 	git_index_entry key = {{ 0 }};
 	git_index_entry *value;
 
-	assert(index);
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
 
 	key.path = path;
 	GIT_INDEX_ENTRY_STAGE_SET(&key, stage);
@@ -1039,23 +1046,24 @@ static int index_entry_reuc_init(git_index_reuc_entry **reuc_out,
 {
 	git_index_reuc_entry *reuc = NULL;
 
-	assert(reuc_out && path);
+	GIT_ASSERT_ARG(reuc_out);
+	GIT_ASSERT_ARG(path);
 
 	*reuc_out = reuc = reuc_entry_alloc(path);
 	GIT_ERROR_CHECK_ALLOC(reuc);
 
 	if ((reuc->mode[0] = ancestor_mode) > 0) {
-		assert(ancestor_oid);
+		GIT_ASSERT(ancestor_oid);
 		git_oid_cpy(&reuc->oid[0], ancestor_oid);
 	}
 
 	if ((reuc->mode[1] = our_mode) > 0) {
-		assert(our_oid);
+		GIT_ASSERT(our_oid);
 		git_oid_cpy(&reuc->oid[1], our_oid);
 	}
 
 	if ((reuc->mode[2] = their_mode) > 0) {
-		assert(their_oid);
+		GIT_ASSERT(their_oid);
 		git_oid_cpy(&reuc->oid[2], their_oid);
 	}
 
@@ -1347,7 +1355,8 @@ static int index_insert(
 	size_t path_length, position;
 	int error;
 
-	assert(index && entry_ptr);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(entry_ptr);
 
 	entry = *entry_ptr;
 
@@ -1472,7 +1481,8 @@ int git_index_add_from_buffer(
 	int error = 0;
 	git_oid id;
 
-	assert(index && source_entry->path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(source_entry && source_entry->path);
 
 	if (INDEX_OWNER(index) == NULL)
 		return create_index_error(-1,
@@ -1557,7 +1567,8 @@ int git_index_add_bypath(git_index *index, const char *path)
 	git_index_entry *entry = NULL;
 	int ret;
 
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 
 	if ((ret = index_entry_init(&entry, index, path)) == 0)
 		ret = index_insert(index, &entry, 1, false, false, true);
@@ -1609,7 +1620,8 @@ int git_index_remove_bypath(git_index *index, const char *path)
 {
 	int ret;
 
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 
 	if (((ret = git_index_remove(index, path, 0)) < 0 &&
 		ret != GIT_ENOTFOUND) ||
@@ -1629,7 +1641,7 @@ int git_index__fill(git_index *index, const git_vector *source_entries)
 	int error = 0;
 	size_t i;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	if (!source_entries->length)
 		return 0;
@@ -1670,7 +1682,8 @@ int git_index_add(git_index *index, const git_index_entry *source_entry)
 	git_index_entry *entry = NULL;
 	int ret;
 
-	assert(index && source_entry && source_entry->path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(source_entry && source_entry->path);
 
 	if (!valid_filemode(source_entry->mode)) {
 		git_error_set(GIT_ERROR_INDEX, "invalid entry mode");
@@ -1758,7 +1771,8 @@ int git_index_find_prefix(size_t *at_pos, git_index *index, const char *prefix)
 int git_index__find_pos(
 	size_t *out, git_index *index, const char *path, size_t path_len, int stage)
 {
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 	return index_find(out, index, path, path_len, stage);
 }
 
@@ -1766,7 +1780,8 @@ int git_index_find(size_t *at_pos, git_index *index, const char *path)
 {
 	size_t pos;
 
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 
 	if (git_vector_bsearch2(
 			&pos, &index->entries, index->entries_search_path, path) < 0) {
@@ -1799,7 +1814,7 @@ int git_index_conflict_add(git_index *index,
 	unsigned short i;
 	int ret = 0;
 
-	assert (index);
+	GIT_ASSERT_ARG(index);
 
 	if ((ancestor_entry &&
 			(ret = index_entry_dup(&entries[0], index, ancestor_entry)) < 0) ||
@@ -1870,7 +1885,10 @@ static int index_conflict__get_byindex(
 	size_t count;
 	int stage, len = 0;
 
-	assert(ancestor_out && our_out && their_out && index);
+	GIT_ASSERT_ARG(ancestor_out);
+	GIT_ASSERT_ARG(our_out);
+	GIT_ASSERT_ARG(their_out);
+	GIT_ASSERT_ARG(index);
 
 	*ancestor_out = NULL;
 	*our_out = NULL;
@@ -1916,7 +1934,11 @@ int git_index_conflict_get(
 	size_t pos;
 	int len = 0;
 
-	assert(ancestor_out && our_out && their_out && index && path);
+	GIT_ASSERT_ARG(ancestor_out);
+	GIT_ASSERT_ARG(our_out);
+	GIT_ASSERT_ARG(their_out);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 
 	*ancestor_out = NULL;
 	*our_out = NULL;
@@ -1963,13 +1985,14 @@ static int index_conflict_remove(git_index *index, const char *path)
 
 int git_index_conflict_remove(git_index *index, const char *path)
 {
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 	return index_conflict_remove(index, path);
 }
 
 int git_index_conflict_cleanup(git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 	return index_conflict_remove(index, NULL);
 }
 
@@ -1978,7 +2001,7 @@ int git_index_has_conflicts(const git_index *index)
 	size_t i;
 	git_index_entry *entry;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	git_vector_foreach(&index->entries, i, entry) {
 		if (GIT_INDEX_ENTRY_STAGE(entry) > 0)
@@ -1995,7 +2018,8 @@ int git_index_iterator_new(
 	git_index_iterator *it;
 	int error;
 
-	assert(iterator_out && index);
+	GIT_ASSERT_ARG(iterator_out);
+	GIT_ASSERT_ARG(index);
 
 	it = git__calloc(1, sizeof(git_index_iterator));
 	GIT_ERROR_CHECK_ALLOC(it);
@@ -2015,7 +2039,8 @@ int git_index_iterator_next(
 	const git_index_entry **out,
 	git_index_iterator *it)
 {
-	assert(out && it);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(it);
 
 	if (it->cur >= git_vector_length(&it->snap))
 		return GIT_ITEROVER;
@@ -2039,7 +2064,8 @@ int git_index_conflict_iterator_new(
 {
 	git_index_conflict_iterator *it = NULL;
 
-	assert(iterator_out && index);
+	GIT_ASSERT_ARG(iterator_out);
+	GIT_ASSERT_ARG(index);
 
 	it = git__calloc(1, sizeof(git_index_conflict_iterator));
 	GIT_ERROR_CHECK_ALLOC(it);
@@ -2059,7 +2085,10 @@ int git_index_conflict_next(
 	const git_index_entry *entry;
 	int len;
 
-	assert(ancestor_out && our_out && their_out && iterator);
+	GIT_ASSERT_ARG(ancestor_out);
+	GIT_ASSERT_ARG(our_out);
+	GIT_ASSERT_ARG(their_out);
+	GIT_ASSERT_ARG(iterator);
 
 	*ancestor_out = NULL;
 	*our_out = NULL;
@@ -2097,14 +2126,14 @@ void git_index_conflict_iterator_free(git_index_conflict_iterator *iterator)
 
 size_t git_index_name_entrycount(git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 	return index->names.length;
 }
 
 const git_index_name_entry *git_index_name_get_byindex(
 	git_index *index, size_t n)
 {
-	assert(index);
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
 
 	git_vector_sort(&index->names);
 	return git_vector_get(&index->names, n);
@@ -2125,7 +2154,7 @@ int git_index_name_add(git_index *index,
 {
 	git_index_name_entry *conflict_name;
 
-	assert((ancestor && ours) || (ancestor && theirs) || (ours && theirs));
+	GIT_ASSERT_ARG((ancestor && ours) || (ancestor && theirs) || (ours && theirs));
 
 	conflict_name = git__calloc(1, sizeof(git_index_name_entry));
 	GIT_ERROR_CHECK_ALLOC(conflict_name);
@@ -2148,7 +2177,7 @@ int git_index_name_clear(git_index *index)
 	size_t i;
 	git_index_name_entry *conflict_name;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	git_vector_foreach(&index->names, i, conflict_name)
 		index_name_entry_free(conflict_name);
@@ -2162,7 +2191,7 @@ int git_index_name_clear(git_index *index)
 
 size_t git_index_reuc_entrycount(git_index *index)
 {
-	assert(index);
+	GIT_ASSERT_ARG(index);
 	return index->reuc.length;
 }
 
@@ -2179,8 +2208,9 @@ static int index_reuc_insert(
 {
 	int res;
 
-	assert(index && reuc && reuc->path != NULL);
-	assert(git_vector_is_sorted(&index->reuc));
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(reuc && reuc->path != NULL);
+	GIT_ASSERT(git_vector_is_sorted(&index->reuc));
 
 	res = git_vector_insert_sorted(&index->reuc, reuc, &index_reuc_on_dup);
 	index->dirty = 1;
@@ -2196,7 +2226,8 @@ int git_index_reuc_add(git_index *index, const char *path,
 	git_index_reuc_entry *reuc = NULL;
 	int error = 0;
 
-	assert(index && path);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(path);
 
 	if ((error = index_entry_reuc_init(&reuc, path, ancestor_mode,
 			ancestor_oid, our_mode, our_oid, their_mode, their_oid)) < 0 ||
@@ -2215,12 +2246,14 @@ const git_index_reuc_entry *git_index_reuc_get_bypath(
 	git_index *index, const char *path)
 {
 	size_t pos;
-	assert(index && path);
+
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, NULL);
 
 	if (!index->reuc.length)
 		return NULL;
 
-	assert(git_vector_is_sorted(&index->reuc));
+	GIT_ASSERT_WITH_RETVAL(git_vector_is_sorted(&index->reuc), NULL);
 
 	if (git_index_reuc_find(&pos, index, path) < 0)
 		return NULL;
@@ -2231,8 +2264,8 @@ const git_index_reuc_entry *git_index_reuc_get_bypath(
 const git_index_reuc_entry *git_index_reuc_get_byindex(
 	git_index *index, size_t n)
 {
-	assert(index);
-	assert(git_vector_is_sorted(&index->reuc));
+	GIT_ASSERT_ARG_WITH_RETVAL(index, NULL);
+	GIT_ASSERT_WITH_RETVAL(git_vector_is_sorted(&index->reuc), NULL);
 
 	return git_vector_get(&index->reuc, n);
 }
@@ -2242,7 +2275,8 @@ int git_index_reuc_remove(git_index *index, size_t position)
 	int error;
 	git_index_reuc_entry *reuc;
 
-	assert(git_vector_is_sorted(&index->reuc));
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT(git_vector_is_sorted(&index->reuc));
 
 	reuc = git_vector_get(&index->reuc, position);
 	error = git_vector_remove(&index->reuc, position);
@@ -2258,7 +2292,7 @@ int git_index_reuc_clear(git_index *index)
 {
 	size_t i;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	for (i = 0; i < index->reuc.length; ++i)
 		index_entry_reuc_free(git__swap(index->reuc.contents[i], NULL));
@@ -2626,7 +2660,7 @@ static int parse_index(git_index *index, const char *buffer, size_t buffer_size)
 
 	seek_forward(INDEX_HEADER_SIZE);
 
-	assert(!index->entries.length);
+	GIT_ASSERT(!index->entries.length);
 
 	if ((error = index_map_resize(index->entries_map, header.entry_count, index->ignore_case)) < 0)
 		return error;
@@ -2799,7 +2833,8 @@ static int write_disk_entry(git_filebuf *file, git_index_entry *entry, const cha
 	if (last) {
 		varint_len = git_encode_varint((unsigned char *) path,
 					  disk_size, strlen(last) - same_len);
-		assert(varint_len > 0);
+		GIT_ASSERT(varint_len > 0);
+
 		path += varint_len;
 		disk_size -= varint_len;
 
@@ -2807,14 +2842,14 @@ static int write_disk_entry(git_filebuf *file, git_index_entry *entry, const cha
 		 * If using path compression, we are not allowed
 		 * to have additional trailing NULs.
 		 */
-		assert(disk_size == path_len + 1);
+		GIT_ASSERT(disk_size == path_len + 1);
 	} else {
 		/*
 		 * If no path compression is used, we do have
 		 * NULs as padding. As such, simply assert that
 		 * we have enough space left to write the path.
 		 */
-		assert(disk_size > path_len);
+		GIT_ASSERT(disk_size > path_len);
 	}
 
 	memcpy(path, path_start, path_len + 1);
@@ -3010,7 +3045,8 @@ static int write_index(git_oid *checksum, git_index *index, git_filebuf *file)
 	bool is_extended;
 	uint32_t index_version_number;
 
-	assert(index && file);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(file);
 
 	if (index->version <= INDEX_VERSION_NUMBER_EXT)  {
 		is_extended = is_index_extended(index);
@@ -3192,7 +3228,7 @@ static int git_index_read_iterator(
 	size_t i;
 	int error;
 
-	assert((new_iterator->flags & GIT_ITERATOR_DONT_IGNORE_CASE));
+	GIT_ASSERT((new_iterator->flags & GIT_ITERATOR_DONT_IGNORE_CASE));
 
 	if ((error = git_vector_init(&new_entries, new_length_hint, index->entries._cmp)) < 0 ||
 	    (error = git_vector_init(&remove_entries, index->entries.length, NULL)) < 0 ||
@@ -3364,7 +3400,7 @@ int git_index_add_all(
 	git_pathspec ps;
 	bool no_fnmatch = (flags & GIT_INDEX_ADD_DISABLE_PATHSPEC_MATCH) != 0;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	repo = INDEX_OWNER(index);
 	if ((error = git_repository__ensure_not_bare(repo, "index add all")) < 0)
@@ -3450,8 +3486,8 @@ static int index_apply_to_wd_diff(git_index *index, int action, const git_strarr
 		payload,
 	};
 
-	assert(index);
-	assert(action == INDEX_ACTION_UPDATE || action == INDEX_ACTION_ADDALL);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(action == INDEX_ACTION_UPDATE || action == INDEX_ACTION_ADDALL);
 
 	repo = INDEX_OWNER(index);
 
@@ -3505,7 +3541,7 @@ static int index_apply_to_all(
 	const char *match;
 	git_buf path = GIT_BUF_INIT;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	if ((error = git_pathspec__init(&ps, paths)) < 0)
 		return error;
diff --git a/src/indexer.c b/src/indexer.c
index 8c74f0e72..7b3db3101 100644
--- a/src/indexer.c
+++ b/src/indexer.c
@@ -239,7 +239,8 @@ static int hash_object_stream(git_indexer*idx, git_packfile_stream *stream)
 {
 	ssize_t read;
 
-	assert(idx && stream);
+	GIT_ASSERT_ARG(idx);
+	GIT_ASSERT_ARG(stream);
 
 	do {
 		if ((read = git_packfile_stream_read(stream, idx->objbuf, sizeof(idx->objbuf))) < 0)
@@ -262,7 +263,7 @@ static int advance_delta_offset(git_indexer *idx, git_object_t type)
 {
 	git_mwindow *w = NULL;
 
-	assert(type == GIT_OBJECT_REF_DELTA || type == GIT_OBJECT_OFS_DELTA);
+	GIT_ASSERT_ARG(type == GIT_OBJECT_REF_DELTA || type == GIT_OBJECT_OFS_DELTA);
 
 	if (type == GIT_OBJECT_REF_DELTA) {
 		idx->off += GIT_OID_RAWSZ;
@@ -282,7 +283,7 @@ static int read_object_stream(git_indexer *idx, git_packfile_stream *stream)
 {
 	ssize_t read;
 
-	assert(stream);
+	GIT_ASSERT_ARG(stream);
 
 	do {
 		read = git_packfile_stream_read(stream, idx->objbuf, sizeof(idx->objbuf));
@@ -612,7 +613,8 @@ static int write_at(git_indexer *idx, const void *data, off64_t offset, size_t s
 	git_map map;
 	int error;
 
-	assert(data && size);
+	GIT_ASSERT_ARG(data);
+	GIT_ASSERT_ARG(size);
 
 	if ((error = git__mmap_alignment(&mmap_alignment)) < 0)
 		return error;
@@ -759,7 +761,9 @@ int git_indexer_append(git_indexer *idx, const void *data, size_t size, git_inde
 	struct git_pack_header *hdr = &idx->hdr;
 	git_mwindow_file *mwf = &idx->pack->mwf;
 
-	assert(idx && data && stats);
+	GIT_ASSERT_ARG(idx);
+	GIT_ASSERT_ARG(data);
+	GIT_ASSERT_ARG(stats);
 
 	if ((error = append_to_pack(idx, data, size)) < 0)
 		return error;
@@ -813,7 +817,8 @@ int git_indexer_append(git_indexer *idx, const void *data, size_t size, git_inde
 	/* Now that we have data in the pack, let's try to parse it */
 
 	/* As the file grows any windows we try to use will be out of date */
-	git_mwindow_free_all(mwf);
+	if ((error = git_mwindow_free_all(mwf)) < 0)
+		goto on_error;
 
 	while (stats->indexed_objects < idx->nr_objects) {
 		if ((error = read_stream_object(idx, stats)) != 0) {
@@ -857,16 +862,16 @@ static int index_path(git_buf *path, git_indexer *idx, const char *suffix)
  * Rewind the packfile by the trailer, as we might need to fix the
  * packfile by injecting objects at the tail and must overwrite it.
  */
-static void seek_back_trailer(git_indexer *idx)
+static int seek_back_trailer(git_indexer *idx)
 {
 	idx->pack->mwf.size -= GIT_OID_RAWSZ;
-	git_mwindow_free_all(&idx->pack->mwf);
+	return git_mwindow_free_all(&idx->pack->mwf);
 }
 
 static int inject_object(git_indexer *idx, git_oid *id)
 {
-	git_odb_object *obj;
-	struct entry *entry;
+	git_odb_object *obj = NULL;
+	struct entry *entry = NULL;
 	struct git_pack_entry *pentry = NULL;
 	git_oid foo = {{0}};
 	unsigned char hdr[64];
@@ -876,12 +881,14 @@ static int inject_object(git_indexer *idx, git_oid *id)
 	size_t len, hdr_len;
 	int error;
 
-	seek_back_trailer(idx);
+	if ((error = seek_back_trailer(idx)) < 0)
+		goto cleanup;
+
 	entry_start = idx->pack->mwf.size;
 
-	if (git_odb_read(&obj, idx->odb, id) < 0) {
+	if ((error = git_odb_read(&obj, idx->odb, id)) < 0) {
 		git_error_set(GIT_ERROR_INDEXER, "missing delta bases");
-		return -1;
+		goto cleanup;
 	}
 
 	data = git_odb_object_data(obj);
@@ -893,8 +900,8 @@ static int inject_object(git_indexer *idx, git_oid *id)
 	entry->crc = crc32(0L, Z_NULL, 0);
 
 	/* Write out the object header */
-	hdr_len = git_packfile__object_header(hdr, len, git_odb_object_type(obj));
-	if ((error = append_to_pack(idx, hdr, hdr_len)) < 0)
+	if ((error = git_packfile__object_header(&hdr_len, hdr, len, git_odb_object_type(obj))) < 0 ||
+	    (error = append_to_pack(idx, hdr, hdr_len)) < 0)
 		goto cleanup;
 
 	idx->pack->mwf.size += hdr_len;
@@ -950,7 +957,7 @@ static int fix_thin_pack(git_indexer *idx, git_indexer_progress *stats)
 	unsigned int left = 0;
 	git_oid base;
 
-	assert(git_vector_length(&idx->deltas) > 0);
+	GIT_ASSERT(git_vector_length(&idx->deltas) > 0);
 
 	if (idx->odb == NULL) {
 		git_error_set(GIT_ERROR_INDEXER, "cannot fix a thin pack without an ODB");
@@ -1081,7 +1088,9 @@ static int update_header_and_rehash(git_indexer *idx, git_indexer_progress *stat
 	 * hash_partially() keep the existing trailer out of the
 	 * calculation.
 	 */
-	git_mwindow_free_all(mwf);
+	if (git_mwindow_free_all(mwf) < 0)
+		return -1;
+
 	idx->inbuf_len = 0;
 	while (hashed < mwf->size) {
 		ptr = git_mwindow_open(mwf, &w, hashed, chunk, &left);
@@ -1253,7 +1262,8 @@ int git_indexer_commit(git_indexer *idx, git_indexer_progress *stats)
 	if (git_filebuf_commit_at(&index_file, filename.ptr) < 0)
 		goto on_error;
 
-	git_mwindow_free_all(&idx->pack->mwf);
+	if (git_mwindow_free_all(&idx->pack->mwf) < 0)
+		goto on_error;
 
 	/* Truncate file to undo rounding up to next page_size in append_to_pack */
 	if (p_ftruncate(idx->pack->mwf.fd, idx->pack->mwf.size) < 0) {
diff --git a/src/iterator.c b/src/iterator.c
index a393187c0..073459501 100644
--- a/src/iterator.c
+++ b/src/iterator.c
@@ -330,7 +330,7 @@ static iterator_pathlist_search_t iterator_pathlist_search(
 			break;
 
 		/* an exact match would have been matched by the bsearch above */
-		assert(p[path_len]);
+		GIT_ASSERT_WITH_RETVAL(p[path_len], ITERATOR_PATHLIST_NONE);
 
 		/* is this a literal directory entry (eg `foo/`) or a file beneath */
 		if (p[path_len] == '/') {
@@ -678,14 +678,14 @@ done:
 	return error;
 }
 
-static void tree_iterator_frame_pop(tree_iterator *iter)
+static int tree_iterator_frame_pop(tree_iterator *iter)
 {
 	tree_iterator_frame *frame;
 	git_buf *buf = NULL;
 	git_tree *tree;
 	size_t i;
 
-	assert(iter->frames.size);
+	GIT_ASSERT(iter->frames.size);
 
 	frame = git_array_pop(iter->frames);
 
@@ -705,6 +705,8 @@ static void tree_iterator_frame_pop(tree_iterator *iter)
 	git_vector_free(&frame->similar_trees);
 
 	git_buf_dispose(&frame->path);
+
+	return 0;
 }
 
 static int tree_iterator_current(
@@ -760,7 +762,9 @@ static int tree_iterator_advance(const git_index_entry **out, git_iterator *i)
 
 		/* no more entries in this frame.  pop the frame out */
 		if (frame->next_idx == frame->entries.length) {
-			tree_iterator_frame_pop(iter);
+			if ((error = tree_iterator_frame_pop(iter)) < 0)
+				break;
+
 			continue;
 		}
 
@@ -838,7 +842,7 @@ static int tree_iterator_advance_into(
 	const git_index_entry **out, git_iterator *i)
 {
 	tree_iterator *iter = (tree_iterator *)i;
-    tree_iterator_frame *frame;
+	tree_iterator_frame *frame;
 	tree_iterator_entry *prev_entry;
 	int error;
 
@@ -855,7 +859,7 @@ static int tree_iterator_advance_into(
 	 * we will have pushed a new (empty) frame on to the stack for this
 	 * new directory.  since it's empty, its current_entry should be null.
 	 */
-	assert(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
+	GIT_ASSERT(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
 
 	if (prev_entry) {
 		if (!git_tree_entry__is_tree(prev_entry->tree_entry))
@@ -973,7 +977,7 @@ int git_iterator_current_tree_entry(
 	tree_iterator_frame *frame;
 	tree_iterator_entry *entry;
 
-	assert(i->type == GIT_ITERATOR_TREE);
+	GIT_ASSERT(i->type == GIT_ITERATOR_TREE);
 
 	iter = (tree_iterator *)i;
 
@@ -990,11 +994,11 @@ int git_iterator_current_parent_tree(
 	tree_iterator *iter;
 	tree_iterator_frame *frame;
 
-	assert(i->type == GIT_ITERATOR_TREE);
+	GIT_ASSERT(i->type == GIT_ITERATOR_TREE);
 
 	iter = (tree_iterator *)i;
 
-	assert(depth < iter->frames.size);
+	GIT_ASSERT(depth < iter->frames.size);
 	frame = &iter->frames.ptr[iter->frames.size-depth-1];
 
 	*parent_tree = frame->tree;
@@ -1388,7 +1392,7 @@ static int filesystem_iterator_frame_push(
 		if ((error = git_path_diriter_fullpath(&path, &path_len, &diriter)) < 0)
 			goto done;
 
-		assert(path_len > iter->root_len);
+		GIT_ASSERT(path_len > iter->root_len);
 
 		/* remove the prefix if requested */
 		path += iter->root_len;
@@ -1469,17 +1473,19 @@ done:
 	return error;
 }
 
-GIT_INLINE(void) filesystem_iterator_frame_pop(filesystem_iterator *iter)
+GIT_INLINE(int) filesystem_iterator_frame_pop(filesystem_iterator *iter)
 {
 	filesystem_iterator_frame *frame;
 
-	assert(iter->frames.size);
+	GIT_ASSERT(iter->frames.size);
 
 	frame = git_array_pop(iter->frames);
 	filesystem_iterator_frame_pop_ignores(iter);
 
 	git_pool_clear(&frame->entry_pool);
 	git_vector_free(&frame->entries);
+
+	return 0;
 }
 
 static void filesystem_iterator_set_current(
@@ -1646,7 +1652,7 @@ static int filesystem_iterator_advance_into(
 	 * we will have pushed a new (empty) frame on to the stack for this
 	 * new directory.  since it's empty, its current_entry should be null.
 	 */
-	assert(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
+	GIT_ASSERT(iterator__do_autoexpand(i) ^ (prev_entry != NULL));
 
 	if (prev_entry) {
 		if (prev_entry->st.st_mode != GIT_FILEMODE_COMMIT &&
@@ -1762,12 +1768,13 @@ static int filesystem_iterator_advance_over(
 	*out = NULL;
 	*status = GIT_ITERATOR_STATUS_NORMAL;
 
-	assert(iterator__has_been_accessed(i));
+	GIT_ASSERT(iterator__has_been_accessed(i));
 
 	current_frame = filesystem_iterator_current_frame(iter);
-	assert(current_frame);
+	GIT_ASSERT(current_frame);
+
 	current_entry = filesystem_iterator_current_entry(current_frame);
-	assert(current_entry);
+	GIT_ASSERT(current_entry);
 
 	if ((error = git_iterator_current(&entry, i)) < 0)
 		return error;
@@ -2065,8 +2072,8 @@ static bool index_iterator_create_pseudotree(
 
 static int index_iterator_skip_pseudotree(index_iterator *iter)
 {
-	assert(iterator__has_been_accessed(&iter->base));
-	assert(S_ISDIR(iter->entry->mode));
+	GIT_ASSERT(iterator__has_been_accessed(&iter->base));
+	GIT_ASSERT(S_ISDIR(iter->entry->mode));
 
 	while (true) {
 		const git_index_entry *next_entry = NULL;
@@ -2280,10 +2287,11 @@ int git_iterator_reset_range(
 	return i->cb->reset(i);
 }
 
-void git_iterator_set_ignore_case(git_iterator *i, bool ignore_case)
+int git_iterator_set_ignore_case(git_iterator *i, bool ignore_case)
 {
-	assert(!iterator__has_been_accessed(i));
+	GIT_ASSERT(!iterator__has_been_accessed(i));
 	iterator_set_ignore_case(i, ignore_case);
+	return 0;
 }
 
 void git_iterator_free(git_iterator *iter)
diff --git a/src/iterator.h b/src/iterator.h
index ebd69362b..30465df2f 100644
--- a/src/iterator.h
+++ b/src/iterator.h
@@ -263,7 +263,7 @@ GIT_INLINE(bool) git_iterator_ignore_case(git_iterator *iter)
 	return ((iter->flags & GIT_ITERATOR_IGNORE_CASE) != 0);
 }
 
-extern void git_iterator_set_ignore_case(
+extern int git_iterator_set_ignore_case(
 	git_iterator *iter, bool ignore_case);
 
 extern int git_iterator_current_tree_entry(
diff --git a/src/libgit2.c b/src/libgit2.c
index 07414bec8..9e5112dbf 100644
--- a/src/libgit2.c
+++ b/src/libgit2.c
@@ -122,29 +122,28 @@ int git_libgit2_features(void)
 	;
 }
 
-static int config_level_to_sysdir(int config_level)
+static int config_level_to_sysdir(int *out, int config_level)
 {
-	int val = -1;
-
 	switch (config_level) {
 	case GIT_CONFIG_LEVEL_SYSTEM:
-		val = GIT_SYSDIR_SYSTEM;
-		break;
+		*out = GIT_SYSDIR_SYSTEM;
+		return 0;
 	case GIT_CONFIG_LEVEL_XDG:
-		val = GIT_SYSDIR_XDG;
-		break;
+		*out = GIT_SYSDIR_XDG;
+		return 0;
 	case GIT_CONFIG_LEVEL_GLOBAL:
-		val = GIT_SYSDIR_GLOBAL;
-		break;
+		*out = GIT_SYSDIR_GLOBAL;
+		return 0;
 	case GIT_CONFIG_LEVEL_PROGRAMDATA:
-		val = GIT_SYSDIR_PROGRAMDATA;
-		break;
+		*out = GIT_SYSDIR_PROGRAMDATA;
+		return 0;
 	default:
-		git_error_set(
-			GIT_ERROR_INVALID, "invalid config path selector %d", config_level);
+		break;
 	}
 
-	return val;
+	git_error_set(
+		GIT_ERROR_INVALID, "invalid config path selector %d", config_level);
+	return -1;
 }
 
 const char *git_libgit2__user_agent(void)
@@ -190,12 +189,15 @@ int git_libgit2_opts(int key, ...)
 		break;
 
 	case GIT_OPT_GET_SEARCH_PATH:
-		if ((error = config_level_to_sysdir(va_arg(ap, int))) >= 0) {
+		{
+			int sysdir = va_arg(ap, int);
 			git_buf *out = va_arg(ap, git_buf *);
 			const git_buf *tmp;
+			int level;
 
-			git_buf_sanitize(out);
-			if ((error = git_sysdir_get(&tmp, error)) < 0)
+			if ((error = config_level_to_sysdir(&level, sysdir)) < 0 ||
+			    (error = git_buf_sanitize(out)) < 0 ||
+			    (error = git_sysdir_get(&tmp, level)) < 0)
 				break;
 
 			error = git_buf_sets(out, tmp->ptr);
@@ -203,8 +205,12 @@ int git_libgit2_opts(int key, ...)
 		break;
 
 	case GIT_OPT_SET_SEARCH_PATH:
-		if ((error = config_level_to_sysdir(va_arg(ap, int))) >= 0)
-			error = git_sysdir_set(error, va_arg(ap, const char *));
+		{
+			int level;
+
+			if ((error = config_level_to_sysdir(&level, va_arg(ap, int))) >= 0)
+				error = git_sysdir_set(level, va_arg(ap, const char *));
+		}
 		break;
 
 	case GIT_OPT_SET_CACHE_OBJECT_LIMIT:
@@ -233,8 +239,8 @@ int git_libgit2_opts(int key, ...)
 			git_buf *out = va_arg(ap, git_buf *);
 			const git_buf *tmp;
 
-			git_buf_sanitize(out);
-			if ((error = git_sysdir_get(&tmp, GIT_SYSDIR_TEMPLATE)) < 0)
+			if ((error = git_buf_sanitize(out)) < 0 ||
+			    (error = git_sysdir_get(&tmp, GIT_SYSDIR_TEMPLATE)) < 0)
 				break;
 
 			error = git_buf_sets(out, tmp->ptr);
@@ -303,7 +309,8 @@ int git_libgit2_opts(int key, ...)
 	case GIT_OPT_GET_USER_AGENT:
 		{
 			git_buf *out = va_arg(ap, git_buf *);
-			git_buf_sanitize(out);
+			if ((error = git_buf_sanitize(out)) < 0)
+				break;
 			error = git_buf_sets(out, git__user_agent);
 		}
 		break;
diff --git a/src/mailmap.c b/src/mailmap.c
index 409cdbd3c..347b43391 100644
--- a/src/mailmap.c
+++ b/src/mailmap.c
@@ -43,7 +43,8 @@ static int mailmap_entry_cmp(const void *a_raw, const void *b_raw)
 	const git_mailmap_entry *b = (const git_mailmap_entry *)b_raw;
 	int cmp;
 
-	assert(a && b && a->replace_email && b->replace_email);
+	GIT_ASSERT_ARG(a && a->replace_email);
+	GIT_ASSERT_ARG(b && b->replace_email);
 
 	cmp = git__strcmp(a->replace_email, b->replace_email);
 	if (cmp)
@@ -185,7 +186,8 @@ static int mailmap_add_entry_unterminated(
 	git_mailmap_entry *entry = git__calloc(1, sizeof(git_mailmap_entry));
 	GIT_ERROR_CHECK_ALLOC(entry);
 
-	assert(mm && replace_email && *replace_email);
+	GIT_ASSERT_ARG(mm);
+	GIT_ASSERT_ARG(replace_email && *replace_email);
 
 	if (real_name_size > 0) {
 		entry->real_name = git__substrdup(real_name, real_name_size);
@@ -290,7 +292,8 @@ static int mailmap_add_blob(
 	git_buf content = GIT_BUF_INIT;
 	int error;
 
-	assert(mm && repo);
+	GIT_ASSERT_ARG(mm);
+	GIT_ASSERT_ARG(repo);
 
 	error = git_revparse_single(&object, repo, rev);
 	if (error < 0)
@@ -350,8 +353,6 @@ static void mailmap_add_from_repository(git_mailmap *mm, git_repository *repo)
 	const char *rev = NULL;
 	const char *path = NULL;
 
-	assert(mm && repo);
-
 	/* If we're in a bare repo, default blob to 'HEAD:.mailmap' */
 	if (repo->is_bare)
 		rev = MM_BLOB_DEFAULT;
@@ -389,9 +390,14 @@ static void mailmap_add_from_repository(git_mailmap *mm, git_repository *repo)
 
 int git_mailmap_from_repository(git_mailmap **out, git_repository *repo)
 {
-	int error = git_mailmap_new(out);
-	if (error < 0)
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+
+	if ((error = git_mailmap_new(out)) < 0)
 		return error;
+
 	mailmap_add_from_repository(*out, repo);
 	return 0;
 }
@@ -408,7 +414,7 @@ const git_mailmap_entry *git_mailmap_entry_lookup(
 	git_mailmap_entry needle = { NULL };
 	needle.replace_email = (char *)email;
 
-	assert(email);
+	GIT_ASSERT_ARG_WITH_RETVAL(email, NULL);
 
 	if (!mm)
 		return NULL;
@@ -431,7 +437,8 @@ const git_mailmap_entry *git_mailmap_entry_lookup(
 		if (git__strcmp(entry->replace_email, email))
 			break; /* it's a different email, so we're done looking */
 
-		assert(entry->replace_name); /* should be specific */
+		 /* should be specific */
+		GIT_ASSERT_WITH_RETVAL(entry->replace_name, NULL);
 		if (!name || !git__strcmp(entry->replace_name, name))
 			return entry;
 	}
@@ -447,7 +454,9 @@ int git_mailmap_resolve(
 	const char *name, const char *email)
 {
 	const git_mailmap_entry *entry = NULL;
-	assert(name && email);
+
+	GIT_ASSERT(name);
+	GIT_ASSERT(email);
 
 	*real_name = name;
 	*real_email = email;
diff --git a/src/map.h b/src/map.h
index 6328d8cf4..01931d199 100644
--- a/src/map.h
+++ b/src/map.h
@@ -36,9 +36,9 @@ typedef struct { /* memory mapped buffer	*/
 } git_map;
 
 #define GIT_MMAP_VALIDATE(out, len, prot, flags) do { \
-	assert(out != NULL && len > 0); \
-	assert((prot & GIT_PROT_WRITE) || (prot & GIT_PROT_READ)); \
-	assert((flags & GIT_MAP_FIXED) == 0); } while (0)
+	GIT_ASSERT(out != NULL && len > 0); \
+	GIT_ASSERT((prot & GIT_PROT_WRITE) || (prot & GIT_PROT_READ)); \
+	GIT_ASSERT((flags & GIT_MAP_FIXED) == 0); } while (0)
 
 extern int p_mmap(git_map *out, size_t len, int prot, int flags, int fd, off64_t offset);
 extern int p_munmap(git_map *map);
diff --git a/src/merge.c b/src/merge.c
index 2f6bf6fe7..e02ea9169 100644
--- a/src/merge.c
+++ b/src/merge.c
@@ -139,7 +139,9 @@ int git_merge_base_many(git_oid *out, git_repository *repo, size_t length, const
 	git_commit_list *result = NULL;
 	int error = 0;
 
-	assert(out && repo && input_array);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(input_array);
 
 	if ((error = merge_bases_many(&result, &walk, repo, length, input_array)) < 0)
 		return error;
@@ -159,7 +161,9 @@ int git_merge_bases_many(git_oidarray *out, git_repository *repo, size_t length,
 	int error = 0;
 	git_array_oid_t array;
 
-	assert(out && repo && input_array);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(input_array);
 
 	if ((error = merge_bases_many(&result, &walk, repo, length, input_array)) < 0)
 		return error;
@@ -193,7 +197,9 @@ int git_merge_base_octopus(git_oid *out, git_repository *repo, size_t length, co
 	unsigned int i;
 	int error = -1;
 
-	assert(out && repo && input_array);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(input_array);
 
 	if (length < 2) {
 		git_error_set(GIT_ERROR_INVALID, "at least two commits are required to find an ancestor");
@@ -581,7 +587,8 @@ int git_repository_mergehead_foreach(
 	git_oid oid;
 	int error = 0;
 
-	assert(repo && cb);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(cb);
 
 	if ((error = git_buf_joinpath(&merge_head_path, repo->gitdir,
 		GIT_MERGE_HEAD_FILE)) < 0)
@@ -650,7 +657,9 @@ static int merge_conflict_resolve_trivial(
 	git_index_entry const *result = NULL;
 	int error = 0;
 
-	assert(resolved && diff_list && conflict);
+	GIT_ASSERT_ARG(resolved);
+	GIT_ASSERT_ARG(diff_list);
+	GIT_ASSERT_ARG(conflict);
 
 	*resolved = 0;
 
@@ -733,7 +742,9 @@ static int merge_conflict_resolve_one_removed(
 	int ours_changed, theirs_changed;
 	int error = 0;
 
-	assert(resolved && diff_list && conflict);
+	GIT_ASSERT_ARG(resolved);
+	GIT_ASSERT_ARG(diff_list);
+	GIT_ASSERT_ARG(conflict);
 
 	*resolved = 0;
 
@@ -773,7 +784,9 @@ static int merge_conflict_resolve_one_renamed(
 	git_index_entry *merged;
 	int error = 0;
 
-	assert(resolved && diff_list && conflict);
+	GIT_ASSERT_ARG(resolved);
+	GIT_ASSERT_ARG(diff_list);
+	GIT_ASSERT_ARG(conflict);
 
 	*resolved = 0;
 
@@ -917,7 +930,9 @@ static int merge_conflict_resolve_contents(
 	bool fallback = false;
 	int error;
 
-	assert(resolved && diff_list && conflict);
+	GIT_ASSERT_ARG(resolved);
+	GIT_ASSERT_ARG(diff_list);
+	GIT_ASSERT_ARG(conflict);
 
 	*resolved = 0;
 
@@ -1517,7 +1532,8 @@ int git_merge_diff_list__find_renames(
 	size_t src_count, tgt_count, i;
 	int error = 0;
 
-	assert(diff_list && opts);
+	GIT_ASSERT_ARG(diff_list);
+	GIT_ASSERT_ARG(opts);
 
 	if ((opts->flags & GIT_MERGE_FIND_RENAMES) == 0)
 		return 0;
@@ -1843,7 +1859,8 @@ static int merge_normalize_opts(
 	git_config_entry *entry = NULL;
 	int error = 0;
 
-	assert(repo && opts);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(opts);
 
 	if ((error = git_repository_config__weakptr(&cfg, repo)) < 0)
 		return error;
@@ -2070,7 +2087,8 @@ int git_merge__iterators(
 	size_t i;
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -2154,7 +2172,8 @@ int git_merge_trees(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	/* if one side is treesame to the ancestor, take the other side */
 	if (ancestor_tree && merge_opts && (merge_opts->flags & GIT_MERGE_SKIP_REUC)) {
@@ -2441,7 +2460,8 @@ static int write_merge_head(
 	size_t i;
 	int error = 0;
 
-	assert(repo && heads);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(heads);
 
 	if ((error = git_buf_joinpath(&file_path, repo->gitdir, GIT_MERGE_HEAD_FILE)) < 0 ||
 		(error = git_filebuf_open(&file, file_path.ptr, GIT_FILEBUF_CREATE_LEADING_DIRS, GIT_MERGE_FILE_MODE)) < 0)
@@ -2469,7 +2489,7 @@ static int write_merge_mode(git_repository *repo)
 	git_buf file_path = GIT_BUF_INIT;
 	int error = 0;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = git_buf_joinpath(&file_path, repo->gitdir, GIT_MERGE_MODE_FILE)) < 0 ||
 		(error = git_filebuf_open(&file, file_path.ptr, GIT_FILEBUF_CREATE_LEADING_DIRS, GIT_MERGE_FILE_MODE)) < 0)
@@ -2689,7 +2709,8 @@ static int write_merge_msg(
 	char sep = 0;
 	int error = 0;
 
-	assert(repo && heads);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(heads);
 
 	entries = git__calloc(heads_len, sizeof(struct merge_msg_entry));
 	GIT_ERROR_CHECK_ALLOC(entries);
@@ -2800,7 +2821,9 @@ int git_merge__setup(
 {
 	int error = 0;
 
-	assert (repo && our_head && heads);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(our_head);
+	GIT_ASSERT_ARG(heads);
 
 	if ((error = git_repository__set_orig_head(repo, git_annotated_commit_id(our_head))) == 0 &&
 		(error = write_merge_head(repo, heads, heads_len)) == 0 &&
@@ -2824,7 +2847,9 @@ static int merge_ancestor_head(
 	size_t i, alloc_len;
 	int error = 0;
 
-	assert(repo && our_head && their_heads);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(our_head);
+	GIT_ASSERT_ARG(their_heads);
 
 	GIT_ERROR_CHECK_ALLOC_ADD(&alloc_len, their_heads_len, 1);
 	oids = git__calloc(alloc_len, sizeof(git_oid));
@@ -3202,7 +3227,10 @@ int git_merge_analysis_for_ref(
 	int error = 0;
 	bool unborn;
 
-	assert(analysis_out && preference_out && repo && their_heads && their_heads_len > 0);
+	GIT_ASSERT_ARG(analysis_out);
+	GIT_ASSERT_ARG(preference_out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(their_heads && their_heads_len > 0);
 
 	if (their_heads_len != 1) {
 		git_error_set(GIT_ERROR_MERGE, "can only merge a single branch");
@@ -3284,7 +3312,8 @@ int git_merge(
 	unsigned int checkout_strategy;
 	int error = 0;
 
-	assert(repo && their_heads && their_heads_len > 0);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(their_heads && their_heads_len > 0);
 
 	if (their_heads_len != 1) {
 		git_error_set(GIT_ERROR_MERGE, "can only merge a single branch");
diff --git a/src/merge_driver.c b/src/merge_driver.c
index b1f574801..17c386a14 100644
--- a/src/merge_driver.c
+++ b/src/merge_driver.c
@@ -32,33 +32,38 @@ static struct merge_driver_registry merge_driver_registry;
 
 static void git_merge_driver_global_shutdown(void);
 
-git_repository* git_merge_driver_source_repo(const git_merge_driver_source *src)
+git_repository *git_merge_driver_source_repo(
+	const git_merge_driver_source *src)
 {
-	assert(src);
+	GIT_ASSERT_ARG_WITH_RETVAL(src, NULL);
 	return src->repo;
 }
 
-const git_index_entry* git_merge_driver_source_ancestor(const git_merge_driver_source *src)
+const git_index_entry *git_merge_driver_source_ancestor(
+	const git_merge_driver_source *src)
 {
-	assert(src);
+	GIT_ASSERT_ARG_WITH_RETVAL(src, NULL);
 	return src->ancestor;
 }
 
-const git_index_entry* git_merge_driver_source_ours(const git_merge_driver_source *src)
+const git_index_entry *git_merge_driver_source_ours(
+	const git_merge_driver_source *src)
 {
-	assert(src);
+	GIT_ASSERT_ARG_WITH_RETVAL(src, NULL);
 	return src->ours;
 }
 
-const git_index_entry* git_merge_driver_source_theirs(const git_merge_driver_source *src)
+const git_index_entry *git_merge_driver_source_theirs(
+	const git_merge_driver_source *src)
 {
-	assert(src);
+	GIT_ASSERT_ARG_WITH_RETVAL(src, NULL);
 	return src->theirs;
 }
 
-const git_merge_file_options* git_merge_driver_source_file_options(const git_merge_driver_source *src)
+const git_merge_file_options *git_merge_driver_source_file_options(
+	const git_merge_driver_source *src)
 {
-	assert(src);
+	GIT_ASSERT_ARG_WITH_RETVAL(src, NULL);
 	return src->file_opts;
 }
 
@@ -262,7 +267,8 @@ int git_merge_driver_register(const char *name, git_merge_driver *driver)
 {
 	int error;
 
-	assert(name && driver);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(driver);
 
 	if (git_rwlock_wrlock(&merge_driver_registry.lock) < 0) {
 		git_error_set(GIT_ERROR_OS, "failed to lock merge driver registry");
diff --git a/src/merge_file.c b/src/merge_file.c
index 755340fa9..bfa3ec52e 100644
--- a/src/merge_file.c
+++ b/src/merge_file.c
@@ -36,7 +36,10 @@ static int merge_file_input_from_index(
 {
 	int error = 0;
 
-	assert(input_out && odb_object_out && odb && entry);
+	GIT_ASSERT_ARG(input_out);
+	GIT_ASSERT_ARG(odb_object_out);
+	GIT_ASSERT_ARG(odb);
+	GIT_ASSERT_ARG(entry);
 
 	if ((error = git_odb_read(odb_object_out, odb, &entry->id)) < 0)
 		goto done;
@@ -241,7 +244,9 @@ int git_merge_file(
 {
 	git_merge_file_input inputs[3] = { {0} };
 
-	assert(out && ours && theirs);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ours);
+	GIT_ASSERT_ARG(theirs);
 
 	memset(out, 0x0, sizeof(git_merge_file_result));
 
@@ -268,7 +273,10 @@ int git_merge_file_from_index(
 	git_odb_object *odb_object[3] = { 0 };
 	int error = 0;
 
-	assert(out && repo && ours && theirs);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(ours);
+	GIT_ASSERT_ARG(theirs);
 
 	memset(out, 0x0, sizeof(git_merge_file_result));
 
diff --git a/src/message.c b/src/message.c
index 6c5a2379f..327b984fc 100644
--- a/src/message.c
+++ b/src/message.c
@@ -28,8 +28,10 @@ int git_message_prettify(git_buf *message_out, const char *message, int strip_co
 	int consecutive_empty_lines = 0;
 	size_t i, line_length, rtrimmed_line_length;
 	char *next_newline;
+	int error;
 
-	git_buf_sanitize(message_out);
+	if ((error = git_buf_sanitize(message_out)) < 0)
+		return error;
 
 	for (i = 0; i < strlen(message); i += line_length) {
 		next_newline = memchr(message + i, '\n', message_len - i);
diff --git a/src/midx.c b/src/midx.c
index 21cfff497..00d73153d 100644
--- a/src/midx.c
+++ b/src/midx.c
@@ -181,7 +181,7 @@ int git_midx_parse(
 					 chunk_object_offsets = {0},
 					 chunk_object_large_offsets = {0};
 
-	assert(idx);
+	GIT_ASSERT_ARG(idx);
 
 	if (size < sizeof(struct git_midx_header) + 20)
 		return midx_error("multi-pack index is too short");
@@ -338,7 +338,7 @@ int git_midx_entry_find(
 	const unsigned char *object_offset;
 	off64_t offset;
 
-	assert(idx);
+	GIT_ASSERT_ARG(idx);
 
 	hi = ntohl(idx->oid_fanout[(int)short_oid->id[0]]);
 	lo = ((short_oid->id[0] == 0x0) ? 0 : ntohl(idx->oid_fanout[(int)short_oid->id[0] - 1]));
@@ -399,13 +399,16 @@ int git_midx_entry_find(
 	return 0;
 }
 
-void git_midx_close(git_midx_file *idx)
+int git_midx_close(git_midx_file *idx)
 {
-	assert(idx);
+	GIT_ASSERT_ARG(idx);
 
 	if (idx->index_map.data)
 		git_futils_mmap_free(&idx->index_map);
+
 	git_vector_free(&idx->packfile_names);
+
+	return 0;
 }
 
 void git_midx_free(git_midx_file *idx)
diff --git a/src/midx.h b/src/midx.h
index e6a64cd81..3b802952c 100644
--- a/src/midx.h
+++ b/src/midx.h
@@ -71,7 +71,7 @@ int git_midx_entry_find(
 		git_midx_file *idx,
 		const git_oid *short_oid,
 		size_t len);
-void git_midx_close(git_midx_file *idx);
+int git_midx_close(git_midx_file *idx);
 void git_midx_free(git_midx_file *idx);
 
 /* This is exposed for use in the fuzzers. */
diff --git a/src/mwindow.c b/src/mwindow.c
index a852d6bf2..66fd21823 100644
--- a/src/mwindow.c
+++ b/src/mwindow.c
@@ -52,7 +52,7 @@ int git_mwindow_global_init(void)
 {
 	int error;
 
-	assert(!git__pack_cache);
+	GIT_ASSERT(!git__pack_cache);
 
 	if ((error = git_mutex_init(&git__mwindow_mutex)) < 0 ||
 	    (error = git_strmap_new(&git__pack_cache)) < 0)
@@ -105,18 +105,18 @@ int git_mwindow_get_pack(struct git_pack_file **out, const char *path)
 	return 0;
 }
 
-void git_mwindow_put_pack(struct git_pack_file *pack)
+int git_mwindow_put_pack(struct git_pack_file *pack)
 {
-	int count;
+	int count, error;
 
-	if (git_mutex_lock(&git__mwindow_mutex) < 0)
-		return;
+	if ((error = git_mutex_lock(&git__mwindow_mutex)) < 0)
+		return error;
 
 	/* put before get would be a corrupted state */
-	assert(git__pack_cache);
+	GIT_ASSERT(git__pack_cache);
 
 	/* if we cannot find it, the state is corrupted */
-	assert(git_strmap_exists(git__pack_cache, pack->pack_name));
+	GIT_ASSERT(git_strmap_exists(git__pack_cache, pack->pack_name));
 
 	count = git_atomic_dec(&pack->refcount);
 	if (count == 0) {
@@ -125,26 +125,30 @@ void git_mwindow_put_pack(struct git_pack_file *pack)
 	}
 
 	git_mutex_unlock(&git__mwindow_mutex);
-	return;
+	return 0;
 }
 
-void git_mwindow_free_all(git_mwindow_file *mwf)
+int git_mwindow_free_all(git_mwindow_file *mwf)
 {
+	int error;
+
 	if (git_mutex_lock(&git__mwindow_mutex)) {
 		git_error_set(GIT_ERROR_THREAD, "unable to lock mwindow mutex");
-		return;
+		return -1;
 	}
 
-	git_mwindow_free_all_locked(mwf);
+	error = git_mwindow_free_all_locked(mwf);
 
 	git_mutex_unlock(&git__mwindow_mutex);
+
+	return error;
 }
 
 /*
  * Free all the windows in a sequence, typically because we're done
  * with the file
  */
-void git_mwindow_free_all_locked(git_mwindow_file *mwf)
+int git_mwindow_free_all_locked(git_mwindow_file *mwf)
 {
 	git_mwindow_ctl *ctl = &git_mwindow__mem_ctl;
 	size_t i;
@@ -166,7 +170,7 @@ void git_mwindow_free_all_locked(git_mwindow_file *mwf)
 
 	while (mwf->windows) {
 		git_mwindow *w = mwf->windows;
-		assert(w->inuse_cnt == 0);
+		GIT_ASSERT(w->inuse_cnt == 0);
 
 		ctl->mapped -= w->window_map.len;
 		ctl->open_windows--;
@@ -176,6 +180,8 @@ void git_mwindow_free_all_locked(git_mwindow_file *mwf)
 		mwf->windows = w->next;
 		git__free(w);
 	}
+
+	return 0;
 }
 
 /*
@@ -210,8 +216,8 @@ static bool git_mwindow_scan_recently_used(
 	git_mwindow *lru_window = NULL, *lru_last = NULL;
 	bool found = false;
 
-	assert(mwf);
-	assert(out_window);
+	GIT_ASSERT_ARG(mwf);
+	GIT_ASSERT_ARG(out_window);
 
 	lru_window = *out_window;
 	if (out_last)
diff --git a/src/mwindow.h b/src/mwindow.h
index 7519fc36d..b379fba2d 100644
--- a/src/mwindow.h
+++ b/src/mwindow.h
@@ -40,8 +40,8 @@ typedef struct git_mwindow_ctl {
 } git_mwindow_ctl;
 
 int git_mwindow_contains(git_mwindow *win, off64_t offset);
-void git_mwindow_free_all(git_mwindow_file *mwf); /* locks */
-void git_mwindow_free_all_locked(git_mwindow_file *mwf); /* run under lock */
+int git_mwindow_free_all(git_mwindow_file *mwf); /* locks */
+int git_mwindow_free_all_locked(git_mwindow_file *mwf); /* run under lock */
 unsigned char *git_mwindow_open(git_mwindow_file *mwf, git_mwindow **cursor, off64_t offset, size_t extra, unsigned int *left);
 int git_mwindow_file_register(git_mwindow_file *mwf);
 void git_mwindow_file_deregister(git_mwindow_file *mwf);
@@ -51,6 +51,6 @@ extern int git_mwindow_global_init(void);
 
 struct git_pack_file; /* just declaration to avoid cyclical includes */
 int git_mwindow_get_pack(struct git_pack_file **out, const char *path);
-void git_mwindow_put_pack(struct git_pack_file *pack);
+int git_mwindow_put_pack(struct git_pack_file *pack);
 
 #endif
diff --git a/src/net.c b/src/net.c
index ac1bc4299..0705dd390 100644
--- a/src/net.c
+++ b/src/net.c
@@ -281,7 +281,8 @@ int git_net_url_apply_redirect(
 	git_net_url tmp = GIT_NET_URL_INIT;
 	int error = 0;
 
-	assert(url && redirect_location);
+	GIT_ASSERT(url);
+	GIT_ASSERT(redirect_location);
 
 	if (redirect_location[0] == '/') {
 		git__free(url->path);
diff --git a/src/netops.c b/src/netops.c
index 1ef230293..a1ee2927c 100644
--- a/src/netops.c
+++ b/src/netops.c
@@ -61,18 +61,20 @@ void gitno_buffer_setup_fromstream(git_stream *st, gitno_buffer *buf, char *data
 }
 
 /* Consume up to ptr and move the rest of the buffer to the beginning */
-void gitno_consume(gitno_buffer *buf, const char *ptr)
+int gitno_consume(gitno_buffer *buf, const char *ptr)
 {
 	size_t consumed;
 
-	assert(ptr - buf->data >= 0);
-	assert(ptr - buf->data <= (int) buf->len);
+	GIT_ASSERT(ptr - buf->data >= 0);
+	GIT_ASSERT(ptr - buf->data <= (int) buf->len);
 
 	consumed = ptr - buf->data;
 
 	memmove(buf->data, ptr, buf->offset - consumed);
 	memset(buf->data + buf->offset, 0x0, buf->len - buf->offset);
 	buf->offset -= consumed;
+
+	return 0;
 }
 
 /* Consume const bytes and move the rest of the buffer to the beginning */
diff --git a/src/netops.h b/src/netops.h
index 52f1cccb6..771c87b64 100644
--- a/src/netops.h
+++ b/src/netops.h
@@ -62,7 +62,7 @@ void gitno_buffer_setup_fromstream(git_stream *st, gitno_buffer *buf, char *data
 void gitno_buffer_setup_callback(gitno_buffer *buf, char *data, size_t len, int (*recv)(gitno_buffer *buf), void *cb_data);
 int gitno_recv(gitno_buffer *buf);
 
-void gitno_consume(gitno_buffer *buf, const char *ptr);
+int gitno_consume(gitno_buffer *buf, const char *ptr);
 void gitno_consume_n(gitno_buffer *buf, size_t cons);
 
 #endif
diff --git a/src/notes.c b/src/notes.c
index 68d2ae9ec..b9e198599 100644
--- a/src/notes.c
+++ b/src/notes.c
@@ -627,11 +627,11 @@ int git_note_default_ref(git_buf *out, git_repository *repo)
 	char *default_ref;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
-	git_buf_sanitize(out);
-
-	if ((error = note_get_default_ref(&default_ref, repo)) < 0)
+	if ((error = git_buf_sanitize(out)) < 0 ||
+	    (error = note_get_default_ref(&default_ref, repo)) < 0)
 		return error;
 
 	git_buf_attach(out, default_ref, strlen(default_ref));
@@ -640,25 +640,25 @@ int git_note_default_ref(git_buf *out, git_repository *repo)
 
 const git_signature *git_note_committer(const git_note *note)
 {
-	assert(note);
+	GIT_ASSERT_ARG_WITH_RETVAL(note, NULL);
 	return note->committer;
 }
 
 const git_signature *git_note_author(const git_note *note)
 {
-	assert(note);
+	GIT_ASSERT_ARG_WITH_RETVAL(note, NULL);
 	return note->author;
 }
 
-const char * git_note_message(const git_note *note)
+const char *git_note_message(const git_note *note)
 {
-	assert(note);
+	GIT_ASSERT_ARG_WITH_RETVAL(note, NULL);
 	return note->message;
 }
 
-const git_oid * git_note_id(const git_note *note)
+const git_oid *git_note_id(const git_note *note)
 {
-	assert(note);
+	GIT_ASSERT_ARG_WITH_RETVAL(note, NULL);
 	return &note->id;
 }
 
diff --git a/src/object.c b/src/object.c
index 749b0caf2..42e1e46bc 100644
--- a/src/object.c
+++ b/src/object.c
@@ -67,7 +67,7 @@ int git_object__from_raw(
 	size_t object_size;
 	int error;
 
-	assert(object_out);
+	GIT_ASSERT_ARG(object_out);
 	*object_out = NULL;
 
 	/* Validate type match */
@@ -91,7 +91,7 @@ int git_object__from_raw(
 
 	/* Parse raw object data */
 	def = &git_objects_table[type];
-	assert(def->free && def->parse_raw);
+	GIT_ASSERT(def->free && def->parse_raw);
 
 	if ((error = def->parse_raw(object, data, size)) < 0) {
 		def->free(object);
@@ -115,7 +115,7 @@ int git_object__from_odb_object(
 	git_object_def *def;
 	git_object *object = NULL;
 
-	assert(object_out);
+	GIT_ASSERT_ARG(object_out);
 	*object_out = NULL;
 
 	/* Validate type match */
@@ -141,7 +141,7 @@ int git_object__from_odb_object(
 
 	/* Parse raw object data */
 	def = &git_objects_table[odb_obj->cached.type];
-	assert(def->free && def->parse);
+	GIT_ASSERT(def->free && def->parse);
 
 	if ((error = def->parse(object, odb_obj)) < 0)
 		def->free(object);
@@ -174,7 +174,9 @@ int git_object_lookup_prefix(
 	git_odb_object *odb_obj = NULL;
 	int error = 0;
 
-	assert(repo && object_out && id);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(object_out);
+	GIT_ASSERT_ARG(id);
 
 	if (len < GIT_OID_MINPREFIXLEN) {
 		git_error_set(GIT_ERROR_OBJECT, "ambiguous lookup - OID prefix is too short");
@@ -211,7 +213,7 @@ int git_object_lookup_prefix(
 			} else if (cached->flags == GIT_CACHE_STORE_RAW) {
 				odb_obj = (git_odb_object *)cached;
 			} else {
-				assert(!"Wrong caching type in the global object cache");
+				GIT_ASSERT(!"Wrong caching type in the global object cache");
 			}
 		} else {
 			/* Object was not found in the cache, let's explore the backends.
@@ -263,19 +265,19 @@ void git_object_free(git_object *object)
 
 const git_oid *git_object_id(const git_object *obj)
 {
-	assert(obj);
+	GIT_ASSERT_ARG_WITH_RETVAL(obj, NULL);
 	return &obj->cached.oid;
 }
 
 git_object_t git_object_type(const git_object *obj)
 {
-	assert(obj);
+	GIT_ASSERT_ARG_WITH_RETVAL(obj, GIT_OBJECT_INVALID);
 	return obj->cached.type;
 }
 
 git_repository *git_object_owner(const git_object *obj)
 {
-	assert(obj);
+	GIT_ASSERT_ARG_WITH_RETVAL(obj, NULL);
 	return obj->repo;
 }
 
@@ -396,9 +398,10 @@ int git_object_peel(
 	git_object *source, *deref = NULL;
 	int error;
 
-	assert(object && peeled);
+	GIT_ASSERT_ARG(object);
+	GIT_ASSERT_ARG(peeled);
 
-	assert(target_type == GIT_OBJECT_TAG ||
+	GIT_ASSERT_ARG(target_type == GIT_OBJECT_TAG ||
 		target_type == GIT_OBJECT_COMMIT ||
 		target_type == GIT_OBJECT_TREE ||
 		target_type == GIT_OBJECT_BLOB ||
@@ -461,7 +464,9 @@ int git_object_lookup_bypath(
 	git_tree *tree = NULL;
 	git_tree_entry *entry = NULL;
 
-	assert(out && treeish && path);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(treeish);
+	GIT_ASSERT_ARG(path);
 
 	if ((error = git_object_peel((git_object**)&tree, treeish, GIT_OBJECT_TREE)) < 0 ||
 		 (error = git_tree_entry_bypath(&entry, tree, path)) < 0)
@@ -493,9 +498,12 @@ int git_object_short_id(git_buf *out, const git_object *obj)
 	git_oid id = {{0}};
 	git_odb *odb;
 
-	assert(out && obj);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(obj);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
-	git_buf_sanitize(out);
 	repo = git_object_owner(obj);
 
 	if ((error = git_repository__configmap_lookup(&len, repo, GIT_CONFIGMAP_ABBREV)) < 0)
diff --git a/src/odb.c b/src/odb.c
index 129a63255..1e608f5d8 100644
--- a/src/odb.c
+++ b/src/odb.c
@@ -114,7 +114,8 @@ int git_odb__hashobj(git_oid *id, git_rawobj *obj)
 	size_t hdrlen;
 	int error;
 
-	assert(id && obj);
+	GIT_ASSERT_ARG(id);
+	GIT_ASSERT_ARG(obj);
 
 	if (!git_object_typeisloose(obj->type)) {
 		git_error_set(GIT_ERROR_INVALID, "invalid object type");
@@ -346,7 +347,7 @@ int git_odb_hash(git_oid *id, const void *data, size_t len, git_object_t type)
 {
 	git_rawobj raw;
 
-	assert(id);
+	GIT_ASSERT_ARG(id);
 
 	raw.data = (void *)data;
 	raw.len = len;
@@ -376,7 +377,7 @@ static int fake_wstream__write(git_odb_stream *_stream, const char *data, size_t
 {
 	fake_wstream *stream = (fake_wstream *)_stream;
 
-	assert(stream->written + len <= stream->size);
+	GIT_ASSERT(stream->written + len <= stream->size);
 
 	memcpy(stream->buffer + stream->written, data, len);
 	stream->written += len;
@@ -470,12 +471,13 @@ static int add_backend_internal(
 {
 	backend_internal *internal;
 
-	assert(odb && backend);
+	GIT_ASSERT_ARG(odb);
+	GIT_ASSERT_ARG(backend);
 
 	GIT_ERROR_CHECK_VERSION(backend, GIT_ODB_BACKEND_VERSION, "git_odb_backend");
 
 	/* Check if the backend is already owned by another ODB */
-	assert(!backend->odb || backend->odb == odb);
+	GIT_ASSERT(!backend->odb || backend->odb == odb);
 
 	internal = git__malloc(sizeof(backend_internal));
 	GIT_ERROR_CHECK_ALLOC(internal);
@@ -507,7 +509,7 @@ int git_odb_add_alternate(git_odb *odb, git_odb_backend *backend, int priority)
 
 size_t git_odb_num_backends(git_odb *odb)
 {
-	assert(odb);
+	GIT_ASSERT_ARG(odb);
 	return odb->backends.length;
 }
 
@@ -523,7 +525,9 @@ int git_odb_get_backend(git_odb_backend **out, git_odb *odb, size_t pos)
 {
 	backend_internal *internal;
 
-	assert(out && odb);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(odb);
+
 	internal = git_vector_get(&odb->backends, pos);
 
 	if (internal && internal->backend) {
@@ -645,7 +649,8 @@ int git_odb_open(git_odb **out, const char *objects_dir)
 {
 	git_odb *db;
 
-	assert(out && objects_dir);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(objects_dir);
 
 	*out = NULL;
 
@@ -755,7 +760,8 @@ static int odb_freshen_1(
 
 int git_odb__freshen(git_odb *db, const git_oid *id)
 {
-	assert(db && id);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(id);
 
 	if (odb_freshen_1(db, id, false))
 		return 1;
@@ -771,7 +777,8 @@ int git_odb_exists(git_odb *db, const git_oid *id)
 {
 	git_odb_object *object;
 
-	assert(db && id);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(id);
 
 	if (git_oid_is_zero(id))
 		return 0;
@@ -839,7 +846,8 @@ int git_odb_exists_prefix(
 	int error;
 	git_oid key = {{0}};
 
-	assert(db && short_id);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(short_id);
 
 	if (len < GIT_OID_MINPREFIXLEN)
 		return git_odb__error_ambiguous("prefix length too short");
@@ -875,7 +883,8 @@ int git_odb_expand_ids(
 {
 	size_t i;
 
-	assert(db && ids);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(ids);
 
 	for (i = 0; i < count; i++) {
 		git_odb_expand_id *query = &ids[i];
@@ -997,7 +1006,11 @@ int git_odb__read_header_or_object(
 	int error = GIT_ENOTFOUND;
 	git_odb_object *object;
 
-	assert(db && id && out && len_p && type_p);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(id);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(len_p);
+	GIT_ASSERT_ARG(type_p);
 
 	*out = NULL;
 
@@ -1104,7 +1117,9 @@ int git_odb_read(git_odb_object **out, git_odb *db, const git_oid *id)
 {
 	int error;
 
-	assert(out && db && id);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(id);
 
 	if (git_oid_is_zero(id))
 		return error_null_oid(GIT_ENOTFOUND, "cannot read object");
@@ -1237,7 +1252,8 @@ int git_odb_read_prefix(
 	git_oid key = {{0}};
 	int error;
 
-	assert(out && db);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(db);
 
 	if (len < GIT_OID_MINPREFIXLEN)
 		return git_odb__error_ambiguous("prefix length too short");
@@ -1286,7 +1302,8 @@ int git_odb_write(
 	int error;
 	git_odb_stream *stream;
 
-	assert(oid && db);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(db);
 
 	if ((error = git_odb_hash(oid, data, len, type)) < 0)
 		return error;
@@ -1346,7 +1363,8 @@ int git_odb_open_wstream(
 	int error = GIT_ERROR;
 	git_hash_ctx *ctx = NULL;
 
-	assert(stream && db);
+	GIT_ASSERT_ARG(stream);
+	GIT_ASSERT_ARG(db);
 
 	for (i = 0; i < db->backends.length && error < 0; ++i) {
 		backend_internal *internal = git_vector_get(&db->backends, i);
@@ -1456,7 +1474,8 @@ int git_odb_open_rstream(
 	size_t i, reads = 0;
 	int error = GIT_ERROR;
 
-	assert(stream && db);
+	GIT_ASSERT_ARG(stream);
+	GIT_ASSERT_ARG(db);
 
 	for (i = 0; i < db->backends.length && error < 0; ++i) {
 		backend_internal *internal = git_vector_get(&db->backends, i);
@@ -1481,7 +1500,8 @@ int git_odb_write_pack(struct git_odb_writepack **out, git_odb *db, git_indexer_
 	size_t i, writes = 0;
 	int error = GIT_ERROR;
 
-	assert(out && db);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(db);
 
 	for (i = 0; i < db->backends.length && error < 0; ++i) {
 		backend_internal *internal = git_vector_get(&db->backends, i);
@@ -1527,7 +1547,8 @@ void git_odb_backend_data_free(git_odb_backend *backend, void *data)
 int git_odb_refresh(struct git_odb *db)
 {
 	size_t i;
-	assert(db);
+
+	GIT_ASSERT_ARG(db);
 
 	for (i = 0; i < db->backends.length; ++i) {
 		backend_internal *internal = git_vector_get(&db->backends, i);
diff --git a/src/odb_loose.c b/src/odb_loose.c
index 68287795a..b0abbbf4c 100644
--- a/src/odb_loose.c
+++ b/src/odb_loose.c
@@ -309,7 +309,7 @@ static int read_loose_standard(git_rawobj *out, git_buf *obj)
 		goto done;
 	}
 
-	assert(decompressed >= head_len);
+	GIT_ASSERT(decompressed >= head_len);
 	body_len = decompressed - head_len;
 
 	if (body_len)
@@ -344,7 +344,8 @@ static int read_loose(git_rawobj *out, git_buf *loc)
 	int error;
 	git_buf obj = GIT_BUF_INIT;
 
-	assert(out && loc);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(loc);
 
 	if (git_buf_oom(loc))
 		return -1;
@@ -411,7 +412,8 @@ static int read_header_loose(git_rawobj *out, git_buf *loc)
 	ssize_t obj_len;
 	int fd, error;
 
-	assert(out && loc);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(loc);
 
 	if (git_buf_oom(loc))
 		return -1;
@@ -585,7 +587,8 @@ static int loose_backend__read_header(size_t *len_p, git_object_t *type_p, git_o
 	git_rawobj raw;
 	int error;
 
-	assert(backend && oid);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(oid);
 
 	raw.len = 0;
 	raw.type = GIT_OBJECT_INVALID;
@@ -609,7 +612,8 @@ static int loose_backend__read(void **buffer_p, size_t *len_p, git_object_t *typ
 	git_rawobj raw;
 	int error = 0;
 
-	assert(backend && oid);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(oid);
 
 	if (locate_object(&object_path, (loose_backend *)backend, oid) < 0) {
 		error = git_odb__error_notfound("no matching loose object",
@@ -636,7 +640,7 @@ static int loose_backend__read_prefix(
 {
 	int error = 0;
 
-	assert(len >= GIT_OID_MINPREFIXLEN && len <= GIT_OID_HEXSZ);
+	GIT_ASSERT_ARG(len >= GIT_OID_MINPREFIXLEN && len <= GIT_OID_HEXSZ);
 
 	if (len == GIT_OID_HEXSZ) {
 		/* We can fall back to regular read method */
@@ -647,7 +651,7 @@ static int loose_backend__read_prefix(
 		git_buf object_path = GIT_BUF_INIT;
 		git_rawobj raw;
 
-		assert(backend && short_oid);
+		GIT_ASSERT_ARG(backend && short_oid);
 
 		if ((error = locate_object_short_oid(&object_path, out_oid,
 				(loose_backend *)backend, short_oid, len)) == 0 &&
@@ -669,7 +673,8 @@ static int loose_backend__exists(git_odb_backend *backend, const git_oid *oid)
 	git_buf object_path = GIT_BUF_INIT;
 	int error;
 
-	assert(backend && oid);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(oid);
 
 	error = locate_object(&object_path, (loose_backend *)backend, oid);
 
@@ -684,7 +689,10 @@ static int loose_backend__exists_prefix(
 	git_buf object_path = GIT_BUF_INIT;
 	int error;
 
-	assert(backend && out && short_id && len >= GIT_OID_MINPREFIXLEN);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(short_id);
+	GIT_ASSERT_ARG(len >= GIT_OID_MINPREFIXLEN);
 
 	error = locate_object_short_oid(
 		&object_path, out, (loose_backend *)backend, short_id, len);
@@ -759,7 +767,8 @@ static int loose_backend__foreach(git_odb_backend *_backend, git_odb_foreach_cb
 	struct foreach_state state;
 	loose_backend *backend = (loose_backend *) _backend;
 
-	assert(backend && cb);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(cb);
 
 	objects_dir = backend->objects_dir;
 
@@ -833,7 +842,7 @@ static int loose_backend__writestream(git_odb_stream **stream_out, git_odb_backe
 	size_t hdrlen;
 	int error;
 
-	assert(_backend);
+	GIT_ASSERT_ARG(_backend);
 
 	backend = (loose_backend *)_backend;
 	*stream_out = NULL;
@@ -991,7 +1000,11 @@ static int loose_backend__readstream(
 	obj_hdr hdr;
 	int error = 0;
 
-	assert(stream_out && len_out && type_out && _backend && oid);
+	GIT_ASSERT_ARG(stream_out);
+	GIT_ASSERT_ARG(len_out);
+	GIT_ASSERT_ARG(type_out);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(oid);
 
 	backend = (loose_backend *)_backend;
 	*stream_out = NULL;
@@ -1108,11 +1121,7 @@ static int loose_backend__freshen(
 
 static void loose_backend__free(git_odb_backend *_backend)
 {
-	loose_backend *backend;
-	assert(_backend);
-	backend = (loose_backend *)_backend;
-
-	git__free(backend);
+	git__free(_backend);
 }
 
 int git_odb_backend_loose(
@@ -1126,7 +1135,8 @@ int git_odb_backend_loose(
 	loose_backend *backend;
 	size_t objects_dirlen, alloclen;
 
-	assert(backend_out && objects_dir);
+	GIT_ASSERT_ARG(backend_out);
+	GIT_ASSERT_ARG(objects_dir);
 
 	objects_dirlen = strlen(objects_dir);
 
diff --git a/src/odb_mempack.c b/src/odb_mempack.c
index 6d20b39ba..d08356a8d 100644
--- a/src/odb_mempack.c
+++ b/src/odb_mempack.c
@@ -156,7 +156,7 @@ int git_mempack_new(git_odb_backend **out)
 {
 	struct memory_packer_db *db;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	db = git__calloc(1, sizeof(struct memory_packer_db));
 	GIT_ERROR_CHECK_ALLOC(db);
diff --git a/src/odb_pack.c b/src/odb_pack.c
index 86c858df1..e4ad0f4b7 100644
--- a/src/odb_pack.c
+++ b/src/odb_pack.c
@@ -358,7 +358,10 @@ static int pack_backend__read_header(
 	struct git_pack_entry e;
 	int error;
 
-	assert(len_p && type_p && backend && oid);
+	GIT_ASSERT_ARG(len_p);
+	GIT_ASSERT_ARG(type_p);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(oid);
 
 	if ((error = pack_entry_find(&e, (struct pack_backend *)backend, oid)) < 0)
 		return error;
@@ -469,7 +472,9 @@ static int pack_backend__foreach(git_odb_backend *_backend, git_odb_foreach_cb c
 	struct pack_backend *backend;
 	unsigned int i;
 
-	assert(_backend && cb);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(cb);
+
 	backend = (struct pack_backend *)_backend;
 
 	/* Make sure we know about the packfiles */
@@ -488,7 +493,7 @@ static int pack_backend__writepack_append(struct git_odb_writepack *_writepack,
 {
 	struct pack_writepack *writepack = (struct pack_writepack *)_writepack;
 
-	assert(writepack);
+	GIT_ASSERT_ARG(writepack);
 
 	return git_indexer_append(writepack->indexer, data, size, stats);
 }
@@ -497,16 +502,19 @@ static int pack_backend__writepack_commit(struct git_odb_writepack *_writepack,
 {
 	struct pack_writepack *writepack = (struct pack_writepack *)_writepack;
 
-	assert(writepack);
+	GIT_ASSERT_ARG(writepack);
 
 	return git_indexer_commit(writepack->indexer, stats);
 }
 
 static void pack_backend__writepack_free(struct git_odb_writepack *_writepack)
 {
-	struct pack_writepack *writepack = (struct pack_writepack *)_writepack;
+	struct pack_writepack *writepack;
+
+	if (!_writepack)
+		return;
 
-	assert(writepack);
+	writepack = (struct pack_writepack *)_writepack;
 
 	git_indexer_free(writepack->indexer);
 	git__free(writepack);
@@ -522,7 +530,8 @@ static int pack_backend__writepack(struct git_odb_writepack **out,
 	struct pack_backend *backend;
 	struct pack_writepack *writepack;
 
-	assert(out && _backend);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(_backend);
 
 	*out = NULL;
 
@@ -555,7 +564,8 @@ static void pack_backend__free(git_odb_backend *_backend)
 	struct pack_backend *backend;
 	size_t i;
 
-	assert(_backend);
+	if (!_backend)
+		return;
 
 	backend = (struct pack_backend *)_backend;
 
diff --git a/src/oid.c b/src/oid.c
index a8ad3d2ee..893e2fc0f 100644
--- a/src/oid.c
+++ b/src/oid.c
@@ -26,7 +26,8 @@ int git_oid_fromstrn(git_oid *out, const char *str, size_t length)
 	size_t p;
 	int v;
 
-	assert(out && str);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(str);
 
 	if (!length)
 		return oid_error_invalid("too short");
@@ -316,7 +317,7 @@ git_oid_shorten *git_oid_shorten_new(size_t min_length)
 {
 	git_oid_shorten *os;
 
-	assert((size_t)((int)min_length) == min_length);
+	GIT_ASSERT_ARG_WITH_RETVAL((size_t)((int)min_length) == min_length, NULL);
 
 	os = git__calloc(1, sizeof(git_oid_shorten));
 	if (os == NULL)
diff --git a/src/pack-objects.c b/src/pack-objects.c
index cf10e6cb5..8ebb8cf43 100644
--- a/src/pack-objects.c
+++ b/src/pack-objects.c
@@ -48,18 +48,10 @@ struct walk_object {
 };
 
 #ifdef GIT_THREADS
-
-#define GIT_PACKBUILDER__MUTEX_OP(pb, mtx, op) do { \
-		int result = git_mutex_##op(&(pb)->mtx); \
-		assert(!result); \
-		GIT_UNUSED(result); \
-	} while (0)
-
+# define GIT_PACKBUILDER__MUTEX_OP(pb, mtx, op) git_mutex_##op(&(pb)->mtx)
 #else
-
-#define GIT_PACKBUILDER__MUTEX_OP(pb,mtx,op) GIT_UNUSED(pb)
-
-#endif /* GIT_THREADS */
+# define GIT_PACKBUILDER__MUTEX_OP(pb, mtx, op) GIT_UNUSED(pb)
+#endif
 
 #define git_packbuilder__cache_lock(pb) GIT_PACKBUILDER__MUTEX_OP(pb, cache_mutex, lock)
 #define git_packbuilder__cache_unlock(pb) GIT_PACKBUILDER__MUTEX_OP(pb, cache_mutex, unlock)
@@ -177,13 +169,13 @@ on_error:
 
 unsigned int git_packbuilder_set_threads(git_packbuilder *pb, unsigned int n)
 {
-	assert(pb);
+	GIT_ASSERT_ARG(pb);
 
 #ifdef GIT_THREADS
 	pb->nr_threads = n;
 #else
 	GIT_UNUSED(n);
-	assert(1 == pb->nr_threads);
+	GIT_ASSERT(pb->nr_threads == 1);
 #endif
 
 	return pb->nr_threads;
@@ -211,7 +203,8 @@ int git_packbuilder_insert(git_packbuilder *pb, const git_oid *oid,
 	size_t newsize;
 	int ret;
 
-	assert(pb && oid);
+	GIT_ASSERT_ARG(pb);
+	GIT_ASSERT_ARG(oid);
 
 	/* If the object already exists in the hash table, then we don't
 	 * have any work to do */
@@ -347,10 +340,9 @@ static int write_object(
 	}
 
 	/* Write header */
-	hdr_len = git_packfile__object_header(hdr, data_len, type);
-
-	if ((error = write_cb(hdr, hdr_len, cb_data)) < 0 ||
-		(error = git_hash_update(&pb->ctx, hdr, hdr_len)) < 0)
+	if ((error = git_packfile__object_header(&hdr_len, hdr, data_len, type)) < 0 ||
+	    (error = write_cb(hdr, hdr_len, cb_data)) < 0 ||
+	    (error = git_hash_update(&pb->ctx, hdr, hdr_len)) < 0)
 		goto done;
 
 	if (type == GIT_OBJECT_REF_DELTA) {
@@ -852,10 +844,11 @@ static int try_delta(git_packbuilder *pb, struct unpacked *trg,
 		}
 	}
 
-	git_packbuilder__cache_lock(pb);
+	GIT_ASSERT(git_packbuilder__cache_lock(pb) == 0);
+
 	if (trg_object->delta_data) {
 		git__free(trg_object->delta_data);
-		assert(pb->delta_cache_size >= trg_object->delta_size);
+		GIT_ASSERT(pb->delta_cache_size >= trg_object->delta_size);
 		pb->delta_cache_size -= trg_object->delta_size;
 		trg_object->delta_data = NULL;
 	}
@@ -863,7 +856,7 @@ static int try_delta(git_packbuilder *pb, struct unpacked *trg,
 		bool overflow = git__add_sizet_overflow(
 			&pb->delta_cache_size, pb->delta_cache_size, delta_size);
 
-		git_packbuilder__cache_unlock(pb);
+		GIT_ASSERT(git_packbuilder__cache_unlock(pb) == 0);
 
 		if (overflow) {
 			git__free(delta_buf);
@@ -874,7 +867,7 @@ static int try_delta(git_packbuilder *pb, struct unpacked *trg,
 		GIT_ERROR_CHECK_ALLOC(trg_object->delta_data);
 	} else {
 		/* create delta when writing the pack */
-		git_packbuilder__cache_unlock(pb);
+		GIT_ASSERT(git_packbuilder__cache_unlock(pb) == 0);
 		git__free(delta_buf);
 	}
 
@@ -962,9 +955,9 @@ static int find_deltas(git_packbuilder *pb, git_pobject **list,
 		struct unpacked *n = array + idx;
 		size_t max_depth, j, best_base = SIZE_MAX;
 
-		git_packbuilder__progress_lock(pb);
+		GIT_ASSERT(git_packbuilder__progress_lock(pb) == 0);
 		if (!*list_size) {
-			git_packbuilder__progress_unlock(pb);
+			GIT_ASSERT(git_packbuilder__progress_unlock(pb) == 0);
 			break;
 		}
 
@@ -973,7 +966,7 @@ static int find_deltas(git_packbuilder *pb, git_pobject **list,
 
 		po = *list++;
 		(*list_size)--;
-		git_packbuilder__progress_unlock(pb);
+		GIT_ASSERT(git_packbuilder__progress_unlock(pb) == 0);
 
 		mem_usage -= free_unpacked(n);
 		n->object = po;
@@ -1048,10 +1041,10 @@ static int find_deltas(git_packbuilder *pb, git_pobject **list,
 			po->z_delta_size = zbuf.size;
 			git_buf_clear(&zbuf);
 
-			git_packbuilder__cache_lock(pb);
+			GIT_ASSERT(git_packbuilder__cache_lock(pb) == 0);
 			pb->delta_cache_size -= po->delta_size;
 			pb->delta_cache_size += po->z_delta_size;
-			git_packbuilder__cache_unlock(pb);
+			GIT_ASSERT(git_packbuilder__cache_unlock(pb) == 0);
 		}
 
 		/*
@@ -1129,10 +1122,10 @@ static void *threaded_find_deltas(void *arg)
 			; /* TODO */
 		}
 
-		git_packbuilder__progress_lock(me->pb);
+		GIT_ASSERT_WITH_RETVAL(git_packbuilder__progress_lock(me->pb) == 0, NULL);
 		me->working = 0;
 		git_cond_signal(&me->pb->progress_cond);
-		git_packbuilder__progress_unlock(me->pb);
+		GIT_ASSERT_WITH_RETVAL(git_packbuilder__progress_unlock(me->pb) == 0, NULL);
 
 		if (git_mutex_lock(&me->mutex)) {
 			git_error_set(GIT_ERROR_THREAD, "unable to lock packfile condition mutex");
@@ -1237,7 +1230,7 @@ static int ll_find_deltas(git_packbuilder *pb, git_pobject **list,
 		 * 'working' flag from 1 -> 0. This indicates that it is
 		 * ready to receive more work using our work-stealing
 		 * algorithm. */
-		git_packbuilder__progress_lock(pb);
+		GIT_ASSERT(git_packbuilder__progress_lock(pb) == 0);
 		for (;;) {
 			for (i = 0; !target && i < pb->nr_threads; i++)
 				if (!p[i].working)
@@ -1280,7 +1273,7 @@ static int ll_find_deltas(git_packbuilder *pb, git_pobject **list,
 		target->list_size = sub_size;
 		target->remaining = sub_size;
 		target->working = 1;
-		git_packbuilder__progress_unlock(pb);
+		GIT_ASSERT(git_packbuilder__progress_unlock(pb) == 0);
 
 		if (git_mutex_lock(&target->mutex)) {
 			git_error_set(GIT_ERROR_THREAD, "unable to lock packfile condition mutex");
@@ -1363,8 +1356,13 @@ int git_packbuilder_foreach(git_packbuilder *pb, int (*cb)(void *buf, size_t siz
 
 int git_packbuilder_write_buf(git_buf *buf, git_packbuilder *pb)
 {
+	int error;
+
+	if ((error = git_buf_sanitize(buf)) < 0)
+		return error;
+
 	PREPARE_PACK;
-	git_buf_sanitize(buf);
+
 	return write_pack(pb, &write_pack_buf, buf);
 }
 
@@ -1486,7 +1484,8 @@ int git_packbuilder_insert_recur(git_packbuilder *pb, const git_oid *id, const c
 	git_object *obj;
 	int error;
 
-	assert(pb && id);
+	GIT_ASSERT_ARG(pb);
+	GIT_ASSERT_ARG(id);
 
 	if ((error = git_object_lookup(&obj, pb->repo, id, GIT_OBJECT_ANY)) < 0)
 		return error;
@@ -1727,7 +1726,8 @@ int git_packbuilder_insert_walk(git_packbuilder *pb, git_revwalk *walk)
 	git_oid id;
 	struct walk_object *obj;
 
-	assert(pb && walk);
+	GIT_ASSERT_ARG(pb);
+	GIT_ASSERT_ARG(walk);
 
 	if ((error = mark_edges_uninteresting(pb, walk->user_input)) < 0)
 		return error;
diff --git a/src/pack.c b/src/pack.c
index 1b5cf670f..982ad1770 100644
--- a/src/pack.c
+++ b/src/pack.c
@@ -67,7 +67,6 @@ static void free_cache_object(void *o)
 	git_pack_cache_entry *e = (git_pack_cache_entry *)o;
 
 	if (e != NULL) {
-		assert(e->refcount.val == 0);
 		git__free(e->raw.data);
 		git__free(e);
 	}
@@ -311,8 +310,9 @@ static int pack_index_open(struct git_pack_file *p)
 	if (p->index_version > -1)
 		return 0;
 
+	/* checked by git_pack_file alloc */
 	name_len = strlen(p->pack_name);
-	assert(name_len > strlen(".pack")); /* checked by git_pack_file alloc */
+	GIT_ASSERT(name_len > strlen(".pack"));
 
 	if (git_buf_init(&idx_name, name_len) < 0)
 		return -1;
@@ -372,12 +372,12 @@ static unsigned char *pack_window_open(
  *  - each byte afterwards: low seven bits are size continuation,
  *    with the high bit being "size continues"
  */
-size_t git_packfile__object_header(unsigned char *hdr, size_t size, git_object_t type)
+int git_packfile__object_header(size_t *out, unsigned char *hdr, size_t size, git_object_t type)
 {
 	unsigned char *hdr_base;
 	unsigned char c;
 
-	assert(type >= GIT_OBJECT_COMMIT && type <= GIT_OBJECT_REF_DELTA);
+	GIT_ASSERT_ARG(type >= GIT_OBJECT_COMMIT && type <= GIT_OBJECT_REF_DELTA);
 
 	/* TODO: add support for chunked objects; see git.git 6c0d19b1 */
 
@@ -392,7 +392,8 @@ size_t git_packfile__object_header(unsigned char *hdr, size_t size, git_object_t
 	}
 	*hdr++ = c;
 
-	return (hdr - hdr_base);
+	*out = (hdr - hdr_base);
+	return 0;
 }
 
 
@@ -899,7 +900,7 @@ int get_delta_base(
 	off64_t base_offset;
 	git_oid unused;
 
-	assert(delta_base_out);
+	GIT_ASSERT_ARG(delta_base_out);
 
 	base_info = pack_window_open(p, w_curs, *curpos, &left);
 	/* Assumption: the only reason this would fail is because the file is too small */
@@ -1211,8 +1212,7 @@ int git_pack_foreach_entry(
 		if ((error = pack_index_open(p)) < 0)
 			return error;
 
-		assert(p->index_map.data);
-
+		GIT_ASSERT(p->index_map.data);
 		index = p->index_map.data;
 	}
 
@@ -1299,7 +1299,8 @@ static int pack_entry_find_offset(
 
 		if ((error = pack_index_open(p)) < 0)
 			return error;
-		assert(p->index_map.data);
+
+		GIT_ASSERT(p->index_map.data);
 	}
 
 	index = p->index_map.data;
@@ -1388,7 +1389,7 @@ int git_pack_entry_find(
 	git_oid found_oid;
 	int error;
 
-	assert(p);
+	GIT_ASSERT_ARG(p);
 
 	if (len == GIT_OID_HEXSZ && p->num_bad_objects) {
 		unsigned i;
diff --git a/src/pack.h b/src/pack.h
index cebfcd1bd..544a5d286 100644
--- a/src/pack.h
+++ b/src/pack.h
@@ -133,7 +133,7 @@ typedef struct git_packfile_stream {
 	git_mwindow *mw;
 } git_packfile_stream;
 
-size_t git_packfile__object_header(unsigned char *hdr, size_t size, git_object_t type);
+int git_packfile__object_header(size_t *out, unsigned char *hdr, size_t size, git_object_t type);
 
 int git_packfile__name(char **out, const char *path);
 
diff --git a/src/patch.c b/src/patch.c
index 82181bb3d..8f8bd7a08 100644
--- a/src/patch.c
+++ b/src/patch.c
@@ -65,7 +65,7 @@ size_t git_patch_size(
 {
 	size_t out;
 
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	out = patch->content_size;
 
@@ -129,13 +129,13 @@ int git_patch_line_stats(
 
 const git_diff_delta *git_patch_get_delta(const git_patch *patch)
 {
-	assert(patch);
+	GIT_ASSERT_ARG_WITH_RETVAL(patch, NULL);
 	return patch->delta;
 }
 
 size_t git_patch_num_hunks(const git_patch *patch)
 {
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 	return git_array_size(patch->hunks);
 }
 
@@ -152,7 +152,7 @@ int git_patch_get_hunk(
 	size_t hunk_idx)
 {
 	git_patch_hunk *hunk;
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	hunk = git_array_get(patch->hunks, hunk_idx);
 
@@ -170,7 +170,7 @@ int git_patch_get_hunk(
 int git_patch_num_lines_in_hunk(const git_patch *patch, size_t hunk_idx)
 {
 	git_patch_hunk *hunk;
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	if (!(hunk = git_array_get(patch->hunks, hunk_idx)))
 		return patch_error_outofrange("hunk");
@@ -186,7 +186,7 @@ int git_patch_get_line_in_hunk(
 	git_patch_hunk *hunk;
 	git_diff_line *line;
 
-	assert(patch);
+	GIT_ASSERT_ARG(patch);
 
 	if (!(hunk = git_array_get(patch->hunks, hunk_idx))) {
 		if (out) *out = NULL;
@@ -206,7 +206,9 @@ int git_patch_get_line_in_hunk(
 
 int git_patch_from_diff(git_patch **out, git_diff *diff, size_t idx)
 {
-	assert(out && diff && diff->patch_fn);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diff);
+	GIT_ASSERT_ARG(diff->patch_fn);
 	return diff->patch_fn(out, diff, idx);
 }
 
diff --git a/src/patch_generate.c b/src/patch_generate.c
index 6dd61c18f..38cd714a9 100644
--- a/src/patch_generate.c
+++ b/src/patch_generate.c
@@ -561,7 +561,7 @@ static int patch_from_sources(
 	patch_generated_with_delta *pd;
 	git_xdiff_output xo;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	*out = NULL;
 
 	if ((error = patch_generated_with_delta_alloc(
@@ -840,7 +840,7 @@ static int patch_generated_line_cb(
 	GIT_UNUSED(hunk_);
 
 	hunk = git_array_last(patch->base.hunks);
-	assert(hunk); /* programmer error if no hunk is available */
+	GIT_ASSERT(hunk); /* programmer error if no hunk is available */
 
 	line = git_array_alloc(patch->base.lines);
 	GIT_ERROR_CHECK_ALLOC(line);
diff --git a/src/patch_parse.c b/src/patch_parse.c
index 2bf94c2cb..2cc5c5995 100644
--- a/src/patch_parse.c
+++ b/src/patch_parse.c
@@ -1168,7 +1168,8 @@ int git_patch_parse(
 	size_t start, used;
 	int error = 0;
 
-	assert(out && ctx);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ctx);
 
 	*out = NULL;
 
diff --git a/src/path.c b/src/path.c
index f271c532c..dde3efb63 100644
--- a/src/path.c
+++ b/src/path.c
@@ -274,24 +274,6 @@ size_t git_path_basename_offset(git_buf *buffer)
 	return 0;
 }
 
-const char *git_path_topdir(const char *path)
-{
-	size_t len;
-	ssize_t i;
-
-	assert(path);
-	len = strlen(path);
-
-	if (!len || path[len - 1] != '/')
-		return NULL;
-
-	for (i = (ssize_t)len - 2; i >= 0; --i)
-		if (path[i] == '/')
-			break;
-
-	return &path[i + 1];
-}
-
 int git_path_root(const char *path)
 {
 	int offset = 0, prefix_len;
@@ -325,7 +307,9 @@ int git_path_root(const char *path)
 static void path_trim_slashes(git_buf *path)
 {
 	int ceiling = git_path_root(path->ptr) + 1;
-	assert(ceiling >= 0);
+
+	if (ceiling < 0)
+		return;
 
 	while (path->size > (size_t)ceiling) {
 		if (path->ptr[path->size-1] != '/')
@@ -341,7 +325,8 @@ int git_path_join_unrooted(
 {
 	ssize_t root;
 
-	assert(path && path_out);
+	GIT_ASSERT_ARG(path_out);
+	GIT_ASSERT_ARG(path);
 
 	root = (ssize_t)git_path_root(path);
 
@@ -389,7 +374,8 @@ int git_path_prettify(git_buf *path_out, const char *path, const char *base)
 {
 	char buf[GIT_PATH_MAX];
 
-	assert(path && path_out);
+	GIT_ASSERT_ARG(path_out);
+	GIT_ASSERT_ARG(path);
 
 	/* construct path if needed */
 	if (base != NULL && git_path_root(path) < 0) {
@@ -440,7 +426,9 @@ void git_path_string_to_dir(char* path, size_t size)
 int git__percent_decode(git_buf *decoded_out, const char *input)
 {
 	int len, hi, lo, i;
-	assert(decoded_out && input);
+
+	GIT_ASSERT_ARG(decoded_out);
+	GIT_ASSERT_ARG(input);
 
 	len = (int)strlen(input);
 	git_buf_clear(decoded_out);
@@ -501,7 +489,8 @@ int git_path_fromurl(git_buf *local_path_out, const char *file_url)
 {
 	int offset;
 
-	assert(local_path_out && file_url);
+	GIT_ASSERT_ARG(local_path_out);
+	GIT_ASSERT_ARG(file_url);
 
 	if ((offset = local_file_url_prefixlen(file_url)) < 0 ||
 		file_url[offset] == '\0' || file_url[offset] == '/')
@@ -526,7 +515,8 @@ int git_path_walk_up(
 	ssize_t stop = 0, scan;
 	char oldc = '\0';
 
-	assert(path && cb);
+	GIT_ASSERT_ARG(path);
+	GIT_ASSERT_ARG(cb);
 
 	if (ceiling != NULL) {
 		if (git__prefixcmp(path->ptr, ceiling) == 0)
@@ -581,7 +571,7 @@ int git_path_walk_up(
 
 bool git_path_exists(const char *path)
 {
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	return p_access(path, F_OK) == 0;
 }
 
@@ -598,7 +588,7 @@ bool git_path_isfile(const char *path)
 {
 	struct stat st;
 
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	if (p_stat(path, &st) < 0)
 		return false;
 
@@ -609,7 +599,7 @@ bool git_path_islink(const char *path)
 {
 	struct stat st;
 
-	assert(path);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, false);
 	if (p_lstat(path, &st) < 0)
 		return false;
 
@@ -1211,7 +1201,8 @@ int git_path_diriter_init(
 	if (is_win7_or_later < 0)
 		is_win7_or_later = git_has_win32_version(6, 1, 0);
 
-	assert(diriter && path);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT_ARG(path);
 
 	memset(diriter, 0, sizeof(git_path_diriter));
 	diriter->handle = INVALID_HANDLE_VALUE;
@@ -1311,9 +1302,10 @@ int git_path_diriter_filename(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
-
-	assert(diriter->path_utf8.size > diriter->parent_utf8_len);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT(diriter->path_utf8.size > diriter->parent_utf8_len);
 
 	*out = &diriter->path_utf8.ptr[diriter->parent_utf8_len+1];
 	*out_len = diriter->path_utf8.size - diriter->parent_utf8_len - 1;
@@ -1325,7 +1317,9 @@ int git_path_diriter_fullpath(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
 
 	*out = diriter->path_utf8.ptr;
 	*out_len = diriter->path_utf8.size;
@@ -1334,7 +1328,8 @@ int git_path_diriter_fullpath(
 
 int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
 {
-	assert(out && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diriter);
 
 	return git_win32__file_attribute_to_stat(out,
 		(WIN32_FILE_ATTRIBUTE_DATA *)&diriter->current,
@@ -1361,7 +1356,8 @@ int git_path_diriter_init(
 	const char *path,
 	unsigned int flags)
 {
-	assert(diriter && path);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT_ARG(path);
 
 	memset(diriter, 0, sizeof(git_path_diriter));
 
@@ -1401,7 +1397,7 @@ int git_path_diriter_next(git_path_diriter *diriter)
 	bool skip_dot = !(diriter->flags & GIT_PATH_DIR_INCLUDE_DOT_AND_DOTDOT);
 	int error = 0;
 
-	assert(diriter);
+	GIT_ASSERT_ARG(diriter);
 
 	errno = 0;
 
@@ -1444,9 +1440,10 @@ int git_path_diriter_filename(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
-
-	assert(diriter->path.size > diriter->parent_len);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
+	GIT_ASSERT(diriter->path.size > diriter->parent_len);
 
 	*out = &diriter->path.ptr[diriter->parent_len+1];
 	*out_len = diriter->path.size - diriter->parent_len - 1;
@@ -1458,7 +1455,9 @@ int git_path_diriter_fullpath(
 	size_t *out_len,
 	git_path_diriter *diriter)
 {
-	assert(out && out_len && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(out_len);
+	GIT_ASSERT_ARG(diriter);
 
 	*out = diriter->path.ptr;
 	*out_len = diriter->path.size;
@@ -1467,7 +1466,8 @@ int git_path_diriter_fullpath(
 
 int git_path_diriter_stat(struct stat *out, git_path_diriter *diriter)
 {
-	assert(out && diriter);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(diriter);
 
 	return git_path_lstat(diriter->path.ptr, out);
 }
@@ -1503,7 +1503,8 @@ int git_path_dirload(
 	char *dup;
 	int error;
 
-	assert(contents && path);
+	GIT_ASSERT_ARG(contents);
+	GIT_ASSERT_ARG(path);
 
 	if ((error = git_path_diriter_init(&iter, path, flags)) < 0)
 		return error;
@@ -1512,7 +1513,7 @@ int git_path_dirload(
 		if ((error = git_path_diriter_fullpath(&name, &name_len, &iter)) < 0)
 			break;
 
-		assert(name_len > prefix_len);
+		GIT_ASSERT(name_len > prefix_len);
 
 		dup = git__strndup(name + prefix_len, name_len - prefix_len);
 		GIT_ERROR_CHECK_ALLOC(dup);
diff --git a/src/path.h b/src/path.h
index ed6b93574..bfef1b8a8 100644
--- a/src/path.h
+++ b/src/path.h
@@ -67,8 +67,6 @@ extern int git_path_basename_r(git_buf *buffer, const char *path);
  */
 extern size_t git_path_basename_offset(git_buf *buffer);
 
-extern const char *git_path_topdir(const char *path);
-
 /**
  * Find offset to root of path if path has one.
  *
diff --git a/src/pathspec.c b/src/pathspec.c
index 83f776c91..8b17a6e27 100644
--- a/src/pathspec.c
+++ b/src/pathspec.c
@@ -289,7 +289,8 @@ int git_pathspec_matches_path(
 	bool no_fnmatch = (flags & GIT_PATHSPEC_NO_GLOB) != 0;
 	bool casefold =  (flags & GIT_PATHSPEC_IGNORE_CASE) != 0;
 
-	assert(ps && path);
+	GIT_ASSERT_ARG(ps);
+	GIT_ASSERT_ARG(path);
 
 	return (0 != git_pathspec__match(
 		&ps->pathspec, path, no_fnmatch, casefold, NULL, NULL));
@@ -526,7 +527,7 @@ int git_pathspec_match_workdir(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -548,7 +549,7 @@ int git_pathspec_match_index(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(index);
+	GIT_ASSERT_ARG(index);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -570,7 +571,7 @@ int git_pathspec_match_tree(
 	git_iterator_options iter_opts = GIT_ITERATOR_OPTIONS_INIT;
 	int error = 0;
 
-	assert(tree);
+	GIT_ASSERT_ARG(tree);
 
 	iter_opts.flags = pathspec_match_iter_flags(flags);
 
@@ -598,7 +599,7 @@ int git_pathspec_match_diff(
 	const git_diff_delta *delta, **match;
 	git_bitvec used_patterns;
 
-	assert(diff);
+	GIT_ASSERT_ARG(diff);
 
 	if (git_bitvec_init(&used_patterns, patterns->length) < 0)
 		return -1;
diff --git a/src/pool.c b/src/pool.c
index 0c423dd3a..16ffa398d 100644
--- a/src/pool.c
+++ b/src/pool.c
@@ -36,8 +36,8 @@ int git_pool_global_init(void)
 
 int git_pool_init(git_pool *pool, size_t item_size)
 {
-	assert(pool);
-	assert(item_size >= 1);
+	GIT_ASSERT_ARG(pool);
+	GIT_ASSERT_ARG(item_size >= 1);
 
 	memset(pool, 0, sizeof(git_pool));
 	pool->item_size = item_size;
@@ -131,8 +131,8 @@ static int git_pool__ptr_cmp(const void * a, const void * b)
 
 int git_pool_init(git_pool *pool, size_t item_size)
 {
-	assert(pool);
-	assert(item_size >= 1);
+	GIT_ASSERT_ARG(pool);
+	GIT_ASSERT_ARG(item_size >= 1);
 
 	memset(pool, 0, sizeof(git_pool));
 	pool->item_size = item_size;
@@ -205,7 +205,9 @@ char *git_pool_strndup(git_pool *pool, const char *str, size_t n)
 {
 	char *ptr = NULL;
 
-	assert(pool && str && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(str, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
 
 	if (n == SIZE_MAX)
 		return NULL;
@@ -220,7 +222,10 @@ char *git_pool_strndup(git_pool *pool, const char *str, size_t n)
 
 char *git_pool_strdup(git_pool *pool, const char *str)
 {
-	assert(pool && str && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(str, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
+
 	return git_pool_strndup(pool, str, strlen(str));
 }
 
@@ -234,7 +239,8 @@ char *git_pool_strcat(git_pool *pool, const char *a, const char *b)
 	void *ptr;
 	size_t len_a, len_b, total;
 
-	assert(pool && pool->item_size == sizeof(char));
+	GIT_ASSERT_ARG_WITH_RETVAL(pool, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(pool->item_size == sizeof(char), NULL);
 
 	len_a = a ? strlen(a) : 0;
 	len_b = b ? strlen(b) : 0;
diff --git a/src/posix.c b/src/posix.c
index fbaa7c3ca..9cd96d2c8 100644
--- a/src/posix.c
+++ b/src/posix.c
@@ -129,7 +129,8 @@ int p_getcwd(char *buffer_out, size_t size)
 {
 	char *cwd_buffer;
 
-	assert(buffer_out && size > 0);
+	GIT_ASSERT_ARG(buffer_out);
+	GIT_ASSERT_ARG(size > 0);
 
 	cwd_buffer = getcwd(buffer_out, size);
 
@@ -196,7 +197,7 @@ int p_write(git_file fd, const void *buf, size_t cnt)
 	while (cnt) {
 		ssize_t r;
 #ifdef GIT_WIN32
-		assert((size_t)((unsigned int)cnt) == cnt);
+		GIT_ASSERT((size_t)((unsigned int)cnt) == cnt);
 		r = write(fd, b, (unsigned int)cnt);
 #else
 		r = write(fd, b, cnt);
@@ -263,7 +264,7 @@ int p_mmap(git_map *out, size_t len, int prot, int flags, int fd, off64_t offset
 
 int p_munmap(git_map *map)
 {
-	assert(map != NULL);
+	GIT_ASSERT_ARG(map);
 	git__free(map->data);
 
 	return 0;
diff --git a/src/reader.c b/src/reader.c
index 90f700a00..9672473e8 100644
--- a/src/reader.c
+++ b/src/reader.c
@@ -61,7 +61,8 @@ int git_reader_for_tree(git_reader **out, git_tree *tree)
 {
 	tree_reader *reader;
 
-	assert(out && tree);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(tree);
 
 	reader = git__calloc(1, sizeof(tree_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -158,7 +159,8 @@ int git_reader_for_workdir(
 	workdir_reader *reader;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	reader = git__calloc(1, sizeof(workdir_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -223,7 +225,8 @@ int git_reader_for_index(
 	index_reader *reader;
 	int error;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	reader = git__calloc(1, sizeof(index_reader));
 	GIT_ERROR_CHECK_ALLOC(reader);
@@ -251,7 +254,9 @@ int git_reader_read(
 	git_reader *reader,
 	const char *filename)
 {
-	assert(out && reader && filename);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(reader);
+	GIT_ASSERT_ARG(filename);
 
 	return reader->read(out, out_id, out_filemode, reader, filename);
 }
diff --git a/src/rebase.c b/src/rebase.c
index 7c6561195..bf6581a1b 100644
--- a/src/rebase.c
+++ b/src/rebase.c
@@ -186,8 +186,8 @@ static git_rebase_operation *rebase_operation_alloc(
 {
 	git_rebase_operation *operation;
 
-	assert((type == GIT_REBASE_OPERATION_EXEC) == !id);
-	assert((type == GIT_REBASE_OPERATION_EXEC) == !!exec);
+	GIT_ASSERT_WITH_RETVAL((type == GIT_REBASE_OPERATION_EXEC) == !id, NULL);
+	GIT_ASSERT_WITH_RETVAL((type == GIT_REBASE_OPERATION_EXEC) == !!exec, NULL);
 
 	if ((operation = git_array_alloc(rebase->operations)) == NULL)
 		return NULL;
@@ -301,7 +301,7 @@ int git_rebase_open(
 	size_t state_path_len;
 	int error;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = rebase_check_versions(given_opts)) < 0)
 		return error;
@@ -701,7 +701,8 @@ int git_rebase_init(
 	bool inmemory = (given_opts && given_opts->inmemory);
 	int error;
 
-	assert(repo && (upstream || onto));
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(upstream || onto);
 
 	*out = NULL;
 
@@ -912,7 +913,8 @@ int git_rebase_next(
 {
 	int error;
 
-	assert(out && rebase);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(rebase);
 
 	if ((error = rebase_movenext(rebase)) < 0)
 		return error;
@@ -931,7 +933,9 @@ int git_rebase_inmemory_index(
 	git_index **out,
 	git_rebase *rebase)
 {
-	assert(out && rebase && rebase->index);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(rebase);
+	GIT_ASSERT_ARG(rebase->index);
 
 	GIT_REFCOUNT_INC(rebase->index);
 	*out = rebase->index;
@@ -1006,12 +1010,12 @@ static int rebase_commit__create(
 	}
 
 	if (git_buf_is_allocated(&commit_signature)) {
-		assert(git_buf_contains_nul(&commit_signature));
+		GIT_ASSERT(git_buf_contains_nul(&commit_signature));
 		commit_signature_string = git_buf_cstr(&commit_signature);
 	}
 
 	if (git_buf_is_allocated(&signature_field)) {
-		assert(git_buf_contains_nul(&signature_field));
+		GIT_ASSERT(git_buf_contains_nul(&signature_field));
 		signature_field_string = git_buf_cstr(&signature_field);
 	}
 
@@ -1055,7 +1059,7 @@ static int rebase_commit_merge(
 	int error;
 
 	operation = git_array_get(rebase->operations, rebase->current);
-	assert(operation);
+	GIT_ASSERT(operation);
 
 	if ((error = rebase_ensure_not_dirty(rebase->repo, false, true, GIT_EUNMERGED)) < 0 ||
 		(error = git_repository_head(&head, rebase->repo)) < 0 ||
@@ -1095,9 +1099,9 @@ static int rebase_commit_inmemory(
 	git_commit *commit = NULL;
 	int error = 0;
 
-	assert(rebase->index);
-	assert(rebase->last_commit);
-	assert(rebase->current < rebase->operations.size);
+	GIT_ASSERT_ARG(rebase->index);
+	GIT_ASSERT_ARG(rebase->last_commit);
+	GIT_ASSERT_ARG(rebase->current < rebase->operations.size);
 
 	if ((error = rebase_commit__create(&commit, rebase, rebase->index,
 		rebase->last_commit, author, committer, message_encoding, message)) < 0)
@@ -1125,7 +1129,8 @@ int git_rebase_commit(
 {
 	int error;
 
-	assert(rebase && committer);
+	GIT_ASSERT_ARG(rebase);
+	GIT_ASSERT_ARG(committer);
 
 	if (rebase->inmemory)
 		error = rebase_commit_inmemory(
@@ -1145,7 +1150,7 @@ int git_rebase_abort(git_rebase *rebase)
 	git_commit *orig_head_commit = NULL;
 	int error;
 
-	assert(rebase);
+	GIT_ASSERT_ARG(rebase);
 
 	if (rebase->inmemory)
 		return 0;
@@ -1358,7 +1363,7 @@ int git_rebase_finish(
 {
 	int error = 0;
 
-	assert(rebase);
+	GIT_ASSERT_ARG(rebase);
 
 	if (rebase->inmemory)
 		return 0;
@@ -1373,14 +1378,17 @@ int git_rebase_finish(
 }
 
 const char *git_rebase_orig_head_name(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return rebase->orig_head_name;
 }
 
 const git_oid *git_rebase_orig_head_id(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return &rebase->orig_head_id;
 }
 
 const char *git_rebase_onto_name(git_rebase *rebase) {
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 	return rebase->onto_name;
 }
 
@@ -1390,21 +1398,21 @@ const git_oid *git_rebase_onto_id(git_rebase *rebase) {
 
 size_t git_rebase_operation_entrycount(git_rebase *rebase)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, 0);
 
 	return git_array_size(rebase->operations);
 }
 
 size_t git_rebase_operation_current(git_rebase *rebase)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, 0);
 
 	return rebase->started ? rebase->current : GIT_REBASE_NO_OPERATION;
 }
 
 git_rebase_operation *git_rebase_operation_byindex(git_rebase *rebase, size_t idx)
 {
-	assert(rebase);
+	GIT_ASSERT_ARG_WITH_RETVAL(rebase, NULL);
 
 	return git_array_get(rebase->operations, idx);
 }
diff --git a/src/refdb.c b/src/refdb.c
index fb86d5ccb..ed33de92b 100644
--- a/src/refdb.c
+++ b/src/refdb.c
@@ -24,7 +24,8 @@ int git_refdb_new(git_refdb **out, git_repository *repo)
 {
 	git_refdb *db;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	db = git__calloc(1, sizeof(*db));
 	GIT_ERROR_CHECK_ALLOC(db);
@@ -41,7 +42,8 @@ int git_refdb_open(git_refdb **out, git_repository *repo)
 	git_refdb *db;
 	git_refdb_backend *dir;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	*out = NULL;
 
@@ -89,7 +91,7 @@ int git_refdb_set_backend(git_refdb *db, git_refdb_backend *backend)
 
 int git_refdb_compress(git_refdb *db)
 {
-	assert(db);
+	GIT_ASSERT_ARG(db);
 
 	if (db->backend->compress)
 		return db->backend->compress(db->backend);
@@ -114,7 +116,9 @@ void git_refdb_free(git_refdb *db)
 
 int git_refdb_exists(int *exists, git_refdb *refdb, const char *ref_name)
 {
-	assert(exists && refdb && refdb->backend);
+	GIT_ASSERT_ARG(exists);
+	GIT_ASSERT_ARG(refdb);
+	GIT_ASSERT_ARG(refdb->backend);
 
 	return refdb->backend->exists(exists, refdb->backend, ref_name);
 }
@@ -124,7 +128,10 @@ int git_refdb_lookup(git_reference **out, git_refdb *db, const char *ref_name)
 	git_reference *ref;
 	int error;
 
-	assert(db && db->backend && out && ref_name);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(db->backend);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ref_name);
 
 	error = db->backend->lookup(&ref, db->backend, ref_name);
 	if (error < 0)
@@ -234,7 +241,8 @@ void git_refdb_iterator_free(git_reference_iterator *iter)
 
 int git_refdb_write(git_refdb *db, git_reference *ref, int force, const git_signature *who, const char *message, const git_oid *old_id, const char *old_target)
 {
-	assert(db && db->backend);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(db->backend);
 
 	GIT_REFCOUNT_INC(db);
 	ref->db = db;
@@ -253,7 +261,9 @@ int git_refdb_rename(
 {
 	int error;
 
-	assert(db && db->backend);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(db->backend);
+
 	error = db->backend->rename(out, db->backend, old_name, new_name, force, who, message);
 	if (error < 0)
 		return error;
@@ -268,7 +278,9 @@ int git_refdb_rename(
 
 int git_refdb_delete(struct git_refdb *db, const char *ref_name, const git_oid *old_id, const char *old_target)
 {
-	assert(db && db->backend);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(db->backend);
+
 	return db->backend->del(db->backend, ref_name, old_id, old_target);
 }
 
@@ -276,7 +288,8 @@ int git_refdb_reflog_read(git_reflog **out, git_refdb *db,  const char *name)
 {
 	int error;
 
-	assert(db && db->backend);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(db->backend);
 
 	if ((error = db->backend->reflog_read(out, db->backend, name)) < 0)
 		return error;
@@ -368,14 +381,16 @@ out:
 
 int git_refdb_has_log(git_refdb *db, const char *refname)
 {
-	assert(db && refname);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(refname);
 
 	return db->backend->has_log(db->backend, refname);
 }
 
 int git_refdb_ensure_log(git_refdb *db, const char *refname)
 {
-	assert(db && refname);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(refname);
 
 	return db->backend->ensure_log(db->backend, refname);
 }
@@ -389,7 +404,9 @@ int git_refdb_init_backend(git_refdb_backend *backend, unsigned int version)
 
 int git_refdb_lock(void **payload, git_refdb *db, const char *refname)
 {
-	assert(payload && db && refname);
+	GIT_ASSERT_ARG(payload);
+	GIT_ASSERT_ARG(db);
+	GIT_ASSERT_ARG(refname);
 
 	if (!db->backend->lock) {
 		git_error_set(GIT_ERROR_REFERENCE, "backend does not support locking");
@@ -401,7 +418,7 @@ int git_refdb_lock(void **payload, git_refdb *db, const char *refname)
 
 int git_refdb_unlock(git_refdb *db, void *payload, int success, int update_reflog, const git_reference *ref, const git_signature *sig, const char *message)
 {
-	assert(db);
+	GIT_ASSERT_ARG(db);
 
 	return db->backend->unlock(db->backend, payload, success, update_reflog, ref, sig, message);
 }
diff --git a/src/refdb_fs.c b/src/refdb_fs.c
index 7e0481909..aef5ab237 100644
--- a/src/refdb_fs.c
+++ b/src/refdb_fs.c
@@ -331,7 +331,7 @@ static int refdb_fs_backend__exists(
 	git_buf ref_path = GIT_BUF_INIT;
 	int error;
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	*exists = 0;
 
@@ -472,7 +472,7 @@ static int refdb_fs_backend__lookup(
 	refdb_fs_backend *backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 	int error;
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	if (!(error = loose_lookup(out, backend, ref_name)))
 		return 0;
@@ -678,7 +678,7 @@ static int refdb_fs_backend__iterator(
 	refdb_fs_iter *iter = NULL;
 	int error;
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	iter = git__calloc(1, sizeof(refdb_fs_iter));
 	GIT_ERROR_CHECK_ALLOC(iter);
@@ -783,7 +783,9 @@ static int loose_lock(git_filebuf *file, refdb_fs_backend *backend, const char *
 	git_buf ref_path = GIT_BUF_INIT;
 	const char *basedir;
 
-	assert(file && backend && name);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(name);
 
 	if (!git_path_isvalid(backend->repo, name, 0, GIT_PATH_REJECT_FILESYSTEM_DEFAULTS)) {
 		git_error_set(GIT_ERROR_INVALID, "invalid reference name '%s'", name);
@@ -819,7 +821,8 @@ static int loose_lock(git_filebuf *file, refdb_fs_backend *backend, const char *
 
 static int loose_commit(git_filebuf *file, const git_reference *ref)
 {
-	assert(file && ref);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(ref);
 
 	if (ref->type == GIT_REFERENCE_DIRECT) {
 		char oid[GIT_OID_HEXSZ + 1];
@@ -829,7 +832,7 @@ static int loose_commit(git_filebuf *file, const git_reference *ref)
 	} else if (ref->type == GIT_REFERENCE_SYMBOLIC) {
 		git_filebuf_printf(file, GIT_SYMREF "%s\n", ref->target.symbolic);
 	} else {
-		assert(0); /* don't let this happen */
+		GIT_ASSERT(0);
 	}
 
 	return git_filebuf_commit(file);
@@ -1066,7 +1069,7 @@ static int packed_write(refdb_fs_backend *backend)
 
 	for (i = 0; i < git_sortedcache_entrycount(refcache); ++i) {
 		struct packref *ref = git_sortedcache_entry(refcache, i);
-		assert(ref);
+		GIT_ASSERT(ref);
 
 		if ((error = packed_find_peel(backend, ref)) < 0)
 			goto fail;
@@ -1219,7 +1222,7 @@ static int refdb_fs_backend__write(
 	git_filebuf file = GIT_FILEBUF_INIT;
 	int error = 0;
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	if ((error = reference_path_available(backend, ref->name, NULL, force)) < 0)
 		return error;
@@ -1292,7 +1295,7 @@ on_error:
         return error;
 }
 
-static void refdb_fs_backend__prune_refs(
+static int refdb_fs_backend__prune_refs(
 	refdb_fs_backend *backend,
 	const char *ref_name,
 	const char *prefix)
@@ -1300,10 +1303,12 @@ static void refdb_fs_backend__prune_refs(
 	git_buf relative_path = GIT_BUF_INIT;
 	git_buf base_path = GIT_BUF_INIT;
 	size_t commonlen;
+	int error;
 
-	assert(backend && ref_name);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(ref_name);
 
-	if (git_buf_sets(&relative_path, ref_name) < 0)
+	if ((error = git_buf_sets(&relative_path, ref_name)) < 0)
 		goto cleanup;
 
 	git_path_squash_slashes(&relative_path);
@@ -1313,20 +1318,30 @@ static void refdb_fs_backend__prune_refs(
 
 		git_buf_truncate(&relative_path, commonlen);
 
-		if (prefix) {
-			if (git_buf_join3(&base_path, '/', backend->commonpath, prefix, git_buf_cstr(&relative_path)) < 0)
-				goto cleanup;
-		} else {
-			if (git_buf_joinpath(&base_path, backend->commonpath, git_buf_cstr(&relative_path)) < 0)
-				goto cleanup;
-		}
+		if (prefix)
+			error = git_buf_join3(&base_path, '/',
+				backend->commonpath, prefix,
+				git_buf_cstr(&relative_path));
+		else
+			error = git_buf_joinpath(&base_path,
+				backend->commonpath,
+				git_buf_cstr(&relative_path));
+
+		if (error < 0)
+			goto cleanup;
+
+		error = git_futils_rmdir_r(ref_name + commonlen,
+			git_buf_cstr(&base_path),
+			GIT_RMDIR_EMPTY_PARENTS | GIT_RMDIR_SKIP_ROOT);
 
-		git_futils_rmdir_r(ref_name + commonlen, git_buf_cstr(&base_path), GIT_RMDIR_EMPTY_PARENTS | GIT_RMDIR_SKIP_ROOT);
+		if (error == GIT_ENOTFOUND)
+			error = 0;
 	}
 
 cleanup:
 	git_buf_dispose(&relative_path);
 	git_buf_dispose(&base_path);
+	return error;
 }
 
 static int refdb_fs_backend__delete(
@@ -1338,7 +1353,8 @@ static int refdb_fs_backend__delete(
 	git_filebuf file = GIT_FILEBUF_INIT;
 	int error = 0;
 
-	assert(backend && ref_name);
+	GIT_ASSERT_ARG(backend);
+	GIT_ASSERT_ARG(ref_name);
 
 	if ((error = loose_lock(&file, backend, ref_name)) < 0)
 		return error;
@@ -1424,7 +1440,7 @@ static int refdb_fs_backend__delete_tail(
 cleanup:
 	git_filebuf_cleanup(file);
 	if (error == 0)
-		refdb_fs_backend__prune_refs(backend, ref_name, "");
+		error = refdb_fs_backend__prune_refs(backend, ref_name, "");
 	return error;
 }
 
@@ -1444,7 +1460,7 @@ static int refdb_fs_backend__rename(
 	git_filebuf file = GIT_FILEBUF_INIT;
 	int error;
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	if ((error = reference_path_available(
 			backend, new_name, old_name, force)) < 0 ||
@@ -1497,7 +1513,7 @@ static int refdb_fs_backend__compress(git_refdb_backend *_backend)
 	int error;
 	refdb_fs_backend *backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 
-	assert(backend);
+	GIT_ASSERT_ARG(backend);
 
 	if ((error = packed_reload(backend)) < 0 || /* load the existing packfile */
 	    (error = packed_loadloose(backend)) < 0 || /* add all the loose refs */
@@ -1511,7 +1527,8 @@ static void refdb_fs_backend__free(git_refdb_backend *_backend)
 {
 	refdb_fs_backend *backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 
-	assert(backend);
+	if (!backend)
+		return;
 
 	git_sortedcache_free(backend->refcache);
 	git__free(backend->gitpath);
@@ -1672,7 +1689,7 @@ static int refdb_reflog_fs__ensure_log(git_refdb_backend *_backend, const char *
 	git_buf path = GIT_BUF_INIT;
 	int error;
 
-	assert(_backend && name);
+	GIT_ASSERT_ARG(_backend && name);
 
 	backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 	repo = backend->repo;
@@ -1705,7 +1722,8 @@ static int refdb_reflog_fs__has_log(git_refdb_backend *_backend, const char *nam
 {
 	refdb_fs_backend *backend;
 
-	assert(_backend && name);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(name);
 
 	backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 
@@ -1721,7 +1739,9 @@ static int refdb_reflog_fs__read(git_reflog **out, git_refdb_backend *_backend,
 	git_repository *repo;
 	refdb_fs_backend *backend;
 
-	assert(out && _backend && name);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(name);
 
 	backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 	repo = backend->repo;
@@ -1838,7 +1858,8 @@ static int refdb_reflog_fs__write(git_refdb_backend *_backend, git_reflog *reflo
 	git_buf log = GIT_BUF_INIT;
 	git_filebuf fbuf = GIT_FILEBUF_INIT;
 
-	assert(_backend && reflog);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(reflog);
 
 	backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 
@@ -1960,7 +1981,9 @@ static int refdb_reflog_fs__rename(git_refdb_backend *_backend, const char *old_
 	git_repository *repo;
 	refdb_fs_backend *backend;
 
-	assert(_backend && old_name && new_name);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(old_name);
+	GIT_ASSERT_ARG(new_name);
 
 	backend = GIT_CONTAINER_OF(_backend, refdb_fs_backend, parent);
 	repo = backend->repo;
@@ -2037,7 +2060,8 @@ static int refdb_reflog_fs__delete(git_refdb_backend *_backend, const char *name
 	git_buf path = GIT_BUF_INIT;
 	int error;
 
-	assert(_backend && name);
+	GIT_ASSERT_ARG(_backend);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = retrieve_reflog_path(&path, backend->repo, name)) < 0)
 		goto out;
@@ -2048,7 +2072,7 @@ static int refdb_reflog_fs__delete(git_refdb_backend *_backend, const char *name
 	if ((error = p_unlink(path.ptr)) < 0)
 		goto out;
 
-	refdb_fs_backend__prune_refs(backend, name, GIT_REFLOG_DIR);
+	error = refdb_fs_backend__prune_refs(backend, name, GIT_REFLOG_DIR);
 
 out:
 	git_buf_dispose(&path);
diff --git a/src/reflog.c b/src/reflog.c
index 34537aa1f..1e9c0d4f1 100644
--- a/src/reflog.c
+++ b/src/reflog.c
@@ -50,7 +50,9 @@ int git_reflog_read(git_reflog **reflog, git_repository *repo,  const char *name
 	git_refdb *refdb;
 	int error;
 
-	assert(reflog && repo && name);
+	GIT_ASSERT_ARG(reflog);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = git_repository_refdb__weakptr(&refdb, repo)) < 0)
 		return error;
@@ -62,7 +64,8 @@ int git_reflog_write(git_reflog *reflog)
 {
 	git_refdb *db;
 
-	assert(reflog && reflog->db);
+	GIT_ASSERT_ARG(reflog);
+	GIT_ASSERT_ARG(reflog->db);
 
 	db = reflog->db;
 	return db->backend->reflog_write(db->backend, reflog);
@@ -73,7 +76,9 @@ int git_reflog_append(git_reflog *reflog, const git_oid *new_oid, const git_sign
 	const git_reflog_entry *previous;
 	git_reflog_entry *entry;
 
-	assert(reflog && new_oid && committer);
+	GIT_ASSERT_ARG(reflog);
+	GIT_ASSERT_ARG(new_oid);
+	GIT_ASSERT_ARG(committer);
 
 	entry = git__calloc(1, sizeof(git_reflog_entry));
 	GIT_ERROR_CHECK_ALLOC(entry);
@@ -139,13 +144,13 @@ int git_reflog_delete(git_repository *repo, const char *name)
 
 size_t git_reflog_entrycount(git_reflog *reflog)
 {
-	assert(reflog);
+	GIT_ASSERT_ARG_WITH_RETVAL(reflog, 0);
 	return reflog->entries.length;
 }
 
-const git_reflog_entry * git_reflog_entry_byindex(const git_reflog *reflog, size_t idx)
+const git_reflog_entry *git_reflog_entry_byindex(const git_reflog *reflog, size_t idx)
 {
-	assert(reflog);
+	GIT_ASSERT_ARG_WITH_RETVAL(reflog, NULL);
 
 	if (idx >= reflog->entries.length)
 		return NULL;
@@ -154,27 +159,27 @@ const git_reflog_entry * git_reflog_entry_byindex(const git_reflog *reflog, size
 		&reflog->entries, reflog_inverse_index(idx, reflog->entries.length));
 }
 
-const git_oid * git_reflog_entry_id_old(const git_reflog_entry *entry)
+const git_oid *git_reflog_entry_id_old(const git_reflog_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return &entry->oid_old;
 }
 
-const git_oid * git_reflog_entry_id_new(const git_reflog_entry *entry)
+const git_oid *git_reflog_entry_id_new(const git_reflog_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return &entry->oid_cur;
 }
 
-const git_signature * git_reflog_entry_committer(const git_reflog_entry *entry)
+const git_signature *git_reflog_entry_committer(const git_reflog_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return entry->committer;
 }
 
-const char * git_reflog_entry_message(const git_reflog_entry *entry)
+const char *git_reflog_entry_message(const git_reflog_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return entry->msg;
 }
 
diff --git a/src/refs.c b/src/refs.c
index 497b066d2..a954b8359 100644
--- a/src/refs.c
+++ b/src/refs.c
@@ -50,7 +50,8 @@ git_reference *git_reference__alloc_symbolic(
 {
 	git_reference *ref;
 
-	assert(name && target);
+	GIT_ASSERT_ARG_WITH_RETVAL(name, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(target, NULL);
 
 	ref = alloc_ref(name);
 	if (!ref)
@@ -73,7 +74,8 @@ git_reference *git_reference__alloc(
 {
 	git_reference *ref;
 
-	assert(name && oid);
+	GIT_ASSERT_ARG_WITH_RETVAL(name, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(oid, NULL);
 
 	ref = alloc_ref(name);
 	if (!ref)
@@ -94,7 +96,8 @@ git_reference *git_reference__realloc(
 	size_t namelen, reflen;
 	git_reference *rewrite = NULL;
 
-	assert(ptr_to_ref && name);
+	GIT_ASSERT_ARG_WITH_RETVAL(ptr_to_ref, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(name, NULL);
 
 	namelen = strlen(name);
 
@@ -215,7 +218,9 @@ int git_reference_lookup_resolved(
 	git_refdb *refdb;
 	int error = 0;
 
-	assert(ref_out && repo && name);
+	GIT_ASSERT_ARG(ref_out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = reference_normalize_for_repo(normalized, repo, name, true)) < 0 ||
 	    (error = git_repository_refdb__weakptr(&refdb, repo)) < 0 ||
@@ -307,25 +312,25 @@ cleanup:
  */
 git_reference_t git_reference_type(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 	return ref->type;
 }
 
 const char *git_reference_name(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG_WITH_RETVAL(ref, NULL);
 	return ref->name;
 }
 
 git_repository *git_reference_owner(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG_WITH_RETVAL(ref, NULL);
 	return ref->db->repo;
 }
 
 const git_oid *git_reference_target(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG_WITH_RETVAL(ref, NULL);
 
 	if (ref->type != GIT_REFERENCE_DIRECT)
 		return NULL;
@@ -335,7 +340,7 @@ const git_oid *git_reference_target(const git_reference *ref)
 
 const git_oid *git_reference_target_peel(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG_WITH_RETVAL(ref, NULL);
 
 	if (ref->type != GIT_REFERENCE_DIRECT || git_oid_is_zero(&ref->peel))
 		return NULL;
@@ -345,7 +350,7 @@ const git_oid *git_reference_target_peel(const git_reference *ref)
 
 const char *git_reference_symbolic_target(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG_WITH_RETVAL(ref, NULL);
 
 	if (ref->type != GIT_REFERENCE_SYMBOLIC)
 		return NULL;
@@ -370,8 +375,9 @@ static int reference__create(
 	git_reference *ref = NULL;
 	int error = 0;
 
-	assert(repo && name);
-	assert(symbolic || signature);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(symbolic || signature);
 
 	if (ref_out)
 		*ref_out = NULL;
@@ -385,7 +391,7 @@ static int reference__create(
 		return error;
 
 	if (oid != NULL) {
-		assert(symbolic == NULL);
+		GIT_ASSERT(symbolic == NULL);
 
 		if (!git_object__is_valid(repo, oid, GIT_OBJECT_ANY)) {
 			git_error_set(GIT_ERROR_REFERENCE,
@@ -457,7 +463,7 @@ int git_reference_create_matching(
 	int error;
 	git_signature *who = NULL;
 
-	assert(id);
+	GIT_ASSERT_ARG(id);
 
 	if ((error = git_reference__log_signature(&who, repo)) < 0)
 		return error;
@@ -492,7 +498,7 @@ int git_reference_symbolic_create_matching(
 	int error;
 	git_signature *who = NULL;
 
-	assert(target);
+	GIT_ASSERT_ARG(target);
 
 	if ((error = git_reference__log_signature(&who, repo)) < 0)
 		return error;
@@ -533,7 +539,9 @@ int git_reference_set_target(
 	int error;
 	git_repository *repo;
 
-	assert(out && ref && id);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ref);
+	GIT_ASSERT_ARG(id);
 
 	repo = ref->db->repo;
 
@@ -560,7 +568,9 @@ int git_reference_symbolic_set_target(
 {
 	int error;
 
-	assert(out && ref && target);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ref);
+	GIT_ASSERT_ARG(target);
 
 	if ((error = ensure_is_an_updatable_symbolic_reference(ref)) < 0)
 		return error;
@@ -611,7 +621,8 @@ int git_reference_rename(
 	git_repository *repo;
 	int error;
 
-	assert(out && ref);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(ref);
 
 	repo = git_reference_owner(ref);
 
@@ -777,7 +788,8 @@ int git_reference_list(
 {
 	git_vector ref_list;
 
-	assert(array && repo);
+	GIT_ASSERT_ARG(array);
+	GIT_ASSERT_ARG(repo);
 
 	array->strings = NULL;
 	array->count = 0;
@@ -861,7 +873,8 @@ static bool is_all_caps_and_underscore(const char *name, size_t len)
 	size_t i;
 	char c;
 
-	assert(name && len > 0);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(len > 0);
 
 	for (i = 0; i < len; i++)
 	{
@@ -892,7 +905,7 @@ int git_reference__normalize_name(
 	git_path_iconv_t ic = GIT_PATH_ICONV_INIT;
 #endif
 
-	assert(name);
+	GIT_ASSERT_ARG(name);
 
 	process_flags = flags;
 	current = (char *)name;
@@ -1024,7 +1037,8 @@ int git_reference_normalize_name(
 		goto cleanup;
 	}
 
-	git_buf_copy_cstr(buffer_out, buffer_size, &buf);
+	if ((error = git_buf_copy_cstr(buffer_out, buffer_size, &buf)) < 0)
+		goto cleanup;
 
 	error = 0;
 
@@ -1040,7 +1054,9 @@ int git_reference_cmp(
 	const git_reference *ref2)
 {
 	git_reference_t type1, type2;
-	assert(ref1 && ref2);
+
+	GIT_ASSERT_ARG(ref1);
+	GIT_ASSERT_ARG(ref2);
 
 	type1 = git_reference_type(ref1);
 	type2 = git_reference_type(ref2);
@@ -1163,7 +1179,8 @@ int git_reference_has_log(git_repository *repo, const char *refname)
 	int error;
 	git_refdb *refdb;
 
-	assert(repo && refname);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(refname);
 
 	if ((error = git_repository_refdb__weakptr(&refdb, repo)) < 0)
 		return error;
@@ -1176,7 +1193,8 @@ int git_reference_ensure_log(git_repository *repo, const char *refname)
 	int error;
 	git_refdb *refdb;
 
-	assert(repo && refname);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(refname);
 
 	if ((error = git_repository_refdb__weakptr(&refdb, repo)) < 0)
 		return error;
@@ -1191,7 +1209,7 @@ int git_reference__is_branch(const char *ref_name)
 
 int git_reference_is_branch(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 	return git_reference__is_branch(ref->name);
 }
 
@@ -1202,7 +1220,7 @@ int git_reference__is_remote(const char *ref_name)
 
 int git_reference_is_remote(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 	return git_reference__is_remote(ref->name);
 }
 
@@ -1213,7 +1231,7 @@ int git_reference__is_tag(const char *ref_name)
 
 int git_reference_is_tag(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 	return git_reference__is_tag(ref->name);
 }
 
@@ -1224,7 +1242,7 @@ int git_reference__is_note(const char *ref_name)
 
 int git_reference_is_note(const git_reference *ref)
 {
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 	return git_reference__is_note(ref->name);
 }
 
@@ -1246,7 +1264,7 @@ int git_reference_peel(
 	git_object *target = NULL;
 	int error;
 
-	assert(ref);
+	GIT_ASSERT_ARG(ref);
 
 	if (ref->type == GIT_REFERENCE_DIRECT) {
 		resolved = ref;
@@ -1338,7 +1356,10 @@ int git_reference__is_unborn_head(bool *unborn, const git_reference *ref, git_re
 {
 	int error;
 	git_reference *tmp_ref;
-	assert(unborn && ref && repo);
+
+	GIT_ASSERT_ARG(unborn);
+	GIT_ASSERT_ARG(ref);
+	GIT_ASSERT_ARG(repo);
 
 	if (ref->type == GIT_REFERENCE_DIRECT) {
 		*unborn = 0;
diff --git a/src/refspec.c b/src/refspec.c
index 4245cbbda..d0be29bf6 100644
--- a/src/refspec.c
+++ b/src/refspec.c
@@ -24,7 +24,8 @@ int git_refspec__parse(git_refspec *refspec, const char *input, bool is_fetch)
 	int valid = 0;
 	unsigned int flags;
 
-	assert(refspec && input);
+	GIT_ASSERT_ARG(refspec);
+	GIT_ASSERT_ARG(input);
 
 	memset(refspec, 0x0, sizeof(git_refspec));
 	refspec->push = !is_fetch;
@@ -180,7 +181,8 @@ void git_refspec__dispose(git_refspec *refspec)
 int git_refspec_parse(git_refspec **out_refspec, const char *input, int is_fetch)
 {
 	git_refspec *refspec;
-	assert(out_refspec && input);
+	GIT_ASSERT_ARG(out_refspec);
+	GIT_ASSERT_ARG(input);
 
 	*out_refspec = NULL;
 
@@ -219,7 +221,7 @@ const char *git_refspec_string(const git_refspec *refspec)
 
 int git_refspec_force(const git_refspec *refspec)
 {
-	assert(refspec);
+	GIT_ASSERT_ARG(refspec);
 
 	return refspec->force;
 }
@@ -245,8 +247,11 @@ static int refspec_transform(
 {
 	const char *from_star, *to_star;
 	size_t replacement_len, star_offset;
+	int error;
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
-	git_buf_sanitize(out);
 	git_buf_clear(out);
 
 	/*
@@ -258,7 +263,7 @@ static int refspec_transform(
 	from_star = strchr(from, '*');
 	to_star = strchr(to, '*');
 
-	assert(from_star && to_star);
+	GIT_ASSERT(from_star && to_star);
 
 	/* star offset, both in 'from' and in 'name' */
 	star_offset = from_star - from;
@@ -278,8 +283,14 @@ static int refspec_transform(
 
 int git_refspec_transform(git_buf *out, const git_refspec *spec, const char *name)
 {
-	assert(out && spec && name);
-	git_buf_sanitize(out);
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(name);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	if (!git_refspec_src_matches(spec, name)) {
 		git_error_set(GIT_ERROR_INVALID, "ref '%s' doesn't match the source", name);
@@ -294,8 +305,14 @@ int git_refspec_transform(git_buf *out, const git_refspec *spec, const char *nam
 
 int git_refspec_rtransform(git_buf *out, const git_refspec *spec, const char *name)
 {
-	assert(out && spec && name);
-	git_buf_sanitize(out);
+	int error;
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(name);
+
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	if (!git_refspec_dst_matches(spec, name)) {
 		git_error_set(GIT_ERROR_INVALID, "ref '%s' doesn't match the destination", name);
@@ -322,14 +339,15 @@ int git_refspec__serialize(git_buf *out, const git_refspec *refspec)
 
 int git_refspec_is_wildcard(const git_refspec *spec)
 {
-	assert(spec && spec->src);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(spec->src);
 
 	return (spec->src[strlen(spec->src) - 1] == '*');
 }
 
 git_direction git_refspec_direction(const git_refspec *spec)
 {
-	assert(spec);
+	GIT_ASSERT_ARG(spec);
 
 	return spec->push;
 }
@@ -348,7 +366,9 @@ int git_refspec__dwim_one(git_vector *out, git_refspec *spec, git_vector *refs)
 		NULL
 	};
 
-	assert(out && spec && refs);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(refs);
 
 	cur = git__calloc(1, sizeof(git_refspec));
 	GIT_ERROR_CHECK_ALLOC(cur);
diff --git a/src/remote.c b/src/remote.c
index f63824861..29e15bbdf 100644
--- a/src/remote.c
+++ b/src/remote.c
@@ -210,7 +210,8 @@ int git_remote_create_with_opts(git_remote **out, const char *url, const git_rem
 	const git_remote_create_options dummy_opts = GIT_REMOTE_CREATE_OPTIONS_INIT;
 	int error = -1;
 
-	assert(out && url);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(url);
 
 	if (!opts) {
 		opts = &dummy_opts;
@@ -459,7 +460,9 @@ int git_remote_lookup(git_remote **out, git_repository *repo, const char *name)
 	struct refspec_cb_data data = { NULL };
 	bool optional_setting_found = false, found;
 
-	assert(out && repo && name);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = ensure_remote_name_is_valid(name)) < 0)
 		return error;
@@ -581,19 +584,19 @@ static int lookup_remote_prune_config(git_remote *remote, git_config *config, co
 
 const char *git_remote_name(const git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG_WITH_RETVAL(remote, NULL);
 	return remote->name;
 }
 
 git_repository *git_remote_owner(const git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG_WITH_RETVAL(remote, NULL);
 	return remote->repo;
 }
 
 const char *git_remote_url(const git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG_WITH_RETVAL(remote, NULL);
 	return remote->url;
 }
 
@@ -603,7 +606,8 @@ static int set_url(git_repository *repo, const char *remote, const char *pattern
 	git_buf buf = GIT_BUF_INIT, canonical_url = GIT_BUF_INIT;
 	int error;
 
-	assert(repo && remote);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(remote);
 
 	if ((error = ensure_remote_name_is_valid(remote)) < 0)
 		return error;
@@ -637,7 +641,7 @@ int git_remote_set_url(git_repository *repo, const char *remote, const char *url
 
 const char *git_remote_pushurl(const git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG_WITH_RETVAL(remote, NULL);
 	return remote->pushurl;
 }
 
@@ -648,14 +652,17 @@ int git_remote_set_pushurl(git_repository *repo, const char *remote, const char*
 
 static int resolve_url(git_buf *resolved_url, const char *url, int direction, const git_remote_callbacks *callbacks)
 {
-	int status;
+	int status, error;
 
 	if (callbacks && callbacks->resolve_url) {
 		git_buf_clear(resolved_url);
 		status = callbacks->resolve_url(resolved_url, url, direction, callbacks->payload);
 		if (status != GIT_PASSTHROUGH) {
 			git_error_set_after_callback_function(status, "git_resolve_url_cb");
-			git_buf_sanitize(resolved_url);
+
+			if ((error = git_buf_sanitize(resolved_url)) < 0)
+				return error;
+
 			return status;
 		}
 	}
@@ -667,8 +674,8 @@ int git_remote__urlfordirection(git_buf *url_out, struct git_remote *remote, int
 {
 	const char *url = NULL;
 
-	assert(remote);
-	assert(direction == GIT_DIRECTION_FETCH || direction == GIT_DIRECTION_PUSH);
+	GIT_ASSERT_ARG(remote);
+	GIT_ASSERT_ARG(direction == GIT_DIRECTION_FETCH || direction == GIT_DIRECTION_PUSH);
 
 	if (direction == GIT_DIRECTION_FETCH) {
 		url = remote->url;
@@ -713,7 +720,7 @@ int git_remote__connect(git_remote *remote, git_direction direction, const git_r
 	git_credential_acquire_cb credentials = NULL;
 	git_transport_cb transport = NULL;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (callbacks) {
 		GIT_ERROR_CHECK_VERSION(callbacks, GIT_REMOTE_CALLBACKS_VERSION, "git_remote_callbacks");
@@ -778,7 +785,7 @@ int git_remote_connect(git_remote *remote, git_direction direction, const git_re
 
 int git_remote_ls(const git_remote_head ***out, size_t *size, git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!remote->transport) {
 		git_error_set(GIT_ERROR_NET, "this remote has never connected");
@@ -795,7 +802,7 @@ int git_remote__get_http_proxy(git_remote *remote, bool use_ssl, char **proxy_ur
 	git_buf val = GIT_BUF_INIT;
 	int error;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!proxy_url || !remote->repo)
 		return -1;
@@ -924,7 +931,7 @@ int git_remote_download(git_remote *remote, const git_strarray *refspecs, const
 	const git_strarray *custom_headers = NULL;
 	const git_proxy_options *proxy = NULL;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!remote->repo) {
 		git_error_set(GIT_ERROR_INVALID, "cannot download detached remote");
@@ -1063,7 +1070,8 @@ static int remote_head_for_fetchspec_src(git_remote_head **out, git_vector *upda
 	unsigned int i;
 	git_remote_head *remote_ref;
 
-	assert(update_heads && fetchspec_src);
+	GIT_ASSERT_ARG(update_heads);
+	GIT_ASSERT_ARG(fetchspec_src);
 
 	*out = NULL;
 
@@ -1117,7 +1125,9 @@ static int remote_head_for_ref(git_remote_head **out, git_remote *remote, git_re
 	const char *ref_name;
 	int error = 0, update;
 
-	assert(out && spec && ref);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(spec);
+	GIT_ASSERT_ARG(ref);
 
 	*out = NULL;
 
@@ -1154,7 +1164,7 @@ static int git_remote_write_fetchhead(git_remote *remote, git_refspec *spec, git
 	unsigned int i = 0;
 	int error = 0;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	/* no heads, nothing to do */
 	if (update_heads->length == 0)
@@ -1370,7 +1380,7 @@ static int update_tips_for_spec(
 	git_refspec tagspec;
 	git_vector update_heads;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (git_repository_odb__weakptr(&odb, remote->repo) < 0)
 		return -1;
@@ -1674,7 +1684,7 @@ out:
 
 int git_remote_connected(const git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!remote->transport || !remote->transport->is_connected)
 		return 0;
@@ -1685,7 +1695,7 @@ int git_remote_connected(const git_remote *remote)
 
 int git_remote_stop(git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (remote->transport && remote->transport->cancel)
 		remote->transport->cancel(remote->transport);
@@ -1695,7 +1705,7 @@ int git_remote_stop(git_remote *remote)
 
 int git_remote_disconnect(git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (git_remote_connected(remote))
 		remote->transport->close(remote->transport);
@@ -1781,7 +1791,7 @@ int git_remote_list(git_strarray *remotes_list, git_repository *repo)
 
 const git_indexer_progress *git_remote_stats(git_remote *remote)
 {
-	assert(remote);
+	GIT_ASSERT_ARG_WITH_RETVAL(remote, NULL);
 	return &remote->stats;
 }
 
@@ -1796,7 +1806,7 @@ int git_remote_set_autotag(git_repository *repo, const char *remote, git_remote_
 	git_config *config;
 	int error;
 
-	assert(repo && remote);
+	GIT_ASSERT_ARG(repo && remote);
 
 	if ((error = ensure_remote_name_is_valid(remote)) < 0)
 		return error;
@@ -2060,7 +2070,7 @@ int git_remote_rename(git_strarray *out, git_repository *repo, const char *name,
 	git_vector problem_refspecs = GIT_VECTOR_INIT;
 	git_remote *remote = NULL;
 
-	assert(out && repo && name && new_name);
+	GIT_ASSERT_ARG(out && repo && name && new_name);
 
 	if ((error = git_remote_lookup(&remote, repo, name)) < 0)
 		return error;
@@ -2236,7 +2246,7 @@ static const char *name_offset(size_t *len_out, const char *name)
 	prefix_len = strlen("remote.");
 	dot = strchr(name + prefix_len, '.');
 
-	assert(dot);
+	GIT_ASSERT_ARG_WITH_RETVAL(dot, NULL);
 
 	*len_out = dot - name - prefix_len;
 	return name + prefix_len;
@@ -2266,10 +2276,13 @@ static int remove_branch_config_related_entries(
 		if (strcmp(remote_name, entry->value))
 			continue;
 
-		branch = name_offset(&branch_len, entry->name);
+		if ((branch = name_offset(&branch_len, entry->name)) == NULL) {
+			error = -1;
+			break;
+		}
 
 		git_buf_clear(&buf);
-		if (git_buf_printf(&buf, "branch.%.*s.merge", (int)branch_len, branch) < 0)
+		if ((error = git_buf_printf(&buf, "branch.%.*s.merge", (int)branch_len, branch)) < 0)
 			break;
 
 		if ((error = git_config_delete_entry(config, git_buf_cstr(&buf))) < 0) {
@@ -2279,7 +2292,7 @@ static int remove_branch_config_related_entries(
 		}
 
 		git_buf_clear(&buf);
-		if (git_buf_printf(&buf, "branch.%.*s.remote", (int)branch_len, branch) < 0)
+		if ((error = git_buf_printf(&buf, "branch.%.*s.remote", (int)branch_len, branch)) < 0)
 			break;
 
 		if ((error = git_config_delete_entry(config, git_buf_cstr(&buf))) < 0) {
@@ -2374,7 +2387,8 @@ int git_remote_delete(git_repository *repo, const char *name)
 {
 	int error;
 
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = remove_branch_config_related_entries(repo, name)) < 0 ||
 	    (error = remove_remote_tracking(repo, name)) < 0 ||
@@ -2393,7 +2407,7 @@ int git_remote_default_branch(git_buf *out, git_remote *remote)
 	git_buf local_default = GIT_BUF_INIT;
 	int error;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	if ((error = git_remote_ls(&heads, &heads_len, remote)) < 0)
 		goto done;
@@ -2403,7 +2417,8 @@ int git_remote_default_branch(git_buf *out, git_remote *remote)
 		goto done;
 	}
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	/* the first one must be HEAD so if that has the symref info, we're done */
 	if (heads[0]->symref_target) {
@@ -2461,7 +2476,7 @@ int git_remote_upload(git_remote *remote, const git_strarray *refspecs, const gi
 	const git_remote_callbacks *cbs = NULL;
 	git_remote_connection_opts conn = GIT_REMOTE_CONNECTION_OPTIONS_INIT;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!remote->repo) {
 		git_error_set(GIT_ERROR_INVALID, "cannot download detached remote");
@@ -2527,7 +2542,7 @@ int git_remote_push(git_remote *remote, const git_strarray *refspecs, const git_
 	const git_strarray *custom_headers = NULL;
 	const git_proxy_options *proxy = NULL;
 
-	assert(remote);
+	GIT_ASSERT_ARG(remote);
 
 	if (!remote->repo) {
 		git_error_set(GIT_ERROR_INVALID, "cannot download detached remote");
@@ -2542,8 +2557,6 @@ int git_remote_push(git_remote *remote, const git_strarray *refspecs, const git_
 		proxy = &opts->proxy_opts;
 	}
 
-	assert(remote);
-
 	if ((error = git_remote_connect(remote, GIT_DIRECTION_PUSH, cbs, proxy, custom_headers)) < 0)
 		return error;
 
@@ -2570,9 +2583,9 @@ char *apply_insteadof(git_config *config, const char *url, int direction)
 	git_config_entry *entry;
 	git_config_iterator *iter;
 
-	assert(config);
-	assert(url);
-	assert(direction == GIT_DIRECTION_FETCH || direction == GIT_DIRECTION_PUSH);
+	GIT_ASSERT_ARG_WITH_RETVAL(config, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(url, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(direction == GIT_DIRECTION_FETCH || direction == GIT_DIRECTION_PUSH, NULL);
 
 	/* Add 1 to prefix/suffix length due to the additional escaped dot */
 	prefix_length = strlen(PREFIX) + 1;
diff --git a/src/repository.c b/src/repository.c
index f0d4b06aa..697d6dfe9 100644
--- a/src/repository.c
+++ b/src/repository.c
@@ -142,7 +142,7 @@ static void set_index(git_repository *repo, git_index *index)
 
 int git_repository__cleanup(git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	git_repository_submodule_cache_clear(repo);
 	git_cache_clear(&repo->objects);
@@ -368,7 +368,7 @@ static size_t find_ceiling_dir_offset(
 	const char *ceil, *sep;
 	size_t len, max_len = 0, min_len;
 
-	assert(path);
+	GIT_ASSERT_ARG(path);
 
 	min_len = (size_t)(git_path_root(path) + 1);
 
@@ -414,7 +414,8 @@ static int read_gitfile(git_buf *path_out, const char *file_path)
 	git_buf file = GIT_BUF_INIT;
 	size_t  prefix_len = strlen(GIT_FILE_CONTENT_PREFIX);
 
-	assert(path_out && file_path);
+	GIT_ASSERT_ARG(path_out);
+	GIT_ASSERT_ARG(file_path);
 
 	if (git_futils_readbuffer(&file, file_path) < 0)
 		return -1;
@@ -901,7 +902,8 @@ int git_repository_open_from_worktree(git_repository **repo_out, git_worktree *w
 	size_t len;
 	int err;
 
-	assert(repo_out && wt);
+	GIT_ASSERT_ARG(repo_out);
+	GIT_ASSERT_ARG(wt);
 
 	*repo_out = NULL;
 	len = strlen(wt->gitlink_path);
@@ -945,10 +947,12 @@ int git_repository_discover(
 	const char *ceiling_dirs)
 {
 	uint32_t flags = across_fs ? GIT_REPOSITORY_OPEN_CROSS_FS : 0;
+	int error;
 
-	assert(start_path);
+	GIT_ASSERT_ARG(start_path);
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	return find_repo(out, NULL, NULL, NULL, start_path, flags, ceiling_dirs);
 }
@@ -965,7 +969,7 @@ static int load_config(
 	git_buf config_path = GIT_BUF_INIT;
 	git_config *cfg = NULL;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	if ((error = git_config_new(&cfg)) < 0)
 		return error;
@@ -1089,7 +1093,9 @@ int git_repository_config_snapshot(git_config **out, git_repository *repo)
 
 int git_repository_set_config(git_repository *repo, git_config *config)
 {
-	assert(repo && config);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(config);
+
 	set_config(repo, config);
 	return 0;
 }
@@ -1098,7 +1104,8 @@ int git_repository_odb__weakptr(git_odb **out, git_repository *repo)
 {
 	int error = 0;
 
-	assert(repo && out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(out);
 
 	if (repo->_odb == NULL) {
 		git_buf odb_path = GIT_BUF_INIT;
@@ -1141,7 +1148,9 @@ int git_repository_odb(git_odb **out, git_repository *repo)
 
 int git_repository_set_odb(git_repository *repo, git_odb *odb)
 {
-	assert(repo && odb);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(odb);
+
 	set_odb(repo, odb);
 	return 0;
 }
@@ -1150,7 +1159,8 @@ int git_repository_refdb__weakptr(git_refdb **out, git_repository *repo)
 {
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	if (repo->_refdb == NULL) {
 		git_refdb *refdb;
@@ -1182,7 +1192,9 @@ int git_repository_refdb(git_refdb **out, git_repository *repo)
 
 int git_repository_set_refdb(git_repository *repo, git_refdb *refdb)
 {
-	assert(repo && refdb);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(refdb);
+
 	set_refdb(repo, refdb);
 	return 0;
 }
@@ -1191,7 +1203,8 @@ int git_repository_index__weakptr(git_index **out, git_repository *repo)
 {
 	int error = 0;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	if (repo->_index == NULL) {
 		git_buf index_path = GIT_BUF_INIT;
@@ -1232,7 +1245,7 @@ int git_repository_index(git_index **out, git_repository *repo)
 
 int git_repository_set_index(git_repository *repo, git_index *index)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 	set_index(repo, index);
 	return 0;
 }
@@ -2130,7 +2143,9 @@ int git_repository_init_ext(
 	bool is_valid;
 	int error;
 
-	assert(out && given_repo && opts);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(given_repo);
+	GIT_ASSERT_ARG(opts);
 
 	GIT_ERROR_CHECK_VERSION(opts, GIT_REPOSITORY_INIT_OPTIONS_VERSION, "git_repository_init_options");
 
@@ -2206,7 +2221,8 @@ int git_repository_head_detached_for_worktree(git_repository *repo, const char *
 	git_reference *ref = NULL;
 	int error;
 
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = git_repository_head_for_worktree(&ref, repo, name)) < 0)
 		goto out;
@@ -2223,7 +2239,7 @@ int git_repository_head(git_reference **head_out, git_repository *repo)
 	git_reference *head;
 	int error;
 
-	assert(head_out);
+	GIT_ASSERT_ARG(head_out);
 
 	if ((error = git_reference_lookup(&head, repo, GIT_HEAD_FILE)) < 0)
 		return error;
@@ -2246,7 +2262,9 @@ int git_repository_head_for_worktree(git_reference **out, git_repository *repo,
 	git_reference *head = NULL;
 	int error;
 
-	assert(out && repo && name);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	*out = NULL;
 
@@ -2460,13 +2478,13 @@ int git_repository_item_path(git_buf *out, const git_repository *repo, git_repos
 
 const char *git_repository_path(const git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
 	return repo->gitdir;
 }
 
 const char *git_repository_workdir(const git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
 
 	if (repo->is_bare)
 		return NULL;
@@ -2476,7 +2494,7 @@ const char *git_repository_workdir(const git_repository *repo)
 
 const char *git_repository_commondir(const git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG_WITH_RETVAL(repo, NULL);
 	return repo->commondir;
 }
 
@@ -2486,7 +2504,8 @@ int git_repository_set_workdir(
 	int error = 0;
 	git_buf path = GIT_BUF_INIT;
 
-	assert(repo && workdir);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(workdir);
 
 	if (git_path_prettify_dir(&path, workdir, NULL) < 0)
 		return -1;
@@ -2526,13 +2545,13 @@ int git_repository_set_workdir(
 
 int git_repository_is_bare(const git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 	return repo->is_bare;
 }
 
 int git_repository_is_worktree(const git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 	return repo->is_worktree;
 }
 
@@ -2541,7 +2560,7 @@ int git_repository_set_bare(git_repository *repo)
 	int error;
 	git_config *config;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if (repo->is_bare)
 		return 0;
@@ -2609,7 +2628,8 @@ int git_repository_message(git_buf *out, git_repository *repo)
 	struct stat st;
 	int error;
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	if (git_buf_joinpath(&path, repo->gitdir, GIT_MERGE_MSG_FILE) < 0)
 		return -1;
@@ -2654,7 +2674,10 @@ int git_repository_hashfile(
 	uint64_t len;
 	git_buf full_path = GIT_BUF_INIT;
 
-	assert(out && path && repo); /* as_path can be NULL */
+	 /* as_path can be NULL */
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(path);
+	GIT_ASSERT_ARG(repo);
 
 	/* At some point, it would be nice if repo could be NULL to just
 	 * apply filter rules defined in system and global files, but for
@@ -2739,7 +2762,8 @@ static int detach(git_repository *repo, const git_oid *id, const char *new)
 	git_object *object = NULL, *peeled = NULL;
 	git_reference *new_head = NULL, *current = NULL;
 
-	assert(repo && id);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(id);
 
 	if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
 		return error;
@@ -2775,7 +2799,8 @@ int git_repository_set_head(
 	git_buf log_message = GIT_BUF_INIT;
 	int error;
 
-	assert(repo && refname);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(refname);
 
 	if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
 		return error;
@@ -2827,7 +2852,8 @@ int git_repository_set_head_detached_from_annotated(
 	git_repository *repo,
 	const git_annotated_commit *commitish)
 {
-	assert(repo && commitish);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(commitish);
 
 	return detach(repo, git_annotated_commit_id(commitish), commitish->description);
 }
@@ -2839,7 +2865,7 @@ int git_repository_detach_head(git_repository* repo)
 	git_buf log_message = GIT_BUF_INIT;
 	int error;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = git_reference_lookup(&current, repo, GIT_HEAD_FILE)) < 0)
 		return error;
@@ -2874,7 +2900,7 @@ int git_repository_state(git_repository *repo)
 	git_buf repo_path = GIT_BUF_INIT;
 	int state = GIT_REPOSITORY_STATE_NONE;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if (git_buf_puts(&repo_path, repo->gitdir) < 0)
 		return -1;
@@ -2951,7 +2977,7 @@ static const char *state_files[] = {
 
 int git_repository_state_cleanup(git_repository *repo)
 {
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	return git_repository__cleanup_files(repo, state_files, ARRAY_SIZE(state_files));
 }
@@ -3030,7 +3056,7 @@ int git_repository_submodule_cache_all(git_repository *repo)
 {
 	int error;
 
-	assert(repo);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = git_strmap_new(&repo->submodule_cache)))
 		return error;
@@ -3042,7 +3068,9 @@ int git_repository_submodule_cache_all(git_repository *repo)
 int git_repository_submodule_cache_clear(git_repository *repo)
 {
 	git_submodule *sm;
-	assert(repo);
+
+	GIT_ASSERT_ARG(repo);
+
 	if (repo->submodule_cache == NULL) {
 		return 0;
 	}
diff --git a/src/reset.c b/src/reset.c
index ca6a5bd73..dfae91d6f 100644
--- a/src/reset.c
+++ b/src/reset.c
@@ -33,7 +33,7 @@ int git_reset_default(
 	int error;
 	git_index *index = NULL;
 
-	assert(pathspecs != NULL && pathspecs->count > 0);
+	GIT_ASSERT_ARG(pathspecs && pathspecs->count > 0);
 
 	memset(&entry, 0, sizeof(git_index_entry));
 
@@ -62,10 +62,10 @@ int git_reset_default(
 	for (i = 0, max_i = git_diff_num_deltas(diff); i < max_i; ++i) {
 		const git_diff_delta *delta = git_diff_get_delta(diff, i);
 
-		assert(delta->status == GIT_DELTA_ADDED ||
-			delta->status == GIT_DELTA_MODIFIED ||
-			delta->status == GIT_DELTA_CONFLICTED ||
-			delta->status == GIT_DELTA_DELETED);
+		GIT_ASSERT(delta->status == GIT_DELTA_ADDED ||
+		           delta->status == GIT_DELTA_MODIFIED ||
+		           delta->status == GIT_DELTA_CONFLICTED ||
+		           delta->status == GIT_DELTA_DELETED);
 
 		error = git_index_conflict_remove(index, delta->old_file.path);
 		if (error < 0) {
@@ -113,7 +113,8 @@ static int reset(
 	git_checkout_options opts = GIT_CHECKOUT_OPTIONS_INIT;
 	git_buf log_message = GIT_BUF_INIT;
 
-	assert(repo && target);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(target);
 
 	if (checkout_opts)
 		opts = *checkout_opts;
diff --git a/src/revert.c b/src/revert.c
index b84bc7d79..683f0d70d 100644
--- a/src/revert.c
+++ b/src/revert.c
@@ -129,7 +129,10 @@ int git_revert_commit(
 	git_tree *parent_tree = NULL, *our_tree = NULL, *revert_tree = NULL;
 	int parent = 0, error = 0;
 
-	assert(out && repo && revert_commit && our_commit);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(revert_commit);
+	GIT_ASSERT_ARG(our_commit);
 
 	if (git_commit_parentcount(revert_commit) > 1) {
 		if (!mainline)
@@ -180,7 +183,8 @@ int git_revert(
 	git_indexwriter indexwriter = GIT_INDEXWRITER_INIT;
 	int error;
 
-	assert(repo && commit);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(commit);
 
 	GIT_ERROR_CHECK_VERSION(given_opts, GIT_REVERT_OPTIONS_VERSION, "git_revert_options");
 
diff --git a/src/revparse.c b/src/revparse.c
index 1cc8b97f5..4b919d32a 100644
--- a/src/revparse.c
+++ b/src/revparse.c
@@ -317,7 +317,7 @@ static int handle_at_syntax(git_object **out, git_reference **ref, const char *s
 	git_buf identifier = GIT_BUF_INIT;
 	git_time_t timestamp;
 
-	assert(*out == NULL);
+	GIT_ASSERT(*out == NULL);
 
 	if (git_buf_put(&identifier, spec, identifier_len) < 0)
 		return -1;
@@ -524,7 +524,7 @@ static int extract_curly_braces_content(git_buf *buf, const char *spec, size_t *
 {
 	git_buf_clear(buf);
 
-	assert(spec[*pos] == '^' || spec[*pos] == '@');
+	GIT_ASSERT_ARG(spec[*pos] == '^' || spec[*pos] == '@');
 
 	(*pos)++;
 
@@ -550,7 +550,7 @@ static int extract_path(git_buf *buf, const char *spec, size_t *pos)
 {
 	git_buf_clear(buf);
 
-	assert(spec[*pos] == ':');
+	GIT_ASSERT_ARG(spec[*pos] == ':');
 
 	(*pos)++;
 
@@ -568,7 +568,7 @@ static int extract_how_many(int *n, const char *spec, size_t *pos)
 	int parsed, accumulated;
 	char kind = spec[*pos];
 
-	assert(spec[*pos] == '^' || spec[*pos] == '~');
+	GIT_ASSERT_ARG(spec[*pos] == '^' || spec[*pos] == '~');
 
 	accumulated = 0;
 
@@ -676,7 +676,10 @@ static int revparse(
 
 	bool should_return_reference = true;
 
-	assert(object_out && reference_out && repo && spec);
+	GIT_ASSERT_ARG(object_out);
+	GIT_ASSERT_ARG(reference_out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(spec);
 
 	*object_out = NULL;
 	*reference_out = NULL;
@@ -882,7 +885,9 @@ int git_revparse(
 	const char *dotdot;
 	int error = 0;
 
-	assert(revspec && repo && spec);
+	GIT_ASSERT_ARG(revspec);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(spec);
 
 	memset(revspec, 0x0, sizeof(*revspec));
 
diff --git a/src/revwalk.c b/src/revwalk.c
index 1efb938bd..249cb16bf 100644
--- a/src/revwalk.c
+++ b/src/revwalk.c
@@ -99,7 +99,8 @@ int git_revwalk_push(git_revwalk *walk, const git_oid *oid)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
 
-	assert(walk && oid);
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(oid);
 
 	return git_revwalk__push_commit(walk, oid, &opts);
 }
@@ -108,7 +109,9 @@ int git_revwalk_push(git_revwalk *walk, const git_oid *oid)
 int git_revwalk_hide(git_revwalk *walk, const git_oid *oid)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk && oid);
+
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(oid);
 
 	opts.uninteresting = 1;
 	return git_revwalk__push_commit(walk, oid, &opts);
@@ -133,7 +136,8 @@ int git_revwalk__push_glob(git_revwalk *walk, const char *glob, const git_revwal
 	git_reference_iterator *iter;
 	size_t wildcard;
 
-	assert(walk && glob);
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(glob);
 
 	if (given_opts)
 		memcpy(&opts, given_opts, sizeof(opts));
@@ -172,7 +176,9 @@ out:
 int git_revwalk_push_glob(git_revwalk *walk, const char *glob)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk && glob);
+
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(glob);
 
 	return git_revwalk__push_glob(walk, glob, &opts);
 }
@@ -180,7 +186,9 @@ int git_revwalk_push_glob(git_revwalk *walk, const char *glob)
 int git_revwalk_hide_glob(git_revwalk *walk, const char *glob)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk && glob);
+
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(glob);
 
 	opts.uninteresting = 1;
 	return git_revwalk__push_glob(walk, glob, &opts);
@@ -189,7 +197,8 @@ int git_revwalk_hide_glob(git_revwalk *walk, const char *glob)
 int git_revwalk_push_head(git_revwalk *walk)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk);
+
+	GIT_ASSERT_ARG(walk);
 
 	return git_revwalk__push_ref(walk, GIT_HEAD_FILE, &opts);
 }
@@ -197,7 +206,8 @@ int git_revwalk_push_head(git_revwalk *walk)
 int git_revwalk_hide_head(git_revwalk *walk)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk);
+
+	GIT_ASSERT_ARG(walk);
 
 	opts.uninteresting = 1;
 	return git_revwalk__push_ref(walk, GIT_HEAD_FILE, &opts);
@@ -206,7 +216,9 @@ int git_revwalk_hide_head(git_revwalk *walk)
 int git_revwalk_push_ref(git_revwalk *walk, const char *refname)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk && refname);
+
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(refname);
 
 	return git_revwalk__push_ref(walk, refname, &opts);
 }
@@ -249,7 +261,10 @@ out:
 int git_revwalk_hide_ref(git_revwalk *walk, const char *refname)
 {
 	git_revwalk__push_options opts = GIT_REVWALK__PUSH_OPTIONS_INIT;
-	assert(walk && refname);
+
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(refname);
+
 	opts.uninteresting = 1;
 	return git_revwalk__push_ref(walk, refname, &opts);
 }
@@ -694,13 +709,14 @@ void git_revwalk_free(git_revwalk *walk)
 
 git_repository *git_revwalk_repository(git_revwalk *walk)
 {
-	assert(walk);
+	GIT_ASSERT_ARG_WITH_RETVAL(walk, NULL);
+
 	return walk->repo;
 }
 
 int git_revwalk_sorting(git_revwalk *walk, unsigned int sort_mode)
 {
-	assert(walk);
+	GIT_ASSERT_ARG(walk);
 
 	if (walk->walking)
 		git_revwalk_reset(walk);
@@ -732,7 +748,8 @@ int git_revwalk_next(git_oid *oid, git_revwalk *walk)
 	int error;
 	git_commit_list_node *next;
 
-	assert(walk && oid);
+	GIT_ASSERT_ARG(walk);
+	GIT_ASSERT_ARG(oid);
 
 	if (!walk->walking) {
 		if ((error = prepare_walk(walk)) < 0)
@@ -757,7 +774,7 @@ int git_revwalk_reset(git_revwalk *walk)
 {
 	git_commit_list_node *commit;
 
-	assert(walk);
+	GIT_ASSERT_ARG(walk);
 
 	git_oidmap_foreach_value(walk->commits, commit, {
 		commit->seen = 0;
@@ -787,7 +804,7 @@ int git_revwalk_add_hide_cb(
 	git_revwalk_hide_cb hide_cb,
 	void *payload)
 {
-	assert(walk);
+	GIT_ASSERT_ARG(walk);
 
 	if (walk->walking)
 		git_revwalk_reset(walk);
diff --git a/src/signature.c b/src/signature.c
index f4c8a104a..1efda212a 100644
--- a/src/signature.c
+++ b/src/signature.c
@@ -65,7 +65,8 @@ int git_signature_new(git_signature **sig_out, const char *name, const char *ema
 {
 	git_signature *p = NULL;
 
-	assert(name && email);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(email);
 
 	*sig_out = NULL;
 
@@ -279,7 +280,8 @@ int git_signature_from_buffer(git_signature **out, const char *buf)
 	const char *buf_end;
 	int error;
 
-	assert(out && buf);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(buf);
 
 	*out = NULL;
 
@@ -302,8 +304,6 @@ void git_signature__writebuf(git_buf *buf, const char *header, const git_signatu
 	int offset, hours, mins;
 	char sign;
 
-	assert(buf && sig);
-
 	offset = sig->when.offset;
 	sign = (sig->when.offset < 0 || sig->when.sign == '-') ? '-' : '+';
 
@@ -320,7 +320,8 @@ void git_signature__writebuf(git_buf *buf, const char *header, const git_signatu
 
 bool git_signature__equal(const git_signature *one, const git_signature *two)
 {
-	assert(one && two);
+	GIT_ASSERT_ARG(one);
+	GIT_ASSERT_ARG(two);
 
 	return
 		git__strcmp(one->name, two->name) == 0 &&
diff --git a/src/stash.c b/src/stash.c
index 0d5dc4351..8ee127322 100644
--- a/src/stash.c
+++ b/src/stash.c
@@ -546,7 +546,9 @@ int git_stash_save(
 	git_buf msg = GIT_BUF_INIT;
 	int error;
 
-	assert(out && repo && stasher);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(stasher);
 
 	if ((error = git_repository__ensure_not_bare(repo, "stash save")) < 0)
 		return error;
diff --git a/src/status.c b/src/status.c
index eca1f4912..c98564643 100644
--- a/src/status.c
+++ b/src/status.c
@@ -391,14 +391,14 @@ done:
 
 size_t git_status_list_entrycount(git_status_list *status)
 {
-	assert(status);
+	GIT_ASSERT_ARG_WITH_RETVAL(status, 0);
 
 	return status->paired.length;
 }
 
 const git_status_entry *git_status_byindex(git_status_list *status, size_t i)
 {
-	assert(status);
+	GIT_ASSERT_ARG_WITH_RETVAL(status, NULL);
 
 	return git_vector_get(&status->paired, i);
 }
@@ -492,7 +492,9 @@ int git_status_file(
 	struct status_file_info sfi = {0};
 	git_index *index;
 
-	assert(status_flags && repo && path);
+	GIT_ASSERT_ARG(status_flags);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(path);
 
 	if ((error = git_repository_index__weakptr(&index, repo)) < 0)
 		return error;
@@ -558,7 +560,8 @@ int git_status_init_options(git_status_options *opts, unsigned int version)
 int git_status_list_get_perfdata(
 	git_diff_perfdata *out, const git_status_list *status)
 {
-	assert(out);
+	GIT_ASSERT_ARG(out);
+
 	GIT_ERROR_CHECK_VERSION(out, GIT_DIFF_PERFDATA_VERSION, "git_diff_perfdata");
 
 	out->stat_calls = 0;
diff --git a/src/strarray.c b/src/strarray.c
index 54fe9fbfb..2f9b77cc2 100644
--- a/src/strarray.c
+++ b/src/strarray.c
@@ -13,7 +13,8 @@ int git_strarray_copy(git_strarray *tgt, const git_strarray *src)
 {
 	size_t i;
 
-	assert(tgt && src);
+	GIT_ASSERT_ARG(tgt);
+	GIT_ASSERT_ARG(src);
 
 	memset(tgt, 0, sizeof(*tgt));
 
diff --git a/src/streams/mbedtls.c b/src/streams/mbedtls.c
index 00daa5521..22b9f47df 100644
--- a/src/streams/mbedtls.c
+++ b/src/streams/mbedtls.c
@@ -181,8 +181,8 @@ static int ssl_set_error(mbedtls_ssl_context *ssl, int error)
 	char errbuf[512];
 	int ret = -1;
 
-	assert(error != MBEDTLS_ERR_SSL_WANT_READ);
-	assert(error != MBEDTLS_ERR_SSL_WANT_WRITE);
+	GIT_ASSERT(error != MBEDTLS_ERR_SSL_WANT_READ);
+	GIT_ASSERT(error != MBEDTLS_ERR_SSL_WANT_WRITE);
 
 	if (error != 0)
 		mbedtls_strerror( error, errbuf, 512 );
@@ -423,7 +423,9 @@ int git_mbedtls_stream_new(
 	git_stream *stream;
 	int error;
 
-	assert(out && host && port);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
 
 	if ((error = git_socket_stream_new(&stream, host, port)) < 0)
 		return error;
@@ -442,7 +444,7 @@ int git_mbedtls__set_cert_location(const char *path, int is_dir)
 	char errbuf[512];
 	mbedtls_x509_crt *cacert;
 
-	assert(path != NULL);
+	GIT_ASSERT_ARG(path);
 
 	cacert = git__malloc(sizeof(mbedtls_x509_crt));
 	GIT_ERROR_CHECK_ALLOC(cacert);
diff --git a/src/streams/openssl.c b/src/streams/openssl.c
index 0a0c2c5e5..d866832c6 100644
--- a/src/streams/openssl.c
+++ b/src/streams/openssl.c
@@ -414,8 +414,8 @@ static int ssl_set_error(SSL *ssl, int error)
 
 	err = SSL_get_error(ssl, error);
 
-	assert(err != SSL_ERROR_WANT_READ);
-	assert(err != SSL_ERROR_WANT_WRITE);
+	GIT_ASSERT(err != SSL_ERROR_WANT_READ);
+	GIT_ASSERT(err != SSL_ERROR_WANT_WRITE);
 
 	switch (err) {
 	case SSL_ERROR_WANT_CONNECT:
@@ -757,7 +757,9 @@ static int openssl_stream_wrap(
 {
 	openssl_stream *st;
 
-	assert(out && in && host);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(in);
+	GIT_ASSERT_ARG(host);
 
 	st = git__calloc(1, sizeof(openssl_stream));
 	GIT_ERROR_CHECK_ALLOC(st);
@@ -800,7 +802,9 @@ int git_openssl_stream_new(git_stream **out, const char *host, const char *port)
 	git_stream *stream = NULL;
 	int error;
 
-	assert(out && host && port);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
 
 	if ((error = git_socket_stream_new(&stream, host, port)) < 0)
 		return error;
diff --git a/src/streams/registry.c b/src/streams/registry.c
index b3bf17a4e..e60e1cd63 100644
--- a/src/streams/registry.c
+++ b/src/streams/registry.c
@@ -51,7 +51,7 @@ int git_stream_registry_lookup(git_stream_registration *out, git_stream_t type)
 	git_stream_registration *target;
 	int error = GIT_ENOTFOUND;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	switch(type) {
 	case GIT_STREAM_STANDARD:
@@ -61,7 +61,7 @@ int git_stream_registry_lookup(git_stream_registration *out, git_stream_t type)
 		target = &stream_registry.tls_callbacks;
 		break;
 	default:
-		assert(0);
+		git_error_set(GIT_ERROR_INVALID, "invalid stream type");
 		return -1;
 	}
 
@@ -81,7 +81,7 @@ int git_stream_registry_lookup(git_stream_registration *out, git_stream_t type)
 
 int git_stream_register(git_stream_t type, git_stream_registration *registration)
 {
-	assert(!registration || registration->init);
+	GIT_ASSERT(!registration || registration->init);
 
 	GIT_ERROR_CHECK_VERSION(registration, GIT_STREAM_VERSION, "stream_registration");
 
diff --git a/src/streams/socket.c b/src/streams/socket.c
index 33f7883cd..9415fe892 100644
--- a/src/streams/socket.c
+++ b/src/streams/socket.c
@@ -183,7 +183,9 @@ static int default_socket_stream_new(
 {
 	git_socket_stream *st;
 
-	assert(out && host && port);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
 
 	st = git__calloc(1, sizeof(git_socket_stream));
 	GIT_ERROR_CHECK_ALLOC(st);
@@ -217,7 +219,9 @@ int git_socket_stream_new(
 	git_stream_registration custom = {0};
 	int error;
 
-	assert(out && host && port);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
 
 	if ((error = git_stream_registry_lookup(&custom, GIT_STREAM_STANDARD)) == 0)
 		init = custom.init;
diff --git a/src/streams/stransport.c b/src/streams/stransport.c
index a79d3cbf0..3f31d2541 100644
--- a/src/streams/stransport.c
+++ b/src/streams/stransport.c
@@ -167,7 +167,7 @@ static ssize_t stransport_write(git_stream *stream, const char *data, size_t len
 	if ((ret = SSLWrite(st->ctx, data, data_len, &processed)) != noErr)
 		return stransport_error(ret);
 
-	assert(processed < SSIZE_MAX);
+	GIT_ASSERT(processed < SSIZE_MAX);
 	return (ssize_t)processed;
 }
 
@@ -251,7 +251,9 @@ static int stransport_wrap(
 	stransport_stream *st;
 	OSStatus ret;
 
-	assert(out && in && host);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(in);
+	GIT_ASSERT_ARG(host);
 
 	st = git__calloc(1, sizeof(stransport_stream));
 	GIT_ERROR_CHECK_ALLOC(st);
@@ -305,7 +307,8 @@ int git_stransport_stream_new(git_stream **out, const char *host, const char *po
 	git_stream *stream = NULL;
 	int error;
 
-	assert(out && host);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
 
 	error = git_socket_stream_new(&stream, host, port);
 
diff --git a/src/streams/tls.c b/src/streams/tls.c
index 255a4a0f6..e063a33f9 100644
--- a/src/streams/tls.c
+++ b/src/streams/tls.c
@@ -20,7 +20,9 @@ int git_tls_stream_new(git_stream **out, const char *host, const char *port)
 	git_stream_registration custom = {0};
 	int error;
 
-	assert(out && host && port);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(host);
+	GIT_ASSERT_ARG(port);
 
 	if ((error = git_stream_registry_lookup(&custom, GIT_STREAM_TLS)) == 0) {
 		init = custom.init;
@@ -49,7 +51,8 @@ int git_tls_stream_wrap(git_stream **out, git_stream *in, const char *host)
 	int (*wrap)(git_stream **, git_stream *, const char *) = NULL;
 	git_stream_registration custom = {0};
 
-	assert(out && in);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(in);
 
 	if (git_stream_registry_lookup(&custom, GIT_STREAM_TLS) == 0) {
 		wrap = custom.wrap;
diff --git a/src/submodule.c b/src/submodule.c
index c32b9770a..0c901fa6f 100644
--- a/src/submodule.c
+++ b/src/submodule.c
@@ -258,7 +258,8 @@ int git_submodule_lookup(
 	unsigned int location;
 	git_submodule *sm;
 
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if (repo->is_bare) {
 		git_error_set(GIT_ERROR_SUBMODULE, "cannot get submodules without a working tree");
@@ -520,7 +521,8 @@ int git_submodule__map(git_repository *repo, git_strmap *map)
 	git_submodule *sm;
 	git_config *mods = NULL;
 
-	assert(repo && map);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(map);
 
 	/* get sources that we will need to check */
 	if (git_repository_index(&idx, repo) < 0)
@@ -698,7 +700,9 @@ int git_submodule_add_setup(
 	git_repository *subrepo = NULL;
 	bool path_occupied;
 
-	assert(repo && url && path);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(url);
+	GIT_ASSERT_ARG(path);
 
 	/* see if there is already an entry for this submodule */
 
@@ -799,7 +803,8 @@ int git_submodule_repo_init(
 	git_config *cfg = NULL;
 	git_buf buf = GIT_BUF_INIT;
 
-	assert(out && sm);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(sm);
 
 	/* get the configured remote url of the submodule */
 	if ((error = git_buf_printf(&buf, "submodule.%s.url", sm->name)) < 0 ||
@@ -840,7 +845,7 @@ int git_submodule_clone(git_repository **out, git_submodule *submodule, const gi
 	git_submodule_update_options sub_opts = GIT_SUBMODULE_UPDATE_OPTIONS_INIT;
 	git_clone_options opts = GIT_CLONE_OPTIONS_INIT;
 
-	assert(submodule);
+	GIT_ASSERT_ARG(submodule);
 
 	if (given_opts)
 		memcpy(&sub_opts, given_opts, sizeof(sub_opts));
@@ -879,7 +884,7 @@ int git_submodule_add_finalize(git_submodule *sm)
 	int error;
 	git_index *index;
 
-	assert(sm);
+	GIT_ASSERT_ARG(sm);
 
 	if ((error = git_repository_index__weakptr(&index, sm->repo)) < 0 ||
 		(error = git_index_add_bypath(index, GIT_MODULES_FILE)) < 0)
@@ -898,7 +903,7 @@ int git_submodule_add_to_index(git_submodule *sm, int write_index)
 	git_index_entry entry;
 	struct stat st;
 
-	assert(sm);
+	GIT_ASSERT_ARG(sm);
 
 	/* force reload of wd OID by git_submodule_open */
 	sm->flags = sm->flags & ~GIT_SUBMODULE_STATUS__WD_OID_VALID;
@@ -969,25 +974,25 @@ static const char *submodule_update_to_str(git_submodule_update_t update)
 
 git_repository *git_submodule_owner(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 	return submodule->repo;
 }
 
 const char *git_submodule_name(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 	return submodule->name;
 }
 
 const char *git_submodule_path(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 	return submodule->path;
 }
 
 const char *git_submodule_url(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 	return submodule->url;
 }
 
@@ -996,9 +1001,12 @@ int git_submodule_resolve_url(git_buf *out, git_repository *repo, const char *ur
 	int error = 0;
 	git_buf normalized = GIT_BUF_INIT;
 
-	assert(out && repo && url);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(url);
 
-	git_buf_sanitize(out);
+	if ((error = git_buf_sanitize(out)) < 0)
+		return error;
 
 	/* We do this in all platforms in case someone on Windows created the .gitmodules */
 	if (strchr(url, '\\')) {
@@ -1066,28 +1074,30 @@ static int write_mapped_var(git_repository *repo, const char *name, git_configma
 
 const char *git_submodule_branch(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 	return submodule->branch;
 }
 
 int git_submodule_set_branch(git_repository *repo, const char *name, const char *branch)
 {
-
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	return write_var(repo, name, "branch", branch);
 }
 
 int git_submodule_set_url(git_repository *repo, const char *name, const char *url)
 {
-	assert(repo && name && url);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(url);
 
 	return write_var(repo, name, "url", url);
 }
 
 const git_oid *git_submodule_index_id(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 
 	if (submodule->flags & GIT_SUBMODULE_STATUS__INDEX_OID_VALID)
 		return &submodule->index_oid;
@@ -1097,7 +1107,7 @@ const git_oid *git_submodule_index_id(git_submodule *submodule)
 
 const git_oid *git_submodule_head_id(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 
 	if (submodule->flags & GIT_SUBMODULE_STATUS__HEAD_OID_VALID)
 		return &submodule->head_oid;
@@ -1107,7 +1117,7 @@ const git_oid *git_submodule_head_id(git_submodule *submodule)
 
 const git_oid *git_submodule_wd_id(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, NULL);
 
 	/* load unless we think we have a valid oid */
 	if (!(submodule->flags & GIT_SUBMODULE_STATUS__WD_OID_VALID)) {
@@ -1128,28 +1138,32 @@ const git_oid *git_submodule_wd_id(git_submodule *submodule)
 
 git_submodule_ignore_t git_submodule_ignore(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, GIT_SUBMODULE_IGNORE_UNSPECIFIED);
+
 	return (submodule->ignore < GIT_SUBMODULE_IGNORE_NONE) ?
 		GIT_SUBMODULE_IGNORE_NONE : submodule->ignore;
 }
 
 int git_submodule_set_ignore(git_repository *repo, const char *name, git_submodule_ignore_t ignore)
 {
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	return write_mapped_var(repo, name, _sm_ignore_map, ARRAY_SIZE(_sm_ignore_map), "ignore", ignore);
 }
 
 git_submodule_update_t git_submodule_update_strategy(git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, GIT_SUBMODULE_UPDATE_NONE);
+
 	return (submodule->update < GIT_SUBMODULE_UPDATE_CHECKOUT) ?
 		GIT_SUBMODULE_UPDATE_CHECKOUT : submodule->update;
 }
 
 int git_submodule_set_update(git_repository *repo, const char *name, git_submodule_update_t update)
 {
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	return write_mapped_var(repo, name, _sm_update_map, ARRAY_SIZE(_sm_update_map), "update", update);
 }
@@ -1157,13 +1171,14 @@ int git_submodule_set_update(git_repository *repo, const char *name, git_submodu
 git_submodule_recurse_t git_submodule_fetch_recurse_submodules(
 	git_submodule *submodule)
 {
-	assert(submodule);
+	GIT_ASSERT_ARG_WITH_RETVAL(submodule, GIT_SUBMODULE_RECURSE_NO);
 	return submodule->fetch_recurse;
 }
 
 int git_submodule_set_fetch_recurse_submodules(git_repository *repo, const char *name, git_submodule_recurse_t recurse)
 {
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	return write_mapped_var(repo, name, _sm_recurse_map, ARRAY_SIZE(_sm_recurse_map), "fetchRecurseSubmodules", recurse);
 }
@@ -1260,7 +1275,7 @@ int git_submodule_update(git_submodule *sm, int init, git_submodule_update_optio
 	git_submodule_update_options update_options = GIT_SUBMODULE_UPDATE_OPTIONS_INIT;
 	git_clone_options clone_options = GIT_CLONE_OPTIONS_INIT;
 
-	assert(sm);
+	GIT_ASSERT_ARG(sm);
 
 	if (_update_options)
 		memcpy(&update_options, _update_options, sizeof(git_submodule_update_options));
@@ -1473,7 +1488,8 @@ static int git_submodule__open(
 	unsigned int flags = GIT_REPOSITORY_OPEN_NO_SEARCH;
 	const char *wd;
 
-	assert(sm && subrepo);
+	GIT_ASSERT_ARG(sm);
+	GIT_ASSERT_ARG(subrepo);
 
 	if (git_repository__ensure_not_bare(
 			sm->repo, "open submodule repository") < 0)
@@ -1609,7 +1625,7 @@ int git_submodule_reload(git_submodule *sm, int force)
 
 	GIT_UNUSED(force);
 
-	assert(sm);
+	GIT_ASSERT_ARG(sm);
 
 	if ((error = git_submodule_name_is_valid(sm->repo, sm->name, 0)) <= 0)
 		/* This should come with a warning, but we've no API for that */
@@ -1726,7 +1742,9 @@ int git_submodule_status(unsigned int *status, git_repository *repo, const char
 	git_submodule *sm;
 	int error;
 
-	assert(status && repo && name);
+	GIT_ASSERT_ARG(status);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	if ((error = git_submodule_lookup(&sm, repo, name)) < 0)
 		return error;
@@ -1739,7 +1757,8 @@ int git_submodule_status(unsigned int *status, git_repository *repo, const char
 
 int git_submodule_location(unsigned int *location, git_submodule *sm)
 {
-	assert(location && sm);
+	GIT_ASSERT_ARG(location);
+	GIT_ASSERT_ARG(sm);
 
 	return git_submodule__status(
 		location, NULL, NULL, NULL, sm, GIT_SUBMODULE_IGNORE_ALL);
diff --git a/src/sysdir.c b/src/sysdir.c
index 401b4a55e..dcbd48bc3 100644
--- a/src/sysdir.c
+++ b/src/sysdir.c
@@ -45,7 +45,7 @@ static int get_passwd_home(git_buf *out, uid_t uid)
 	long buflen;
 	int error;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	if ((buflen = sysconf(_SC_GETPW_R_SIZE_MAX)) == -1)
 		buflen = 1024;
@@ -204,7 +204,7 @@ static int git_sysdir_check_selector(git_sysdir_t which)
 
 int git_sysdir_get(const git_buf **out, git_sysdir_t which)
 {
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	*out = NULL;
 
diff --git a/src/tag.c b/src/tag.c
index 8a4d6eec8..ee91e5091 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -27,25 +27,25 @@ void git_tag__free(void *_tag)
 
 int git_tag_target(git_object **target, const git_tag *t)
 {
-	assert(t);
+	GIT_ASSERT_ARG(t);
 	return git_object_lookup(target, t->object.repo, &t->target, t->type);
 }
 
 const git_oid *git_tag_target_id(const git_tag *t)
 {
-	assert(t);
+	GIT_ASSERT_ARG_WITH_RETVAL(t, NULL);
 	return &t->target;
 }
 
 git_object_t git_tag_target_type(const git_tag *t)
 {
-	assert(t);
+	GIT_ASSERT_ARG_WITH_RETVAL(t, GIT_OBJECT_INVALID);
 	return t->type;
 }
 
 const char *git_tag_name(const git_tag *t)
 {
-	assert(t);
+	GIT_ASSERT_ARG_WITH_RETVAL(t, NULL);
 	return t->tag_name;
 }
 
@@ -56,7 +56,7 @@ const git_signature *git_tag_tagger(const git_tag *t)
 
 const char *git_tag_message(const git_tag *t)
 {
-	assert(t);
+	GIT_ASSERT_ARG_WITH_RETVAL(t, NULL);
 	return t->message;
 }
 
@@ -259,8 +259,10 @@ static int git_tag_create__internal(
 
 	int error;
 
-	assert(repo && tag_name && target);
-	assert(!create_tag_annotation || (tagger && message));
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(tag_name);
+	GIT_ASSERT_ARG(target);
+	GIT_ASSERT_ARG(!create_tag_annotation || (tagger && message));
 
 	if (git_object_owner(target) != repo) {
 		git_error_set(GIT_ERROR_INVALID, "the given target does not belong to this repository");
@@ -313,7 +315,12 @@ int git_tag_annotation_create(
 	const git_signature *tagger,
 	const char *message)
 {
-	assert(oid && repo && tag_name && target && tagger && message);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(tag_name);
+	GIT_ASSERT_ARG(target);
+	GIT_ASSERT_ARG(tagger);
+	GIT_ASSERT_ARG(message);
 
 	return write_tag_annotation(oid, repo, tag_name, target, tagger, message);
 }
@@ -339,7 +346,8 @@ int git_tag_create_from_buffer(git_oid *oid, git_repository *repo, const char *b
 	git_reference *new_ref = NULL;
 	git_buf ref_name = GIT_BUF_INIT;
 
-	assert(oid && buffer);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(buffer);
 
 	memset(&tag, 0, sizeof(tag));
 
@@ -454,7 +462,8 @@ int git_tag_foreach(git_repository *repo, git_tag_foreach_cb cb, void *cb_data)
 {
 	tag_cb_data data;
 
-	assert(repo && cb);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(cb);
 
 	data.cb = cb;
 	data.cb_data = cb_data;
@@ -493,7 +502,9 @@ int git_tag_list_match(git_strarray *tag_names, const char *pattern, git_reposit
 	tag_filter_data filter;
 	git_vector taglist;
 
-	assert(tag_names && repo && pattern);
+	GIT_ASSERT_ARG(tag_names);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(pattern);
 
 	if ((error = git_vector_init(&taglist, 8, NULL)) < 0)
 		return error;
diff --git a/src/trace.c b/src/trace.c
index 3acb64398..efc7b01a2 100644
--- a/src/trace.c
+++ b/src/trace.c
@@ -20,7 +20,7 @@ struct git_trace_data git_trace__data = {0};
 int git_trace_set(git_trace_level_t level, git_trace_cb callback)
 {
 #ifdef GIT_TRACE
-	assert(level == 0 || callback != NULL);
+	GIT_ASSERT_ARG(level == 0 || callback != NULL);
 
 	git_trace__data.level = level;
 	git_trace__data.callback = callback;
diff --git a/src/transaction.c b/src/transaction.c
index 81af8d831..98fa1ba90 100644
--- a/src/transaction.c
+++ b/src/transaction.c
@@ -57,7 +57,9 @@ struct git_transaction {
 int git_transaction_config_new(git_transaction **out, git_config *cfg)
 {
 	git_transaction *tx;
-	assert(out && cfg);
+
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(cfg);
 
 	tx = git__calloc(1, sizeof(git_transaction));
 	GIT_ERROR_CHECK_ALLOC(tx);
@@ -74,7 +76,8 @@ int git_transaction_new(git_transaction **out, git_repository *repo)
 	git_pool pool;
 	git_transaction *tx = NULL;
 
-	assert(out && repo);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
 
 	if ((error = git_pool_init(&pool, 1)) < 0)
 		goto on_error;
@@ -109,7 +112,8 @@ int git_transaction_lock_ref(git_transaction *tx, const char *refname)
 	int error;
 	transaction_node *node;
 
-	assert(tx && refname);
+	GIT_ASSERT_ARG(tx);
+	GIT_ASSERT_ARG(refname);
 
 	node = git_pool_mallocz(&tx->pool, sizeof(transaction_node));
 	GIT_ERROR_CHECK_ALLOC(node);
@@ -176,7 +180,9 @@ int git_transaction_set_target(git_transaction *tx, const char *refname, const g
 	int error;
 	transaction_node *node;
 
-	assert(tx && refname && target);
+	GIT_ASSERT_ARG(tx);
+	GIT_ASSERT_ARG(refname);
+	GIT_ASSERT_ARG(target);
 
 	if ((error = find_locked(&node, tx, refname)) < 0)
 		return error;
@@ -195,7 +201,9 @@ int git_transaction_set_symbolic_target(git_transaction *tx, const char *refname
 	int error;
 	transaction_node *node;
 
-	assert(tx && refname && target);
+	GIT_ASSERT_ARG(tx);
+	GIT_ASSERT_ARG(refname);
+	GIT_ASSERT_ARG(target);
 
 	if ((error = find_locked(&node, tx, refname)) < 0)
 		return error;
@@ -272,7 +280,9 @@ int git_transaction_set_reflog(git_transaction *tx, const char *refname, const g
 	int error;
 	transaction_node *node;
 
-	assert(tx && refname && reflog);
+	GIT_ASSERT_ARG(tx);
+	GIT_ASSERT_ARG(refname);
+	GIT_ASSERT_ARG(reflog);
 
 	if ((error = find_locked(&node, tx, refname)) < 0)
 		return error;
@@ -320,7 +330,7 @@ int git_transaction_commit(git_transaction *tx)
 	transaction_node *node;
 	int error = 0;
 
-	assert(tx);
+	GIT_ASSERT_ARG(tx);
 
 	if (tx->type == TRANSACTION_CONFIG) {
 		error = git_config_unlock(tx->cfg, true);
@@ -355,7 +365,8 @@ void git_transaction_free(git_transaction *tx)
 	transaction_node *node;
 	git_pool pool;
 
-	assert(tx);
+	if (!tx)
+		return;
 
 	if (tx->type == TRANSACTION_CONFIG) {
 		if (tx->cfg) {
diff --git a/src/transport.c b/src/transport.c
index 227ee7dee..e128aa6c7 100644
--- a/src/transport.c
+++ b/src/transport.c
@@ -148,8 +148,8 @@ int git_transport_register(
 	size_t i;
 	int error = 0;
 
-	assert(scheme);
-	assert(cb);
+	GIT_ASSERT_ARG(scheme);
+	GIT_ASSERT_ARG(cb);
 
 	if ((error = git_buf_printf(&prefix, "%s://", scheme)) < 0)
 		goto on_error;
@@ -186,7 +186,7 @@ int git_transport_unregister(const char *scheme)
 	size_t i;
 	int error = 0;
 
-	assert(scheme);
+	GIT_ASSERT_ARG(scheme);
 
 	if ((error = git_buf_printf(&prefix, "%s://", scheme)) < 0)
 		goto done;
diff --git a/src/transports/auth_negotiate.c b/src/transports/auth_negotiate.c
index 8a614b81a..c538dbbca 100644
--- a/src/transports/auth_negotiate.c
+++ b/src/transports/auth_negotiate.c
@@ -65,7 +65,9 @@ static int negotiate_set_challenge(
 {
 	http_auth_negotiate_context *ctx = (http_auth_negotiate_context *)c;
 
-	assert(ctx && ctx->configured && challenge);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(challenge);
+	GIT_ASSERT(ctx->configured);
 
 	git__free(ctx->challenge);
 
@@ -108,7 +110,12 @@ static int negotiate_next_token(
 	size_t challenge_len;
 	int error = 0;
 
-	assert(buf && ctx && ctx->configured && cred && cred->credtype == GIT_CREDENTIAL_DEFAULT);
+	GIT_ASSERT_ARG(buf);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(cred);
+
+	GIT_ASSERT(ctx->configured);
+	GIT_ASSERT(cred->credtype == GIT_CREDENTIAL_DEFAULT);
 
 	if (ctx->complete)
 		return 0;
@@ -202,7 +209,7 @@ static int negotiate_is_complete(git_http_auth_context *c)
 {
 	http_auth_negotiate_context *ctx = (http_auth_negotiate_context *)c;
 
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 
 	return (ctx->complete == 1);
 }
diff --git a/src/transports/auth_ntlm.c b/src/transports/auth_ntlm.c
index d134a3db6..e0960bf9d 100644
--- a/src/transports/auth_ntlm.c
+++ b/src/transports/auth_ntlm.c
@@ -29,7 +29,8 @@ static int ntlm_set_challenge(
 {
 	http_auth_ntlm_context *ctx = (http_auth_ntlm_context *)c;
 
-	assert(ctx && challenge);
+	GIT_ASSERT_ARG(ctx);
+	GIT_ASSERT_ARG(challenge);
 
 	git__free(ctx->challenge);
 
@@ -46,7 +47,7 @@ static int ntlm_set_credentials(http_auth_ntlm_context *ctx, git_credential *_cr
 	char *domain = NULL, *domainuser = NULL;
 	int error = 0;
 
-	assert(_cred->credtype == GIT_CREDENTIAL_USERPASS_PLAINTEXT);
+	GIT_ASSERT(_cred->credtype == GIT_CREDENTIAL_USERPASS_PLAINTEXT);
 	cred = (git_credential_userpass_plaintext *)_cred;
 
 	if ((sep = strchr(cred->username, '\\')) != NULL) {
@@ -86,7 +87,10 @@ static int ntlm_next_token(
 	size_t challenge_len, msg_len;
 	int error = -1;
 
-	assert(buf && ctx && ctx->ntlm);
+	GIT_ASSERT_ARG(buf);
+	GIT_ASSERT_ARG(ctx);
+
+	GIT_ASSERT(ctx->ntlm);
 
 	challenge_len = ctx->challenge ? strlen(ctx->challenge) : 0;
 
@@ -162,7 +166,7 @@ static int ntlm_is_complete(git_http_auth_context *c)
 {
 	http_auth_ntlm_context *ctx = (http_auth_ntlm_context *)c;
 
-	assert(ctx);
+	GIT_ASSERT_ARG(ctx);
 	return (ctx->complete == true);
 }
 
diff --git a/src/transports/credential.c b/src/transports/credential.c
index 7b2836445..6e00b0282 100644
--- a/src/transports/credential.c
+++ b/src/transports/credential.c
@@ -85,7 +85,9 @@ int git_credential_userpass_plaintext_new(
 {
 	git_credential_userpass_plaintext *c;
 
-	assert(cred && username && password);
+	GIT_ASSERT_ARG(cred);
+	GIT_ASSERT_ARG(username);
+	GIT_ASSERT_ARG(password);
 
 	c = git__malloc(sizeof(git_credential_userpass_plaintext));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -233,7 +235,9 @@ static int git_credential_ssh_key_type_new(
 {
 	git_credential_ssh_key *c;
 
-	assert(username && cred && privatekey);
+	GIT_ASSERT_ARG(username);
+	GIT_ASSERT_ARG(cred);
+	GIT_ASSERT_ARG(privatekey);
 
 	c = git__calloc(1, sizeof(git_credential_ssh_key));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -269,7 +273,9 @@ int git_credential_ssh_interactive_new(
 {
 	git_credential_ssh_interactive *c;
 
-	assert(out && username && prompt_callback);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(username);
+	GIT_ASSERT_ARG(prompt_callback);
 
 	c = git__calloc(1, sizeof(git_credential_ssh_interactive));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -290,7 +296,8 @@ int git_credential_ssh_interactive_new(
 int git_credential_ssh_key_from_agent(git_credential **cred, const char *username) {
 	git_credential_ssh_key *c;
 
-	assert(username && cred);
+	GIT_ASSERT_ARG(username);
+	GIT_ASSERT_ARG(cred);
 
 	c = git__calloc(1, sizeof(git_credential_ssh_key));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -317,7 +324,8 @@ int git_credential_ssh_custom_new(
 {
 	git_credential_ssh_custom *c;
 
-	assert(username && cred);
+	GIT_ASSERT_ARG(username);
+	GIT_ASSERT_ARG(cred);
 
 	c = git__calloc(1, sizeof(git_credential_ssh_custom));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -347,7 +355,7 @@ int git_credential_default_new(git_credential **cred)
 {
 	git_credential_default *c;
 
-	assert(cred);
+	GIT_ASSERT_ARG(cred);
 
 	c = git__calloc(1, sizeof(git_credential_default));
 	GIT_ERROR_CHECK_ALLOC(c);
@@ -364,7 +372,7 @@ int git_credential_username_new(git_credential **cred, const char *username)
 	git_credential_username *c;
 	size_t len, allocsize;
 
-	assert(cred);
+	GIT_ASSERT_ARG(cred);
 
 	len = strlen(username);
 
diff --git a/src/transports/git.c b/src/transports/git.c
index e48b7f961..7c93155a8 100644
--- a/src/transports/git.c
+++ b/src/transports/git.c
@@ -327,7 +327,7 @@ static int _git_close(git_smart_subtransport *subtransport)
 {
 	git_subtransport *t = (git_subtransport *) subtransport;
 
-	assert(!t->current_stream);
+	GIT_ASSERT(!t->current_stream);
 
 	GIT_UNUSED(t);
 
@@ -338,8 +338,6 @@ static void _git_free(git_smart_subtransport *subtransport)
 {
 	git_subtransport *t = (git_subtransport *) subtransport;
 
-	assert(!t->current_stream);
-
 	git__free(t);
 }
 
diff --git a/src/transports/http.c b/src/transports/http.c
index fb1740c33..4538dd143 100644
--- a/src/transports/http.c
+++ b/src/transports/http.c
@@ -416,7 +416,7 @@ static int http_stream_read(
 		goto done;
 	}
 
-	assert (stream->state == HTTP_STATE_RECEIVING_RESPONSE);
+	GIT_ASSERT(stream->state == HTTP_STATE_RECEIVING_RESPONSE);
 
 	error = git_http_client_read_body(transport->http_client, buffer, buffer_size);
 
@@ -554,7 +554,7 @@ static int http_stream_write(
 		goto done;
 	}
 
-	assert(stream->state == HTTP_STATE_SENDING_REQUEST);
+	GIT_ASSERT(stream->state == HTTP_STATE_SENDING_REQUEST);
 
 	error = git_http_client_send_body(transport->http_client, buffer, len);
 
@@ -588,7 +588,7 @@ static int http_stream_read_response(
 		    (error = handle_response(&complete, stream, &response, false)) < 0)
 		    goto done;
 
-		assert(complete);
+		GIT_ASSERT(complete);
 		stream->state = HTTP_STATE_RECEIVING_RESPONSE;
 	}
 
@@ -637,7 +637,8 @@ static int http_action(
 	const http_service *service;
 	int error;
 
-	assert(out && t);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(t);
 
 	*out = NULL;
 
@@ -720,7 +721,7 @@ int git_smart_subtransport_http(git_smart_subtransport **out, git_transport *own
 
 	GIT_UNUSED(param);
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	transport = git__calloc(sizeof(http_subtransport), 1);
 	GIT_ERROR_CHECK_ALLOC(transport);
diff --git a/src/transports/httpclient.c b/src/transports/httpclient.c
index 6ec22f837..d9cbf1783 100644
--- a/src/transports/httpclient.c
+++ b/src/transports/httpclient.c
@@ -145,7 +145,8 @@ bool git_http_response_is_redirect(git_http_response *response)
 
 void git_http_response_dispose(git_http_response *response)
 {
-	assert(response);
+	if (!response)
+		return;
 
 	git__free(response->content_type);
 	git__free(response->location);
@@ -399,7 +400,7 @@ static int on_body(http_parser *parser, const char *buf, size_t len)
 		return 0;
 	}
 
-	assert(ctx->output_size >= ctx->output_written);
+	GIT_ASSERT(ctx->output_size >= ctx->output_written);
 
 	max_len = min(ctx->output_size - ctx->output_written, len);
 	max_len = min(max_len, INT_MAX);
@@ -665,7 +666,8 @@ static int generate_request(
 	size_t i;
 	int error;
 
-	assert(client && request);
+	GIT_ASSERT_ARG(client);
+	GIT_ASSERT_ARG(request);
 
 	git_buf_clear(&client->request_msg);
 	buf = &client->request_msg;
@@ -842,7 +844,10 @@ static int setup_hosts(
 {
 	int ret, diff = 0;
 
-	assert(client && request && request->url);
+	GIT_ASSERT_ARG(client);
+	GIT_ASSERT_ARG(request);
+
+	GIT_ASSERT(request->url);
 
 	if ((ret = server_setup_from_url(&client->server, request->url)) < 0)
 		return ret;
@@ -922,7 +927,7 @@ static int proxy_connect(
 	    (error = git_http_client_skip_body(client)) < 0)
 		goto done;
 
-	assert(client->state == DONE);
+	GIT_ASSERT(client->state == DONE);
 
 	if (response.status == GIT_HTTP_STATUS_PROXY_AUTHENTICATION_REQUIRED) {
 		save_early_response(client, &response);
@@ -1137,7 +1142,7 @@ GIT_INLINE(int) client_read_and_parse(git_http_client *client)
 		 * final byte when paused in a callback.  Consume that byte.
 		 * https://github.com/nodejs/http-parser/issues/97
 		 */
-		assert(client->read_buf.size > parsed_len);
+		GIT_ASSERT(client->read_buf.size > parsed_len);
 
 		http_parser_pause(parser, 0);
 
@@ -1215,7 +1220,8 @@ int git_http_client_send_request(
 	git_http_response response = {0};
 	int error = -1;
 
-	assert(client && request);
+	GIT_ASSERT_ARG(client);
+	GIT_ASSERT_ARG(request);
 
 	/* If the client did not finish reading, clean up the stream. */
 	if (client->state == READING_BODY)
@@ -1286,7 +1292,7 @@ int git_http_client_send_body(
 	git_buf hdr = GIT_BUF_INIT;
 	int error;
 
-	assert(client);
+	GIT_ASSERT_ARG(client);
 
 	/* If we're waiting for proxy auth, don't sending more requests. */
 	if (client->state == HAS_EARLY_RESPONSE)
@@ -1303,7 +1309,7 @@ int git_http_client_send_body(
 	server = &client->server;
 
 	if (client->request_body_len) {
-		assert(buffer_len <= client->request_body_remain);
+		GIT_ASSERT(buffer_len <= client->request_body_remain);
 
 		if ((error = stream_write(server, buffer, buffer_len)) < 0)
 			goto done;
@@ -1326,7 +1332,8 @@ static int complete_request(git_http_client *client)
 {
 	int error = 0;
 
-	assert(client && client->state == SENDING_BODY);
+	GIT_ASSERT_ARG(client);
+	GIT_ASSERT(client->state == SENDING_BODY);
 
 	if (client->request_body_len && client->request_body_remain) {
 		git_error_set(GIT_ERROR_HTTP, "truncated write");
@@ -1346,7 +1353,8 @@ int git_http_client_read_response(
 	http_parser_context parser_context = {0};
 	int error;
 
-	assert(response && client);
+	GIT_ASSERT_ARG(response);
+	GIT_ASSERT_ARG(client);
 
 	if (client->state == SENDING_BODY) {
 		if ((error = complete_request(client)) < 0)
@@ -1386,7 +1394,7 @@ int git_http_client_read_response(
 			goto done;
 	}
 
-	assert(client->state == READING_BODY || client->state == DONE);
+	GIT_ASSERT(client->state == READING_BODY || client->state == DONE);
 
 done:
 	git_buf_dispose(&parser_context.parse_header_name);
@@ -1439,7 +1447,7 @@ int git_http_client_read_body(
 			break;
 	}
 
-	assert(parser_context.output_written <= INT_MAX);
+	GIT_ASSERT(parser_context.output_written <= INT_MAX);
 	error = (int)parser_context.output_written;
 
 done:
@@ -1493,7 +1501,7 @@ int git_http_client_new(
 {
 	git_http_client *client;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	client = git__calloc(1, sizeof(git_http_client));
 	GIT_ERROR_CHECK_ALLOC(client);
diff --git a/src/transports/local.c b/src/transports/local.c
index 210de9f74..4af85db81 100644
--- a/src/transports/local.c
+++ b/src/transports/local.c
@@ -158,7 +158,7 @@ static int store_refs(transport_local *t)
 	git_remote_head *head;
 	git_strarray ref_names = {0};
 
-	assert(t);
+	GIT_ASSERT_ARG(t);
 
 	if (git_reference_list(&ref_names, t->repo) < 0)
 		goto on_error;
diff --git a/src/transports/smart.c b/src/transports/smart.c
index 5f5919407..3b8a14a4c 100644
--- a/src/transports/smart.c
+++ b/src/transports/smart.c
@@ -18,7 +18,7 @@ static int git_smart__recv_cb(gitno_buffer *buf)
 	size_t old_len, bytes_read;
 	int error;
 
-	assert(t->current_stream);
+	GIT_ASSERT(t->current_stream);
 
 	old_len = buf->offset;
 
@@ -346,7 +346,7 @@ int git_smart__negotiation_step(git_transport *transport, void *data, size_t len
 		return error;
 
 	/* If this is a stateful implementation, the stream we get back should be the same */
-	assert(t->rpc || t->current_stream == stream);
+	GIT_ASSERT(t->rpc || t->current_stream == stream);
 
 	/* Save off the current stream (i.e. socket) that we are working with */
 	t->current_stream = stream;
@@ -375,7 +375,7 @@ int git_smart__get_push_stream(transport_smart *t, git_smart_subtransport_stream
 		return error;
 
 	/* If this is a stateful implementation, the stream we get back should be the same */
-	assert(t->rpc || t->current_stream == *stream);
+	GIT_ASSERT(t->rpc || t->current_stream == *stream);
 
 	/* Save off the current stream (i.e. socket) that we are working with */
 	t->current_stream = *stream;
@@ -481,7 +481,9 @@ int git_transport_smart_certificate_check(git_transport *transport, git_cert *ce
 {
 	transport_smart *t = GIT_CONTAINER_OF(transport, transport_smart, parent);
 
-	assert(transport && cert && hostname);
+	GIT_ASSERT_ARG(transport);
+	GIT_ASSERT_ARG(cert);
+	GIT_ASSERT_ARG(hostname);
 
 	if (!t->certificate_check_cb)
 		return GIT_PASSTHROUGH;
@@ -493,7 +495,8 @@ int git_transport_smart_credentials(git_credential **out, git_transport *transpo
 {
 	transport_smart *t = GIT_CONTAINER_OF(transport, transport_smart, parent);
 
-	assert(out && transport);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(transport);
 
 	if (!t->cred_acquire_cb)
 		return GIT_PASSTHROUGH;
diff --git a/src/transports/smart_protocol.c b/src/transports/smart_protocol.c
index c01656dc4..18dcaa879 100644
--- a/src/transports/smart_protocol.c
+++ b/src/transports/smart_protocol.c
@@ -64,7 +64,9 @@ int git_smart__store_refs(transport_smart *t, int flushes)
 			continue;
 		}
 
-		gitno_consume(buf, line_end);
+		if (gitno_consume(buf, line_end) < 0)
+			return -1;
+
 		if (pkt->type == GIT_PKT_ERR) {
 			git_error_set(GIT_ERROR_NET, "remote error: %s", ((git_pkt_err *)pkt)->error);
 			git__free(pkt);
@@ -236,7 +238,9 @@ static int recv_pkt(git_pkt **out_pkt, git_pkt_type *out_type, gitno_buffer *buf
 		}
 	} while (error);
 
-	gitno_consume(buf, line_end);
+	if (gitno_consume(buf, line_end) < 0)
+		return -1;
+
 	if (out_type != NULL)
 		*out_type = pkt->type;
 	if (out_pkt != NULL)
@@ -791,7 +795,8 @@ static int parse_report(transport_smart *transport, git_push *push)
 			continue;
 		}
 
-		gitno_consume(buf, line_end);
+		if (gitno_consume(buf, line_end) < 0)
+			return -1;
 
 		error = 0;
 
diff --git a/src/transports/ssh.c b/src/transports/ssh.c
index f4ed05bb1..b7efd5ceb 100644
--- a/src/transports/ssh.c
+++ b/src/transports/ssh.c
@@ -238,7 +238,7 @@ static int ssh_stream_alloc(
 {
 	ssh_stream *s;
 
-	assert(stream);
+	GIT_ASSERT_ARG(stream);
 
 	s = git__calloc(sizeof(ssh_stream), 1);
 	GIT_ERROR_CHECK_ALLOC(s);
@@ -404,8 +404,8 @@ static int _git_ssh_authenticate_session(
 		case GIT_CREDENTIAL_SSH_MEMORY: {
 			git_credential_ssh_key *c = (git_credential_ssh_key *)cred;
 
-			assert(c->username);
-			assert(c->privatekey);
+			GIT_ASSERT(c->username);
+			GIT_ASSERT(c->privatekey);
 
 			rc = libssh2_userauth_publickey_frommemory(
 				session,
@@ -483,7 +483,7 @@ static int _git_ssh_session_create(
 	LIBSSH2_SESSION* s;
 	git_socket_stream *socket = GIT_CONTAINER_OF(io, git_socket_stream, parent);
 
-	assert(session);
+	GIT_ASSERT_ARG(session);
 
 	s = libssh2_session_init();
 	if (!s) {
@@ -772,7 +772,7 @@ static int _ssh_close(git_smart_subtransport *subtransport)
 {
 	ssh_subtransport *t = GIT_CONTAINER_OF(subtransport, ssh_subtransport, parent);
 
-	assert(!t->current_stream);
+	GIT_ASSERT(!t->current_stream);
 
 	GIT_UNUSED(t);
 
@@ -783,8 +783,6 @@ static void _ssh_free(git_smart_subtransport *subtransport)
 {
 	ssh_subtransport *t = GIT_CONTAINER_OF(subtransport, ssh_subtransport, parent);
 
-	assert(!t->current_stream);
-
 	git__free(t->cmd_uploadpack);
 	git__free(t->cmd_receivepack);
 	git__free(t);
@@ -849,7 +847,7 @@ int git_smart_subtransport_ssh(
 #ifdef GIT_SSH
 	ssh_subtransport *t;
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 
 	GIT_UNUSED(param);
 
@@ -867,7 +865,7 @@ int git_smart_subtransport_ssh(
 	GIT_UNUSED(owner);
 	GIT_UNUSED(param);
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	*out = NULL;
 
 	git_error_set(GIT_ERROR_INVALID, "cannot create SSH transport. Library was built without SSH support");
@@ -911,7 +909,7 @@ int git_transport_ssh_with_paths(git_transport **out, git_remote *owner, void *p
 	GIT_UNUSED(owner);
 	GIT_UNUSED(payload);
 
-	assert(out);
+	GIT_ASSERT_ARG(out);
 	*out = NULL;
 
 	git_error_set(GIT_ERROR_INVALID, "cannot create SSH transport. Library was built without SSH support");
diff --git a/src/transports/winhttp.c b/src/transports/winhttp.c
index 2a1f6f26f..2b77ec9a7 100644
--- a/src/transports/winhttp.c
+++ b/src/transports/winhttp.c
@@ -1003,7 +1003,7 @@ replay:
 		}
 
 		if (s->chunked) {
-			assert(s->verb == post_verb);
+			GIT_ASSERT(s->verb == post_verb);
 
 			/* Flush, if necessary */
 			if (s->chunk_buffer_len > 0 &&
@@ -1054,7 +1054,7 @@ replay:
 				}
 
 				len -= bytes_read;
-				assert(bytes_read == bytes_written);
+				GIT_ASSERT(bytes_read == bytes_written);
 			}
 
 			git__free(buffer);
@@ -1166,7 +1166,7 @@ replay:
 			if (error < 0) {
 				return error;
 			} else if (!error) {
-				assert(t->server.cred);
+				GIT_ASSERT(t->server.cred);
 				winhttp_stream_close(s);
 				goto replay;
 			}
@@ -1180,7 +1180,7 @@ replay:
 			if (error < 0) {
 				return error;
 			} else if (!error) {
-				assert(t->proxy.cred);
+				GIT_ASSERT(t->proxy.cred);
 				winhttp_stream_close(s);
 				goto replay;
 			}
@@ -1266,7 +1266,7 @@ static int winhttp_stream_write_single(
 		return -1;
 	}
 
-	assert((DWORD)len == bytes_written);
+	GIT_ASSERT((DWORD)len == bytes_written);
 
 	return 0;
 }
@@ -1365,7 +1365,7 @@ static int winhttp_stream_write_buffered(
 		return -1;
 	}
 
-	assert((DWORD)len == bytes_written);
+	GIT_ASSERT((DWORD)len == bytes_written);
 
 	s->post_body_len += bytes_written;
 
@@ -1572,7 +1572,7 @@ static int winhttp_action(
 			break;
 
 		default:
-			assert(0);
+			GIT_ASSERT(0);
 	}
 
 	if (!ret)
diff --git a/src/tree.c b/src/tree.c
index 48468dff6..ba6383ef8 100644
--- a/src/tree.c
+++ b/src/tree.c
@@ -228,7 +228,7 @@ int git_tree_entry_dup(git_tree_entry **dest, const git_tree_entry *source)
 {
 	git_tree_entry *cpy;
 
-	assert(source);
+	GIT_ASSERT_ARG(source);
 
 	cpy = alloc_entry(source->filename, source->filename_len, source->oid);
 	if (cpy == NULL)
@@ -261,19 +261,19 @@ git_filemode_t git_tree_entry_filemode_raw(const git_tree_entry *entry)
 
 const char *git_tree_entry_name(const git_tree_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return entry->filename;
 }
 
 const git_oid *git_tree_entry_id(const git_tree_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, NULL);
 	return entry->oid;
 }
 
 git_object_t git_tree_entry_type(const git_tree_entry *entry)
 {
-	assert(entry);
+	GIT_ASSERT_ARG_WITH_RETVAL(entry, GIT_OBJECT_INVALID);
 
 	if (S_ISGITLINK(entry->attr))
 		return GIT_OBJECT_COMMIT;
@@ -288,7 +288,9 @@ int git_tree_entry_to_object(
 	git_repository *repo,
 	const git_tree_entry *entry)
 {
-	assert(entry && object_out);
+	GIT_ASSERT_ARG(entry);
+	GIT_ASSERT_ARG(object_out);
+
 	return git_object_lookup(object_out, repo, entry->oid, GIT_OBJECT_ANY);
 }
 
@@ -306,7 +308,8 @@ static const git_tree_entry *entry_fromname(
 const git_tree_entry *git_tree_entry_byname(
 	const git_tree *tree, const char *filename)
 {
-	assert(tree && filename);
+	GIT_ASSERT_ARG_WITH_RETVAL(tree, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(filename, NULL);
 
 	return entry_fromname(tree, filename, strlen(filename));
 }
@@ -314,7 +317,7 @@ const git_tree_entry *git_tree_entry_byname(
 const git_tree_entry *git_tree_entry_byindex(
 	const git_tree *tree, size_t idx)
 {
-	assert(tree);
+	GIT_ASSERT_ARG_WITH_RETVAL(tree, NULL);
 	return git_array_get(tree->entries, idx);
 }
 
@@ -324,7 +327,7 @@ const git_tree_entry *git_tree_entry_byid(
 	size_t i;
 	const git_tree_entry *e;
 
-	assert(tree);
+	GIT_ASSERT_ARG_WITH_RETVAL(tree, NULL);
 
 	git_array_foreach(tree->entries, i, e) {
 		if (memcmp(&e->oid->id, &id->id, sizeof(id->id)) == 0)
@@ -336,13 +339,13 @@ const git_tree_entry *git_tree_entry_byid(
 
 size_t git_tree_entrycount(const git_tree *tree)
 {
-	assert(tree);
+	GIT_ASSERT_ARG_WITH_RETVAL(tree, 0);
 	return tree->entries.size;
 }
 
 size_t git_treebuilder_entrycount(git_treebuilder *bld)
 {
-	assert(bld);
+	GIT_ASSERT_ARG_WITH_RETVAL(bld, 0);
 
 	return git_strmap_size(bld->map);
 }
@@ -626,7 +629,9 @@ int git_tree__write_index(
 	git_buf shared_buf = GIT_BUF_INIT;
 	bool old_ignore_case = false;
 
-	assert(oid && index && repo);
+	GIT_ASSERT_ARG(oid);
+	GIT_ASSERT_ARG(index);
+	GIT_ASSERT_ARG(repo);
 
 	if (git_index_has_conflicts(index)) {
 		git_error_set(GIT_ERROR_INDEX,
@@ -680,7 +685,8 @@ int git_treebuilder_new(
 	git_treebuilder *bld;
 	size_t i;
 
-	assert(builder_p && repo);
+	GIT_ASSERT_ARG(builder_p);
+	GIT_ASSERT_ARG(repo);
 
 	bld = git__calloc(1, sizeof(git_treebuilder));
 	GIT_ERROR_CHECK_ALLOC(bld);
@@ -723,7 +729,9 @@ int git_treebuilder_insert(
 	git_tree_entry *entry;
 	int error;
 
-	assert(bld && id && filename);
+	GIT_ASSERT_ARG(bld);
+	GIT_ASSERT_ARG(id);
+	GIT_ASSERT_ARG(filename);
 
 	if ((error = check_entry(bld->repo, filename, id, filemode)) < 0)
 		return error;
@@ -751,7 +759,9 @@ int git_treebuilder_insert(
 
 static git_tree_entry *treebuilder_get(git_treebuilder *bld, const char *filename)
 {
-	assert(bld && filename);
+	GIT_ASSERT_ARG_WITH_RETVAL(bld, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(filename, NULL);
+
 	return git_strmap_get(bld->map, filename);
 }
 
@@ -792,8 +802,8 @@ int git_treebuilder_write_with_buffer(git_oid *oid, git_treebuilder *bld, git_bu
 	git_tree_entry *entry;
 	git_vector entries = GIT_VECTOR_INIT;
 
-	assert(bld);
-	assert(tree);
+	GIT_ASSERT_ARG(bld);
+	GIT_ASSERT_ARG(tree);
 
 	git_buf_clear(tree);
 
@@ -842,7 +852,8 @@ int git_treebuilder_filter(
 	const char *filename;
 	git_tree_entry *entry;
 
-	assert(bld && filter);
+	GIT_ASSERT_ARG(bld);
+	GIT_ASSERT_ARG(filter);
 
 	git_strmap_foreach(bld->map, filename, entry, {
 			if (filter(entry, payload)) {
@@ -858,7 +869,7 @@ int git_treebuilder_clear(git_treebuilder *bld)
 {
 	git_tree_entry *e;
 
-	assert(bld);
+	GIT_ASSERT_ARG(bld);
 
 	git_strmap_foreach_value(bld->map, e, git_tree_entry_free(e));
 	git_strmap_clear(bld->map);
@@ -1174,10 +1185,10 @@ int git_tree_create_updated(git_oid *out, git_repository *repo, git_tree *baseli
 
 		for (j = 0; j < steps_up; j++) {
 			tree_stack_entry *current, *popped = git_array_pop(stack);
-			assert(popped);
+			GIT_ASSERT(popped);
 
 			current = git_array_last(stack);
-			assert(current);
+			GIT_ASSERT(current);
 
 			if ((error = create_popped_tree(current, popped, &component)) < 0)
 				goto cleanup;
diff --git a/src/tsort.c b/src/tsort.c
index 8d1ed9787..045efad23 100644
--- a/src/tsort.c
+++ b/src/tsort.c
@@ -29,8 +29,6 @@ static int binsearch(
 	int l, c, r;
 	void *lx, *cx;
 
-	assert(size > 0);
-
 	l = 0;
 	r = (int)size - 1;
 	c = r >> 1;
diff --git a/src/unix/map.c b/src/unix/map.c
index 7f9076e19..62c52578b 100644
--- a/src/unix/map.c
+++ b/src/unix/map.c
@@ -66,7 +66,7 @@ int p_mmap(git_map *out, size_t len, int prot, int flags, int fd, off64_t offset
 
 int p_munmap(git_map *map)
 {
-	assert(map != NULL);
+	GIT_ASSERT_ARG(map);
 	munmap(map->data, map->len);
 
 	return 0;
diff --git a/src/vector.c b/src/vector.c
index b51e7644b..4a4bc8c0e 100644
--- a/src/vector.c
+++ b/src/vector.c
@@ -53,7 +53,8 @@ int git_vector_size_hint(git_vector *v, size_t size_hint)
 
 int git_vector_dup(git_vector *v, const git_vector *src, git_vector_cmp cmp)
 {
-	assert(v && src);
+	GIT_ASSERT_ARG(v);
+	GIT_ASSERT_ARG(src);
 
 	v->_alloc_size = 0;
 	v->contents = NULL;
@@ -77,7 +78,8 @@ int git_vector_dup(git_vector *v, const git_vector *src, git_vector_cmp cmp)
 
 void git_vector_free(git_vector *v)
 {
-	assert(v);
+	if (!v)
+		return;
 
 	git__free(v->contents);
 	v->contents = NULL;
@@ -90,7 +92,8 @@ void git_vector_free_deep(git_vector *v)
 {
 	size_t i;
 
-	assert(v);
+	if (!v)
+		return;
 
 	for (i = 0; i < v->length; ++i) {
 		git__free(v->contents[i]);
@@ -102,7 +105,7 @@ void git_vector_free_deep(git_vector *v)
 
 int git_vector_init(git_vector *v, size_t initial_size, git_vector_cmp cmp)
 {
-	assert(v);
+	GIT_ASSERT_ARG(v);
 
 	v->_alloc_size = 0;
 	v->_cmp = cmp;
@@ -131,7 +134,7 @@ void **git_vector_detach(size_t *size, size_t *asize, git_vector *v)
 
 int git_vector_insert(git_vector *v, void *element)
 {
-	assert(v);
+	GIT_ASSERT_ARG(v);
 
 	if (v->length >= v->_alloc_size &&
 		resize_vector(v, compute_new_size(v)) < 0)
@@ -150,7 +153,8 @@ int git_vector_insert_sorted(
 	int result;
 	size_t pos;
 
-	assert(v && v->_cmp);
+	GIT_ASSERT_ARG(v);
+	GIT_ASSERT(v->_cmp);
 
 	if (!git_vector_is_sorted(v))
 		git_vector_sort(v);
@@ -180,8 +184,6 @@ int git_vector_insert_sorted(
 
 void git_vector_sort(git_vector *v)
 {
-	assert(v);
-
 	if (git_vector_is_sorted(v) || !v->_cmp)
 		return;
 
@@ -196,7 +198,9 @@ int git_vector_bsearch2(
 	git_vector_cmp key_lookup,
 	const void *key)
 {
-	assert(v && key && key_lookup);
+	GIT_ASSERT_ARG(v);
+	GIT_ASSERT_ARG(key);
+	GIT_ASSERT(key_lookup);
 
 	/* need comparison function to sort the vector */
 	if (!v->_cmp)
@@ -212,7 +216,9 @@ int git_vector_search2(
 {
 	size_t i;
 
-	assert(v && key && key_lookup);
+	GIT_ASSERT_ARG(v);
+	GIT_ASSERT_ARG(key);
+	GIT_ASSERT(key_lookup);
 
 	for (i = 0; i < v->length; ++i) {
 		if (key_lookup(key, v->contents[i]) == 0) {
@@ -240,7 +246,7 @@ int git_vector_remove(git_vector *v, size_t idx)
 {
 	size_t shift_count;
 
-	assert(v);
+	GIT_ASSERT_ARG(v);
 
 	if (idx >= v->length)
 		return GIT_ENOTFOUND;
@@ -303,7 +309,6 @@ void git_vector_remove_matching(
 
 void git_vector_clear(git_vector *v)
 {
-	assert(v);
 	v->length = 0;
 	git_vector_set_sorted(v, 1);
 }
@@ -312,8 +317,6 @@ void git_vector_swap(git_vector *a, git_vector *b)
 {
 	git_vector t;
 
-	assert(a && b);
-
 	if (a != b) {
 		memcpy(&t, a, sizeof(t));
 		memcpy(a, b, sizeof(t));
@@ -340,7 +343,8 @@ int git_vector_insert_null(git_vector *v, size_t idx, size_t insert_len)
 {
 	size_t new_length;
 
-	assert(insert_len > 0 && idx <= v->length);
+	GIT_ASSERT_ARG(insert_len > 0);
+	GIT_ASSERT_ARG(idx <= v->length);
 
 	GIT_ERROR_CHECK_ALLOC_ADD(&new_length, v->length, insert_len);
 
@@ -359,13 +363,13 @@ int git_vector_remove_range(git_vector *v, size_t idx, size_t remove_len)
 {
 	size_t new_length = v->length - remove_len;
 	size_t end_idx = 0;
-	
-	assert(remove_len > 0);
+
+	GIT_ASSERT_ARG(remove_len > 0);
 
 	if (git__add_sizet_overflow(&end_idx, idx, remove_len))
-		assert(0);
+		GIT_ASSERT(0);
 
-	assert(end_idx <= v->length);
+	GIT_ASSERT(end_idx <= v->length);
 
 	if (end_idx < v->length)
 		memmove(&v->contents[idx], &v->contents[end_idx],
diff --git a/src/win32/findfile.c b/src/win32/findfile.c
index 7f077e154..f541a03d4 100644
--- a/src/win32/findfile.c
+++ b/src/win32/findfile.c
@@ -53,7 +53,9 @@ static wchar_t* win32_walkpath(wchar_t *path, wchar_t *buf, size_t buflen)
 {
 	wchar_t term, *base = path;
 
-	assert(path && buf && buflen);
+	GIT_ASSERT_ARG_WITH_RETVAL(path, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(buf, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(buflen, NULL);
 
 	term = (*path == L'"') ? *path++ : L';';
 
@@ -109,7 +111,7 @@ static int win32_find_git_in_registry(
 	HKEY hKey;
 	int error = GIT_ENOTFOUND;
 
-	assert(buf);
+	GIT_ASSERT_ARG(buf);
 
 	if (!RegOpenKeyExW(hive, key, 0, KEY_READ, &hKey)) {
 		DWORD dwType, cbData;
diff --git a/src/win32/map.c b/src/win32/map.c
index e2ce737de..2aabc9b15 100644
--- a/src/win32/map.c
+++ b/src/win32/map.c
@@ -117,7 +117,7 @@ int p_munmap(git_map *map)
 {
 	int error = 0;
 
-	assert(map != NULL);
+	GIT_ASSERT_ARG(map);
 
 	if (map->data) {
 		if (!UnmapViewOfFile(map->data)) {
diff --git a/src/win32/path_w32.c b/src/win32/path_w32.c
index 9faddcf3b..23efd9269 100644
--- a/src/win32/path_w32.c
+++ b/src/win32/path_w32.c
@@ -492,14 +492,12 @@ size_t git_win32_path_remove_namespace(wchar_t *str, size_t len)
 		prefix_len = CONST_STRLEN(unc_prefix);
 	}
 
-	if (remainder) {
-		/*
-		 * Sanity check that the new string isn't longer than the old one.
-		 * (This could only happen due to programmer error introducing a
-		 * prefix longer than the namespace it replaces.)
-		 */
-		assert(len >= remainder_len + prefix_len);
-
+	/*
+	 * Sanity check that the new string isn't longer than the old one.
+	 * (This could only happen due to programmer error introducing a
+	 * prefix longer than the namespace it replaces.)
+	 */
+	if (remainder && len >= remainder_len + prefix_len) {
 		if (prefix)
 			memmove(str, prefix, prefix_len * sizeof(wchar_t));
 
diff --git a/src/win32/precompiled.h b/src/win32/precompiled.h
index 314383d31..806b1698a 100644
--- a/src/win32/precompiled.h
+++ b/src/win32/precompiled.h
@@ -1,6 +1,5 @@
 #include "common.h"
 
-#include <assert.h>
 #include <errno.h>
 #include <limits.h>
 #include <stdlib.h>
diff --git a/src/win32/thread.c b/src/win32/thread.c
index 51b005bc8..f5cacd320 100644
--- a/src/win32/thread.c
+++ b/src/win32/thread.c
@@ -94,10 +94,7 @@ int git_thread_join(
 
 	/* Check for the thread having exited uncleanly. If exit was unclean,
 	 * then we don't have a return value to give back to the caller. */
-	if (exit != CLEAN_THREAD_EXIT) {
-		assert(false);
-		thread->result = NULL;
-	}
+	GIT_ASSERT(exit == CLEAN_THREAD_EXIT);
 
 	if (value_ptr)
 		*value_ptr = thread->result;
@@ -149,7 +146,7 @@ int git_cond_init(git_cond *cond)
 {
 	/* This is an auto-reset event. */
 	*cond = CreateEventW(NULL, FALSE, FALSE, NULL);
-	assert(*cond);
+	GIT_ASSERT(*cond);
 
 	/* If we can't create the event, claim that the reason was out-of-memory.
 	 * The actual reason can be fetched with GetLastError(). */
@@ -164,7 +161,7 @@ int git_cond_free(git_cond *cond)
 		return EINVAL;
 
 	closed = CloseHandle(*cond);
-	assert(closed);
+	GIT_ASSERT(closed);
 	GIT_UNUSED(closed);
 
 	*cond = NULL;
@@ -186,7 +183,7 @@ int git_cond_wait(git_cond *cond, git_mutex *mutex)
 		return error;
 
 	wait_result = WaitForSingleObject(*cond, INFINITE);
-	assert(WAIT_OBJECT_0 == wait_result);
+	GIT_ASSERT(WAIT_OBJECT_0 == wait_result);
 	GIT_UNUSED(wait_result);
 
 	return git_mutex_lock(mutex);
@@ -200,7 +197,7 @@ int git_cond_signal(git_cond *cond)
 		return EINVAL;
 
 	signaled = SetEvent(*cond);
-	assert(signaled);
+	GIT_ASSERT(signaled);
 	GIT_UNUSED(signaled);
 
 	return 0;
diff --git a/src/win32/w32_buffer.c b/src/win32/w32_buffer.c
index b78a7e6f3..f270a1e6a 100644
--- a/src/win32/w32_buffer.c
+++ b/src/win32/w32_buffer.c
@@ -32,13 +32,13 @@ int git_buf_put_w(git_buf *buf, const wchar_t *string_w, size_t len_w)
 		return -1;
 	}
 
-	assert(string_w);
+	GIT_ASSERT(string_w);
 
 	/* Measure the string necessary for conversion */
 	if ((utf8_len = WideCharToMultiByte(CP_UTF8, WC_ERR_INVALID_CHARS, string_w, (int)len_w, NULL, 0, NULL, NULL)) == 0)
 		return 0;
 
-	assert(utf8_len > 0);
+	GIT_ASSERT(utf8_len > 0);
 
 	GIT_ERROR_CHECK_ALLOC_ADD(&new_size, buf->size, (size_t)utf8_len);
 	GIT_ERROR_CHECK_ALLOC_ADD(&new_size, new_size, 1);
@@ -50,7 +50,7 @@ int git_buf_put_w(git_buf *buf, const wchar_t *string_w, size_t len_w)
 			CP_UTF8, WC_ERR_INVALID_CHARS, string_w, (int)len_w, &buf->ptr[buf->size], utf8_len, NULL, NULL)) == 0)
 		return handle_wc_error();
 
-	assert(utf8_write_len == utf8_len);
+	GIT_ASSERT(utf8_write_len == utf8_len);
 
 	buf->size += utf8_write_len;
 	buf->ptr[buf->size] = '\0';
diff --git a/src/worktree.c b/src/worktree.c
index 5b1e2794b..7d447e896 100644
--- a/src/worktree.c
+++ b/src/worktree.c
@@ -37,7 +37,8 @@ int git_worktree_list(git_strarray *wts, git_repository *repo)
 	size_t i, len;
 	int error;
 
-	assert(wts && repo);
+	GIT_ASSERT_ARG(wts);
+	GIT_ASSERT_ARG(repo);
 
 	wts->count = 0;
 	wts->strings = NULL;
@@ -73,7 +74,8 @@ char *git_worktree__read_link(const char *base, const char *file)
 {
 	git_buf path = GIT_BUF_INIT, buf = GIT_BUF_INIT;
 
-	assert(base && file);
+	GIT_ASSERT_ARG_WITH_RETVAL(base, NULL);
+	GIT_ASSERT_ARG_WITH_RETVAL(file, NULL);
 
 	if (git_buf_joinpath(&path, base, file) < 0)
 		goto err;
@@ -106,7 +108,9 @@ static int write_wtfile(const char *base, const char *file, const git_buf *buf)
 	git_buf path = GIT_BUF_INIT;
 	int err;
 
-	assert(base && file && buf);
+	GIT_ASSERT_ARG(base);
+	GIT_ASSERT_ARG(file);
+	GIT_ASSERT_ARG(buf);
 
 	if ((err = git_buf_joinpath(&path, base, file)) < 0)
 		goto out;
@@ -170,7 +174,8 @@ int git_worktree_lookup(git_worktree **out, git_repository *repo, const char *na
 	git_worktree *wt = NULL;
 	int error;
 
-	assert(repo && name);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
 
 	*out = NULL;
 
@@ -237,7 +242,7 @@ void git_worktree_free(git_worktree *wt)
 
 int git_worktree_validate(const git_worktree *wt)
 {
-	assert(wt);
+	GIT_ASSERT_ARG(wt);
 
 	if (!is_worktree_dir(wt->gitdir_path)) {
 		git_error_set(GIT_ERROR_WORKTREE,
@@ -304,7 +309,10 @@ int git_worktree_add(git_worktree **out, git_repository *repo,
 	if (opts)
 		memcpy(&wtopts, opts, sizeof(wtopts));
 
-	assert(out && repo && name && worktree);
+	GIT_ASSERT_ARG(out);
+	GIT_ASSERT_ARG(repo);
+	GIT_ASSERT_ARG(name);
+	GIT_ASSERT_ARG(worktree);
 
 	*out = NULL;
 
@@ -417,7 +425,7 @@ int git_worktree_lock(git_worktree *wt, const char *reason)
 	git_buf buf = GIT_BUF_INIT, path = GIT_BUF_INIT;
 	int error;
 
-	assert(wt);
+	GIT_ASSERT_ARG(wt);
 
 	if ((error = git_worktree_is_locked(NULL, wt)) < 0)
 		goto out;
@@ -448,7 +456,7 @@ int git_worktree_unlock(git_worktree *wt)
 	git_buf path = GIT_BUF_INIT;
 	int error;
 
-	assert(wt);
+	GIT_ASSERT_ARG(wt);
 
 	if ((error = git_worktree_is_locked(NULL, wt)) < 0)
 		return error;
@@ -475,7 +483,7 @@ int git_worktree_is_locked(git_buf *reason, const git_worktree *wt)
 	git_buf path = GIT_BUF_INIT;
 	int error, locked;
 
-	assert(wt);
+	GIT_ASSERT_ARG(wt);
 
 	if (reason)
 		git_buf_clear(reason);
@@ -496,13 +504,13 @@ out:
 
 const char *git_worktree_name(const git_worktree *wt)
 {
-	assert(wt);
+	GIT_ASSERT_ARG_WITH_RETVAL(wt, NULL);
 	return wt->name;
 }
 
 const char *git_worktree_path(const git_worktree *wt)
 {
-	assert(wt);
+	GIT_ASSERT_ARG_WITH_RETVAL(wt, NULL);
 	return wt->worktree_path;
 }
 
diff --git a/src/zstream.c b/src/zstream.c
index 975ead2f6..a5675676e 100644
--- a/src/zstream.c
+++ b/src/zstream.c
@@ -156,7 +156,7 @@ int git_zstream_get_output(void *out, size_t *out_len, git_zstream *zstream)
 	}
 
 	/* either we finished the input or we did not flush the data */
-	assert(zstream->in_len > 0 || zstream->flush == Z_FINISH);
+	GIT_ASSERT(zstream->in_len > 0 || zstream->flush == Z_FINISH);
 
 	/* set out_size to number of bytes actually written to output */
 	*out_len = *out_len - out_remain;
diff --git a/tests/core/path.c b/tests/core/path.c
index 2e5a4ab24..eac3573fe 100644
--- a/tests/core/path.c
+++ b/tests/core/path.c
@@ -32,15 +32,6 @@ check_basename(const char *A, const char *B)
 }
 
 static void
-check_topdir(const char *A, const char *B)
-{
-	const char *dir;
-
-	cl_assert((dir = git_path_topdir(A)) != NULL);
-	cl_assert_equal_s(B, dir);
-}
-
-static void
 check_joinpath(const char *path_a, const char *path_b, const char *expected_path)
 {
 	git_buf joined_path = GIT_BUF_INIT;
@@ -119,23 +110,6 @@ void test_core_path__01_basename(void)
 	check_basename(REP1024("/abc"), "abc");
 }
 
-/* get the latest component in a path */
-void test_core_path__02_topdir(void)
-{
-	check_topdir(".git/", ".git/");
-	check_topdir("/.git/", ".git/");
-	check_topdir("usr/local/.git/", ".git/");
-	check_topdir("./.git/", ".git/");
-	check_topdir("/usr/.git/", ".git/");
-	check_topdir("/", "/");
-	check_topdir("a/", "a/");
-
-	cl_assert(git_path_topdir("/usr/.git") == NULL);
-	cl_assert(git_path_topdir(".") == NULL);
-	cl_assert(git_path_topdir("") == NULL);
-	cl_assert(git_path_topdir("a") == NULL);
-}
-
 /* properly join path components */
 void test_core_path__05_joins(void)
 {
@@ -285,7 +259,7 @@ void test_core_path__08_self_join(void)
 	cl_git_pass(git_buf_joinpath(&path, path.ptr + 4, "somethinglongenoughtorealloc"));
 	cl_assert_equal_s(path.ptr, "/baz/somethinglongenoughtorealloc");
 	cl_assert(asize < path.asize);
-	
+
 	git_buf_dispose(&path);
 }