From b988f5444c6b17cd83758d52174b141737f5f601 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 26 Apr 2017 13:16:18 +0200
Subject: tests: online::clone: use URL of test server

All our tests running against a local SSH server usually read the
server's URL from environment variables. But online::clone::ssh_cert
test fails to do so and instead always connects to
"ssh://localhost/foo". This assumption breaks whenever the SSH server is
not running on the standard port, e.g. when it is running as a user.

Fix the issue by using the URL provided by the environment.

(cherry picked from commit c2c95ad0a210be4811c247be51664bfe8b2e830a)
---
 tests/online/clone.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/online/clone.c b/tests/online/clone.c
index c5d2ab188..07f84c48e 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -577,7 +577,7 @@ void test_online_clone__ssh_cert(void)
 	if (!_remote_ssh_fingerprint)
 		cl_skip();
 
-	cl_git_fail_with(GIT_EUSER, git_clone(&g_repo, "ssh://localhost/foo", "./foo", &g_options));
+	cl_git_fail_with(GIT_EUSER, git_clone(&g_repo, _remote_url, "./foo", &g_options));
 }
 
 static char *read_key_file(const char *path)
-- 
cgit v1.2.1


From 76a7d5f1728745889a0d53c8dc498cbc5eb6dbdb Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 26 Apr 2017 13:04:23 +0200
Subject: travis: cibuild: set up our own sshd server

Some tests of ours require to be running against an SSH server.
Currently, we simply run against the SSH server provided and started by
Travis itself. As our Linux tests run in a sudo-less environment, we
have no control over its configuration and startup/shutdown procedure.
While this has been no problem until now, it will become a problem as
soon as we migrate over to newer Precise images, as the SSH server does
not have any host keys set up. Luckily, we can simply set up our own
unpriviledged SSH server. This has the benefit of us being able to
modify its configuration even in a sudo-less environment.

This commit sets up the unpriviledged SSH server on port 2222.

(cherry picked from commit 06619904a2ae2ffd5d8e34ab11d5eb484e9d5762)
---
 script/cibuild.sh | 34 ++++++++++++++++++++++++++--------
 1 file changed, 26 insertions(+), 8 deletions(-)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 403df223e..9239136dd 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -43,23 +43,39 @@ ctest -V -R libgit2_clar || exit $?
 
 killall git-daemon
 
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-    echo 'PasswordAuthentication yes' | sudo tee -a /etc/sshd_config
-fi
-
+# Set up sshd
+mkdir ~/sshd/
+cat >~/sshd/sshd_config<<-EOF
+	Port 2222
+	ListenAddress 0.0.0.0
+	Protocol 2
+	HostKey ${HOME}/sshd/id_rsa
+	RSAAuthentication yes
+	PasswordAuthentication yes
+	PubkeyAuthentication yes
+	ChallengeResponseAuthentication no
+	# Required here as sshd will simply close connection otherwise
+	UsePAM no
+EOF
+ssh-keygen -t rsa -f ~/sshd/id_rsa -N "" -q
+/usr/sbin/sshd -f ~/sshd/sshd_config
+
+# Set up keys
 ssh-keygen -t rsa -f ~/.ssh/id_rsa -N "" -q
 cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys
-ssh-keyscan -t rsa localhost >>~/.ssh/known_hosts
+while read algorithm key comment; do
+    echo "[localhost]:2222 $algorithm $key" >>~/.ssh/known_hosts
+done <~/sshd/id_rsa.pub
 
 # Get the fingerprint for localhost and remove the colons so we can parse it as
 # a hex number. The Mac version is newer so it has a different output format.
 if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F localhost -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
+    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
 else
-    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F localhost -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
 fi
 
-export GITTEST_REMOTE_URL="ssh://localhost/$HOME/_temp/test.git"
+export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
 export GITTEST_REMOTE_USER=$USER
 export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
 export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
@@ -83,6 +99,8 @@ if [ -e ./libgit2_clar ]; then
 
 fi
 
+killall sshd
+
 export GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
 export GITTEST_REMOTE_USER="libgit2test"
 ctest -V -R libgit2_clar-cred_callback
-- 
cgit v1.2.1


From 5491d0e1304f604cb28d54439bb84f33d24d7353 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 21 Apr 2017 07:58:46 +0000
Subject: travis: upgrade container to Ubuntu 14.04

Ubuntu 12.04 (Precise Pangolin) reaches end of life on April 28th, 2017.
As such, we should update our build infrastructure to use the next
available LTS release, which is Ubuntu 14.04 LTS (Trusty Tahr). Note
that Trusty is still considered beta quality on Travis. But considering
we are able to correctly build and test libgit2, this seems to be a
non-issue for us.

Switch over our default distribution to Trusty. As Precise still has
extended support for paying customers, add an additional job which
compiles libgit2 on the old release.

(cherry picked from commit 7c8d460f8410cf7a110eb10e9c4bafdede6a49c6)
---
 .travis.yml | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/.travis.yml b/.travis.yml
index 83b6602aa..178d98aa2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -36,6 +36,7 @@ addons:
     - openssh-server
     - valgrind
 
+dist: trusty
 sudo: false
 osx_image: xcode8.3
 
@@ -45,14 +46,20 @@ matrix:
    - os: osx
      compiler: gcc
  include:
+   - compiler: gcc
+     env: PRECISE=1
+     os: linux
+     dist: precise
    - compiler: gcc
      env: COVERITY=1
      os: linux
+     dist: trusty
    - compiler: gcc
      env:
        - VALGRIND=1
          OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
      os: linux
+     dist: trusty
  allow_failures:
    - env: COVERITY=1
 
-- 
cgit v1.2.1


From 16957a7fe67cca24df080a8c970f2fb48a5a23f0 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 23 Jul 2017 03:41:52 +0100
Subject: travis: build with patched libcurl

Ubuntu trusty has a bug in curl when using NTLM credentials in a proxy,
dereferencing a null pointer and causing segmentation faults.  Use a
custom-patched version of libcurl that avoids this issue.

(cherry picked from commit f031e20b516209f19a56ef934e12fea6adec097a)
---
 .travis.yml                  | 4 ++--
 script/install-deps-linux.sh | 8 ++++++++
 2 files changed, 10 insertions(+), 2 deletions(-)
 create mode 100755 script/install-deps-linux.sh

diff --git a/.travis.yml b/.travis.yml
index 178d98aa2..9e02d093e 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -37,7 +37,7 @@ addons:
     - valgrind
 
 dist: trusty
-sudo: false
+sudo: true
 osx_image: xcode8.3
 
 matrix:
@@ -64,7 +64,7 @@ matrix:
    - env: COVERITY=1
 
 install:
-  - if [ "$TRAVIS_OS_NAME" = "osx" ]; then ./script/install-deps-${TRAVIS_OS_NAME}.sh; fi
+  - ./script/install-deps-${TRAVIS_OS_NAME}.sh
 
 # Run the Build script and tests
 script:
diff --git a/script/install-deps-linux.sh b/script/install-deps-linux.sh
new file mode 100755
index 000000000..c18b03bfe
--- /dev/null
+++ b/script/install-deps-linux.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -x
+
+echo "deb http://libgit2deps.edwardthomson.com trusty libgit2deps" | sudo tee -a /etc/apt/sources.list
+sudo apt-key adv --keyserver pgp.mit.edu --recv 99131CD5
+sudo apt-get update -qq
+sudo apt-get install -y cmake curl libcurl3 libcurl3-gnutls libcurl4-gnutls-dev libssh2-1-dev openssh-client openssh-server valgrind
-- 
cgit v1.2.1


From fad7f7a2d941e8c7b774f0e3822fb5a367a63591 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 24 Jul 2017 13:10:43 +0100
Subject: travis: use trusty

(cherry picked from commit 4da38193c568ca3842bc1130c82e7a9f955f23aa)
---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 9e02d093e..623e59ef9 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,6 +2,7 @@
 # see travis-ci.org for details
 
 language: c
+dist: trusty
 
 os:
   - linux
-- 
cgit v1.2.1


From 7d1c72a4688418095c04324b59685c4a79c5596a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 24 Jul 2017 16:48:04 +0100
Subject: travis: only kill our own sshd

(cherry picked from commit 697583ea3aceb1379c576515ffa713ba29c50437)
---
 script/cibuild.sh | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 9239136dd..74946db0a 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -50,6 +50,7 @@ cat >~/sshd/sshd_config<<-EOF
 	ListenAddress 0.0.0.0
 	Protocol 2
 	HostKey ${HOME}/sshd/id_rsa
+	PidFile ${HOME}/sshd/pid
 	RSAAuthentication yes
 	PasswordAuthentication yes
 	PubkeyAuthentication yes
@@ -99,7 +100,7 @@ if [ -e ./libgit2_clar ]; then
 
 fi
 
-killall sshd
+kill $(cat "$HOME/sshd/pid")
 
 export GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
 export GITTEST_REMOTE_USER="libgit2test"
-- 
cgit v1.2.1


From dc413239ab1f9aa1416462b73e27cb027f213024 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@microsoft.com>
Date: Mon, 24 Jul 2017 17:53:32 +0100
Subject: travis: only install custom libcurl on trusty

(cherry picked from commit c582fa4eb6bee7880f04080aa80357cca406e448)
---
 script/install-deps-linux.sh | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/script/install-deps-linux.sh b/script/install-deps-linux.sh
index c18b03bfe..15bac4d08 100755
--- a/script/install-deps-linux.sh
+++ b/script/install-deps-linux.sh
@@ -2,7 +2,11 @@
 
 set -x
 
-echo "deb http://libgit2deps.edwardthomson.com trusty libgit2deps" | sudo tee -a /etc/apt/sources.list
-sudo apt-key adv --keyserver pgp.mit.edu --recv 99131CD5
-sudo apt-get update -qq
-sudo apt-get install -y cmake curl libcurl3 libcurl3-gnutls libcurl4-gnutls-dev libssh2-1-dev openssh-client openssh-server valgrind
+if [ -z "$PRECISE" ]; then
+    echo "deb http://libgit2deps.edwardthomson.com trusty libgit2deps" | sudo tee -a /etc/apt/sources.list
+    sudo apt-key adv --keyserver pgp.mit.edu --recv 99131CD5
+    sudo apt-get update -qq
+    sudo apt-get install -y curl libcurl3 libcurl3-gnutls libcurl4-gnutls-dev
+fi
+
+sudo apt-get install -y cmake libssh2-1-dev openssh-client openssh-server valgrind
-- 
cgit v1.2.1


From 1c85bcd8b962b076ff0a4b77d041eb678b43c8ff Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Mon, 6 Nov 2017 11:16:02 +0000
Subject: appveyor: build examples

By default, CMake will not build our examples directory. As we do not
instruct either the MinGW or MSVC builds on AppVeyor to enable building
these examples, we cannot verify that those examples at least build on
Windows systems.

Fix that by passing `-DBUILD_EXAMPLES=ON` to AppVeyor's CMake
invocation.

(cherry picked from commit 0b98a66baae83056401a0a5fef5dc5cd2ed3468b)
---
 appveyor.yml             | 2 +-
 script/appveyor-mingw.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/appveyor.yml b/appveyor.yml
index fb3fff7dd..03a192c49 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -26,7 +26,7 @@ build_script:
     mkdir build
     cd build
     if ($env:GENERATOR -ne "MSYS Makefiles") {
-      cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D MSVC_CRTDBG=ON .. -G"$env:GENERATOR"
+      cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON -D MSVC_CRTDBG=ON .. -G"$env:GENERATOR"
       cmake --build . --config Debug
     }
 - cmd: |
diff --git a/script/appveyor-mingw.sh b/script/appveyor-mingw.sh
index d171a72d5..6b2a9425e 100755
--- a/script/appveyor-mingw.sh
+++ b/script/appveyor-mingw.sh
@@ -19,5 +19,5 @@ fi
 cd build
 gcc --version
 cmake --version
-cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON .. -G"$GENERATOR"
+cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON .. -G"$GENERATOR"
 cmake --build . --config RelWithDebInfo
-- 
cgit v1.2.1


From 736356a67e965ae2a112eb5f4c16116e3cd9e3e0 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Mon, 6 Nov 2017 12:47:40 +0000
Subject: examples: network: fix Win32 linking errors due to getline

The getline(3) function call is not part of ISO C and, most importantly,
it is not implemented on Microsoft Windows platforms. As our networking
example code makes use of getline, this breaks builds on MSVC and MinGW.
As this code wasn't built prior to the previous commit, this was never
noticed.

Fix the error by instead implementing a `readline` function, which
simply reads the password from stdin until it reads a newline
character.

(cherry picked from commit bf15dbf6cf19146082c1245e9db4016d773dbe7e)
---
 examples/network/common.c | 41 +++++++++++++++++++++++++++++++++++++++--
 1 file changed, 39 insertions(+), 2 deletions(-)

diff --git a/examples/network/common.c b/examples/network/common.c
index 1a81a10f8..b0afb0238 100644
--- a/examples/network/common.c
+++ b/examples/network/common.c
@@ -16,6 +16,43 @@
 # define UNUSED(x) x
 #endif
 
+static int readline(char **out)
+{
+	int c, error = 0, length = 0, allocated = 0;
+	char *line = NULL;
+
+	errno = 0;
+
+	while ((c = getchar()) != EOF) {
+		if (length == allocated) {
+			allocated += 16;
+
+			if ((line = realloc(line, allocated)) == NULL) {
+				error = -1;
+				goto error;
+			}
+		}
+
+		if (c == '\n')
+			break;
+
+		line[length++] = c;
+	}
+
+	if (errno != 0) {
+		error = -1;
+		goto error;
+	}
+
+	line[length] = '\0';
+	*out = line;
+	line = NULL;
+	error = length;
+error:
+	free(line);
+	return error;
+}
+
 int cred_acquire_cb(git_cred **out,
 		const char * UNUSED(url),
 		const char * UNUSED(username_from_url),
@@ -26,14 +63,14 @@ int cred_acquire_cb(git_cred **out,
 	int error;
 
 	printf("Username: ");
-	if (getline(&username, NULL, stdin) < 0) {
+	if (readline(&username) < 0) {
 		fprintf(stderr, "Unable to read username: %s", strerror(errno));
 		return -1;
 	}
 
 	/* Yup. Right there on your terminal. Careful where you copy/paste output. */
 	printf("Password: ");
-	if (getline(&password, NULL, stdin) < 0) {
+	if (readline(&password) < 0) {
 		fprintf(stderr, "Unable to read password: %s", strerror(errno));
 		free(username);
 		return -1;
-- 
cgit v1.2.1


From 4eecbdd0be15fc497892f970a41d959402546a7e Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Mart=C3=ADn=20Nieto?= <cmn@dwim.me>
Date: Tue, 31 Oct 2017 10:40:24 +0100
Subject: travis: put clar's sandbox in a ramdisk on macOS

The macOS tests are by far the slowest right now. This attempts to remedy the
situation somewhat by asking clar to put its test data on a ramdisk.

(cherry picked from commit 37bb15122e30bb13aabc213079da53b5cdac2678)
---
 script/cibuild.sh | 9 +++++++++
 1 file changed, 9 insertions(+)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 74946db0a..283acbf5b 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -10,6 +10,15 @@ fi
 
 if [ "$TRAVIS_OS_NAME" = "osx" ]; then
 	export PKG_CONFIG_PATH=$(ls -d /usr/local/Cellar/{curl,zlib}/*/lib/pkgconfig | paste -s -d':' -)
+
+	# Set up a ramdisk for us to put our test data on to speed up tests on macOS
+	export CLAR_TMP="$HOME"/_clar_tmp
+	mkdir -p $CLAR_TMP
+
+	# 2M sectors aka ~1GB of space
+	device=$(hdiutil attach -nomount ram://$((2 * 1024 * 1024)))
+	newfs_hfs $device
+	mount -t hfs $device $CLAR_TMP
 fi
 
 # Should we ask Travis to cache this file?
-- 
cgit v1.2.1


From 9343482873b512183209b33d356f7fb8f6297291 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Mart=C3=ADn=20Nieto?= <cmn@dwim.me>
Date: Tue, 31 Oct 2017 14:43:28 +0100
Subject: travis: let's try a 5GB ramdisk

(cherry picked from commit 71ba464435bb430b02d94c653cd518c11f7289ff)
---
 script/cibuild.sh | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 283acbf5b..1c28baae6 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -15,8 +15,8 @@ if [ "$TRAVIS_OS_NAME" = "osx" ]; then
 	export CLAR_TMP="$HOME"/_clar_tmp
 	mkdir -p $CLAR_TMP
 
-	# 2M sectors aka ~1GB of space
-	device=$(hdiutil attach -nomount ram://$((2 * 1024 * 1024)))
+	# 5*2M sectors aka ~5GB of space
+	device=$(hdiutil attach -nomount ram://$((5 * 2 * 1024 * 1024)))
 	newfs_hfs $device
 	mount -t hfs $device $CLAR_TMP
 fi
-- 
cgit v1.2.1


From 0c51ecf2ace62b65714b977b706b06f8d44f02f2 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 7 Oct 2017 00:10:06 +0100
Subject: travis: add custom apt sources

Move back to Travis's VM infrastructure for efficiency.

(cherry picked from commit 9dc21efdbf275dec18b9c34b472f8df9f8e8c169)
---
 .travis.yml                  | 37 ++++++++++++++++++-------------------
 script/install-deps-linux.sh | 12 ------------
 2 files changed, 18 insertions(+), 31 deletions(-)
 delete mode 100755 script/install-deps-linux.sh

diff --git a/.travis.yml b/.travis.yml
index 623e59ef9..fd0c296d1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -2,7 +2,6 @@
 # see travis-ci.org for details
 
 language: c
-dist: trusty
 
 os:
   - linux
@@ -21,25 +20,25 @@ env:
   - OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release"
   - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
 
-addons:
-  apt:
-    sources:
-     - sourceline: 'deb https://dl.bintray.com/libgit2/ci-dependencies trusty libgit2deps'
-       key_url: 'https://bintray.com/user/downloadSubjectPublicKey?username=bintray'
-    packages:
-    - cmake
-    - curl
-    - libcurl3
-    - libcurl3-gnutls
-    - libcurl4-gnutls-dev
-    - libssh2-1-dev
-    - openssh-client
-    - openssh-server
-    - valgrind
-
 dist: trusty
-sudo: true
 osx_image: xcode8.3
+sudo: false
+
+addons:
+ apt:
+  sources:
+   - sourceline: 'deb http://libgit2deps.edwardthomson.com trusty libgit2deps'
+     key_url: 'https://pgp.mit.edu/pks/lookup?op=get&search=0x5656187599131CD5'
+  packages:
+   cmake
+   curl
+   libcurl3
+   libcurl3-gnutls
+   libcurl4-gnutls-dev
+   libssh2-1-dev
+   openssh-client
+   openssh-server
+   valgrind
 
 matrix:
  fast_finish: true
@@ -65,7 +64,7 @@ matrix:
    - env: COVERITY=1
 
 install:
-  - ./script/install-deps-${TRAVIS_OS_NAME}.sh
+  - if [ -f ./script/install-deps-${TRAVIS_OS_NAME}.sh ]; then ./script/install-deps-${TRAVIS_OS_NAME}.sh; fi
 
 # Run the Build script and tests
 script:
diff --git a/script/install-deps-linux.sh b/script/install-deps-linux.sh
deleted file mode 100755
index 15bac4d08..000000000
--- a/script/install-deps-linux.sh
+++ /dev/null
@@ -1,12 +0,0 @@
-#!/bin/sh
-
-set -x
-
-if [ -z "$PRECISE" ]; then
-    echo "deb http://libgit2deps.edwardthomson.com trusty libgit2deps" | sudo tee -a /etc/apt/sources.list
-    sudo apt-key adv --keyserver pgp.mit.edu --recv 99131CD5
-    sudo apt-get update -qq
-    sudo apt-get install -y curl libcurl3 libcurl3-gnutls libcurl4-gnutls-dev
-fi
-
-sudo apt-get install -y cmake libssh2-1-dev openssh-client openssh-server valgrind
-- 
cgit v1.2.1


From 6be03667ee084939e507057db4006aa53281de73 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Wed, 10 Jan 2018 12:33:56 +0000
Subject: travis: fetch trusty dependencies from bintray

The trusty dependencies are now hosted on Bintray.

(cherry picked from commit da9898aba0fe26ea683822e99853bfb2b02ac744)
---
 .travis.yml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index fd0c296d1..f7c0461fb 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -27,8 +27,8 @@ sudo: false
 addons:
  apt:
   sources:
-   - sourceline: 'deb http://libgit2deps.edwardthomson.com trusty libgit2deps'
-     key_url: 'https://pgp.mit.edu/pks/lookup?op=get&search=0x5656187599131CD5'
+   - sourceline: 'deb https://dl.bintray.com/libgit2/ci-dependencies trusty libgit2deps'
+     key_url: 'https://www.edwardthomson.com/keys/ethomson@libgit2.org'
   packages:
    cmake
    curl
-- 
cgit v1.2.1


From 76ecd892e8922dccc187305844301121323fac33 Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?Carlos=20Mart=C3=ADn=20Nieto?= <carlosmn@github.com>
Date: Wed, 10 Jan 2018 15:13:23 +0000
Subject: travis: we use bintray's own key for signing

The VM on Travis apparently will still proceed, but it's good practice.

(cherry picked from commit 6e748130e4f910b6f8c03a3f6f2e11c856d19ba7)
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index f7c0461fb..49b52d9ff 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -28,7 +28,7 @@ addons:
  apt:
   sources:
    - sourceline: 'deb https://dl.bintray.com/libgit2/ci-dependencies trusty libgit2deps'
-     key_url: 'https://www.edwardthomson.com/keys/ethomson@libgit2.org'
+     key_url: 'https://bintray.com/user/downloadSubjectPublicKey?username=bintray'
   packages:
    cmake
    curl
-- 
cgit v1.2.1


From 13a6b20316e094d5de31c90e2d5353b1a3c13558 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 6 Sep 2017 08:04:19 +0200
Subject: travis: drop support for Ubuntu Precise

Ubuntu Precise is end of life since April 2017. At that point in time,
Precise was still the main distro on which Travis CI built upon, with
the Trusty-based images still being in a beta state. But since June
21st, Trusty has officially moved out of beta and is now the default
image for all new builds. Right now, we build on both old and new images
to assure we support both.

Unfortunately, this leaves us with the highest minimum version for CMake
being 2.8.7, as Precise has no greater version in its repositories. And
because of this limitation, we cannot actually use object libraries in
our build instructions. But considering Precise is end of life and
Trusty is now the new default for Travis, we can and should drop support
for this old and unmaintained distribution. And so we do.

(cherry picked from commit c17c3f8a07377d76432fb2e4369b9805387ac099)
---
 .travis.yml | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 49b52d9ff..e9086aec2 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -46,10 +46,6 @@ matrix:
    - os: osx
      compiler: gcc
  include:
-   - compiler: gcc
-     env: PRECISE=1
-     os: linux
-     dist: precise
    - compiler: gcc
      env: COVERITY=1
      os: linux
-- 
cgit v1.2.1


From 8ba43299acaadfd89c90bde6df881f4c123de3d2 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 11:01:28 +0200
Subject: travis: build sources with tracing enabled

Our tracing architecture is not built by default, causing the Travis CI
to not execute some code and skip several tests. As AppVeyor has already
enabled the tracing architecture when building the code, we should do
the same for Travis CI to have this code being tested on macOS and
Linux.

Add "-DENABLE_TRACE=ON" to our release-build options of Travis.

(cherry picked from commit 8999f6acc78810680f282db4257e842971b80cb4)
---
 .travis.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.travis.yml b/.travis.yml
index e9086aec2..d2782ca00 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ env:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
  matrix:
-  - OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release"
+  - OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
   - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
 
 dist: trusty
-- 
cgit v1.2.1


From 293c5ef2077b64ce60ce8412a139c10e757cb061 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 10:59:03 +0200
Subject: tests: status::worktree: indicate skipped tests on Win32

Some function bodies of tests which are not applicable to the Win32
platform are completely #ifdef'd out instead of calling `cl_skip()`.
This leaves us with no indication that these tests are not being
executed at all and may thus cause decreased scrutiny when investigating
skipped tests. Improve the situation by calling `cl_skip()` instead of
just doing nothing.

(cherry picked from commit 72c28ab011759dce113c2a0c7c36ebcd56bd6ddf)
---
 tests/checkout/tree.c    | 2 ++
 tests/iterator/workdir.c | 2 ++
 tests/repo/open.c        | 2 ++
 tests/status/worktree.c  | 4 ++++
 4 files changed, 10 insertions(+)

diff --git a/tests/checkout/tree.c b/tests/checkout/tree.c
index c3475f411..e93dc1483 100644
--- a/tests/checkout/tree.c
+++ b/tests/checkout/tree.c
@@ -1086,6 +1086,8 @@ void test_checkout_tree__filemode_preserved_in_workdir(void)
 	cl_assert(!GIT_PERMS_IS_EXEC(read_filemode("a/b.txt")));
 
 	git_commit_free(commit);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/iterator/workdir.c b/tests/iterator/workdir.c
index f33fd98f1..618006715 100644
--- a/tests/iterator/workdir.c
+++ b/tests/iterator/workdir.c
@@ -741,6 +741,8 @@ void test_iterator_workdir__skips_fifos_and_special_files(void)
 	cl_assert_equal_i(GIT_ITEROVER, git_iterator_advance(&e, i));
 
 	git_iterator_free(i);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/repo/open.c b/tests/repo/open.c
index 3239b6fec..ab36dd587 100644
--- a/tests/repo/open.c
+++ b/tests/repo/open.c
@@ -180,6 +180,8 @@ void test_repo_open__from_git_new_workdir(void)
 	cl_assert_(git__suffixcmp(git_repository_workdir(repo2), "alternate/") == 0, git_repository_workdir(repo2));
 
 	git_repository_free(repo2);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/status/worktree.c b/tests/status/worktree.c
index 1345dbfd2..79eece85a 100644
--- a/tests/status/worktree.c
+++ b/tests/status/worktree.c
@@ -1072,6 +1072,8 @@ void test_status_worktree__unreadable(void)
 	cl_assert_equal_i(counts.expected_entry_count, counts.entry_count);
 	cl_assert_equal_i(0, counts.wrong_status_flags_count);
 	cl_assert_equal_i(0, counts.wrong_sorted_path);
+#else
+	cl_skip();
 #endif
 }
 
@@ -1106,6 +1108,8 @@ void test_status_worktree__unreadable_not_included(void)
 	cl_assert_equal_i(counts.expected_entry_count, counts.entry_count);
 	cl_assert_equal_i(0, counts.wrong_status_flags_count);
 	cl_assert_equal_i(0, counts.wrong_sorted_path);
+#else
+	cl_skip();
 #endif
 }
 
-- 
cgit v1.2.1


From d2bbea8200890c13de0e33d827e646f07ff4bd35 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 10:59:31 +0200
Subject: tests: iterator_helpers: assert number of iterator items

When the function `expect_iterator_items` surpasses the number of
expected items, we simply break the loop. This causes us to trigger an
assert later on which has message attached, which is annoying when
trying to locate the root error cause. Instead, directly assert that the
current count is still smaller or equal to the expected count inside of
the loop.

(cherry picked from commit 9aba76364fcb4755930856a7bafc5294ed3ee944)
---
 tests/iterator/iterator_helpers.c | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/tests/iterator/iterator_helpers.c b/tests/iterator/iterator_helpers.c
index ae48fcd46..68d574126 100644
--- a/tests/iterator/iterator_helpers.c
+++ b/tests/iterator/iterator_helpers.c
@@ -51,8 +51,7 @@ void expect_iterator_items(
 				cl_assert(entry->mode != GIT_FILEMODE_TREE);
 		}
 
-		if (++count >= expected_flat)
-			break;
+		cl_assert(++count <= expected_flat);
 	}
 
 	assert_at_end(i, v);
-- 
cgit v1.2.1


From 98378a3f88a014e20db9afffb98370b93fe0bdf4 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 11:00:26 +0200
Subject: tests: iterator::workdir: fix reference count in stale test

The test `iterator::workdir::filesystem_gunk` is usually not executed,
as it is guarded by the environment variable "GITTEST_INVASIVE_SPEED"
due to its effects on speed. As such, it has become stale and does not
account for new references which have meanwhile been added to the
testrepo, causing it to fail. Fix this by raising the number of expected
references to 15.

(cherry picked from commit b8c14499f9940feaab08a23651a2ef24d27b17b7)
---
 tests/iterator/workdir.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/iterator/workdir.c b/tests/iterator/workdir.c
index 618006715..198edc7e8 100644
--- a/tests/iterator/workdir.c
+++ b/tests/iterator/workdir.c
@@ -662,7 +662,7 @@ void test_iterator_workdir__filesystem_gunk(void)
 	/* should only have 13 items, since we're not asking for trees to be
 	 * returned.  the goal of this test is simply to not crash.
 	 */
-	expect_iterator_items(i, 13, NULL, 13, NULL);
+	expect_iterator_items(i, 15, NULL, 15, NULL);
 	git_iterator_free(i);
 	git_buf_free(&parent);
 }
-- 
cgit v1.2.1


From 896414317321022db1741f889fca9502b7c27b56 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 11:06:01 +0200
Subject: tests: perf: build but exclude performance tests by default

Our performance tests (or to be more concrete, our single performance
test) are not built by default, as they are always #ifdef'd out. While
it is true that we don't want to run performance tests by default, not
compiling them at all may cause code rot and is thus an unfavorable
approach to handle this.

We can easily improve this situation: this commit removes the #ifdef,
causing the code to always be compiled. Furthermore, we add `-xperf` to
the default command line parameters of `generate.py`, thus causing the
tests to be excluded by default.

Due to this approach, we are now able to execute the performance tests
by passing `-sperf` to `libgit2_clar`. Unfortunately, we cannot execute
the performance tests on Travis or AppVeyor as they rely on history
being available for the libgit2 repository. As both do a shallow clone
only, though, this is not given.

(cherry picked from commit 543ec149b86a68e12dd141a6141e82850dabbf21)
---
 CMakeLists.txt     |  2 +-
 tests/perf/merge.c | 13 -------------
 2 files changed, 1 insertion(+), 14 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index acce6fd89..3f38be860 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -677,7 +677,7 @@ IF (BUILD_CLAR)
 
 	ADD_CUSTOM_COMMAND(
 		OUTPUT ${CLAR_PATH}/clar.suite
-		COMMAND ${PYTHON_EXECUTABLE} generate.py -f -xonline -xstress .
+		COMMAND ${PYTHON_EXECUTABLE} generate.py -f -xonline -xstress -xperf .
 		DEPENDS ${SRC_TEST}
 		WORKING_DIRECTORY ${CLAR_PATH}
 	)
diff --git a/tests/perf/merge.c b/tests/perf/merge.c
index b2ef082eb..721902d63 100644
--- a/tests/perf/merge.c
+++ b/tests/perf/merge.c
@@ -25,20 +25,7 @@
 #define ID_BRANCH_A "d853fb9f24e0fe63b3dce9fbc04fd9cfe17a030b"
 #define ID_BRANCH_B "1ce9ea3ba9b4fa666602d52a5281d41a482cc58b"
 
-
-void test_perf_merge__initialize(void)
-{
-}
-
-void test_perf_merge__cleanup(void)
-{
-}
-
 void test_perf_merge__m1(void)
 {
-#if 1
-	cl_skip();
-#else
 	perf__do_merge(SRC_REPO, "m1", ID_BRANCH_A, ID_BRANCH_B);
-#endif
 }
-- 
cgit v1.2.1


From a1a495f21e58366058ea17a6fe8cab8aa4ad2359 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 12:48:48 +0200
Subject: tests: online::clone: construct credential-URL from environment

We support two types of passing credentials to the proxy, either via the
URL or explicitly by specifying user and password. We test these types
by modifying the proxy URL and executing the tests twice, which is
in fact unnecessary and requires us to maintain the list of environment
variables and test executions across multiple CI infrastructures.

To fix the situation, we can just always pass the host, port, user and
password to the tests. The tests can then assemble the complete URL
either with or without included credentials, allowing us to test both
cases in-process.

(cherry picked from commit fea6092079d5c09b499e472efead2f7aa81ce8a1)
---
 CMakeLists.txt       |  4 ++--
 appveyor.yml         |  6 ++----
 script/cibuild.sh    | 14 +++++---------
 tests/online/clone.c | 16 +++++++++++++---
 4 files changed, 22 insertions(+), 18 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 3f38be860..36ac22195 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -712,8 +712,8 @@ IF (BUILD_CLAR)
 	# Add a test target which runs the cred callback tests, to be
 	# called after setting the url and user
 	ADD_TEST(libgit2_clar-cred_callback libgit2_clar -v -sonline::clone::cred_callback)
-	ADD_TEST(libgit2_clar-proxy_credentials_in_url libgit2_clar -v -sonline::clone::proxy_credentials_in_url)
-	ADD_TEST(libgit2_clar-proxy_credentials_request libgit2_clar -v	-sonline::clone::proxy_credentials_request)
+	ADD_TEST(libgit2_clar-proxy_credentials libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
+
 ENDIF ()
 
 IF (TAGS)
diff --git a/appveyor.yml b/appveyor.yml
index 03a192c49..1bde5243f 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -42,9 +42,7 @@ test_script:
     $env:GITTEST_REMOTE_USER="libgit2test"
     ctest -V -R libgit2_clar-cred_callback
     Receive-Job -Job $proxyJob
-    $env:GITTEST_REMOTE_PROXY_URL = "http://foo:bar@localhost:8080"
-    ctest -V -R libgit2_clar-proxy_credentials_in_url
-    $env:GITTEST_REMOTE_PROXY_URL = "http://localhost:8080"
+    $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
     $env:GITTEST_REMOTE_PROXY_USER = "foo"
     $env:GITTEST_REMOTE_PROXY_PASS = "bar"
-    ctest -V -R libgit2_clar-proxy_credentials_request
+    ctest -V -R libgit2_clar-proxy_credentials
diff --git a/script/cibuild.sh b/script/cibuild.sh
index 1c28baae6..c06de1933 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -90,7 +90,10 @@ export GITTEST_REMOTE_USER=$USER
 export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
 export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
 export GITTEST_REMOTE_SSH_PASSPHRASE=""
-
+# Use the proxy we started at the beginning
+export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+export GITTEST_REMOTE_PROXY_USER="foo"
+export GITTEST_REMOTE_PROXY_PASS="bar"
 
 if [ -e ./libgit2_clar ]; then
     ./libgit2_clar -sonline::push -sonline::clone::ssh_cert &&
@@ -99,14 +102,7 @@ if [ -e ./libgit2_clar ]; then
         ./libgit2_clar -sonline::clone::cred_callback || exit $?
     fi
 
-    # Use the proxy we started at the beginning
-    export GITTEST_REMOTE_PROXY_URL="http://foo:bar@localhost:8080/"
-    ./libgit2_clar -sonline::clone::proxy_credentials_in_url || exit $?
-    export GITTEST_REMOTE_PROXY_URL="http://localhost:8080/"
-    export GITTEST_REMOTE_PROXY_USER="foo"
-    export GITTEST_REMOTE_PROXY_PASS="bar"
-    ./libgit2_clar -sonline::clone::proxy_credentials_request || exit $?
-
+    ctest -V -R libgit2_clar-proxy_credentials || exit $?
 fi
 
 kill $(cat "$HOME/sshd/pid")
diff --git a/tests/online/clone.c b/tests/online/clone.c
index 07f84c48e..6a0054b2b 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -707,24 +707,34 @@ static int proxy_creds(git_cred **out, const char *url, const char *username, un
 
 void test_online_clone__proxy_credentials_request(void)
 {
+	git_buf url = GIT_BUF_INIT;
+
 	if (!_remote_proxy_url || !_remote_proxy_user || !_remote_proxy_pass)
 		cl_skip();
 
+	cl_git_pass(git_buf_printf(&url, "http://%s/", _remote_proxy_url));
+
 	g_options.fetch_opts.proxy_opts.type = GIT_PROXY_SPECIFIED;
-	g_options.fetch_opts.proxy_opts.url = _remote_proxy_url;
+	g_options.fetch_opts.proxy_opts.url = url.ptr;
 	g_options.fetch_opts.proxy_opts.credentials = proxy_creds;
 	called_proxy_creds = 0;
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 	cl_assert(called_proxy_creds);
+
+	git_buf_free(&url);
 }
 
 void test_online_clone__proxy_credentials_in_url(void)
 {
-	if (!_remote_proxy_url)
+	git_buf url = GIT_BUF_INIT;
+
+	if (!_remote_proxy_url || !_remote_proxy_user || !_remote_proxy_pass)
 		cl_skip();
 
+	cl_git_pass(git_buf_printf(&url, "http://%s:%s@%s/", _remote_proxy_user, _remote_proxy_pass, _remote_proxy_url));
+
 	g_options.fetch_opts.proxy_opts.type = GIT_PROXY_SPECIFIED;
-	g_options.fetch_opts.proxy_opts.url = _remote_proxy_url;
+	g_options.fetch_opts.proxy_opts.url = url.ptr;
 	called_proxy_creds = 0;
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 	cl_assert(called_proxy_creds == 0);
-- 
cgit v1.2.1


From 2362ce6ce9bf87d60fe888c96c73e6a4a66c3de1 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Wed, 7 Jun 2017 13:06:53 +0200
Subject: tests: online::clone: inline creds-test with nonexistent URL

Right now, we test our credential callback code twice, once via SSH on
localhost and once via a non-existent GitHub repository. While the first
URL makes sense to be configurable, it does not make sense to hard-code
the non-existing repository, which requires us to call tests multiple
times. Instead, we can just inline the URL into another set of tests.

(cherry picked from commit 54a1bf057a1123cf55ac3447c79761c817382f47)
---
 CMakeLists.txt       | 1 -
 appveyor.yml         | 3 ---
 script/cibuild.sh    | 7 -------
 tests/online/clone.c | 8 ++++----
 4 files changed, 4 insertions(+), 15 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 36ac22195..17c5e5a37 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -711,7 +711,6 @@ IF (BUILD_CLAR)
 
 	# Add a test target which runs the cred callback tests, to be
 	# called after setting the url and user
-	ADD_TEST(libgit2_clar-cred_callback libgit2_clar -v -sonline::clone::cred_callback)
 	ADD_TEST(libgit2_clar-proxy_credentials libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
 
 ENDIF ()
diff --git a/appveyor.yml b/appveyor.yml
index 1bde5243f..9f5ca7c99 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -38,9 +38,6 @@ test_script:
     # Run this early so we know it's ready by the time we need it
     $proxyJob = Start-Job { java -jar $Env:APPVEYOR_BUILD_FOLDER\build\poxyproxy.jar -d --port 8080 --credentials foo:bar }
     ctest -V -R libgit2_clar
-    $env:GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
-    $env:GITTEST_REMOTE_USER="libgit2test"
-    ctest -V -R libgit2_clar-cred_callback
     Receive-Job -Job $proxyJob
     $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
     $env:GITTEST_REMOTE_PROXY_USER = "foo"
diff --git a/script/cibuild.sh b/script/cibuild.sh
index c06de1933..5cebb5c17 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -98,15 +98,8 @@ export GITTEST_REMOTE_PROXY_PASS="bar"
 if [ -e ./libgit2_clar ]; then
     ./libgit2_clar -sonline::push -sonline::clone::ssh_cert &&
     ./libgit2_clar -sonline::clone::ssh_with_paths || exit $?
-    if [ "$TRAVIS_OS_NAME" = "linux" ]; then
-        ./libgit2_clar -sonline::clone::cred_callback || exit $?
-    fi
 
     ctest -V -R libgit2_clar-proxy_credentials || exit $?
 fi
 
 kill $(cat "$HOME/sshd/pid")
-
-export GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
-export GITTEST_REMOTE_USER="libgit2test"
-ctest -V -R libgit2_clar-cred_callback
diff --git a/tests/online/clone.c b/tests/online/clone.c
index 6a0054b2b..a0e7ff45e 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -263,8 +263,8 @@ static int cred_failure_cb(
 
 void test_online_clone__cred_callback_failure_return_code_is_tunnelled(void)
 {
-	if (!_remote_url || !_remote_user)
-		clar__skip();
+	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
+	_remote_user = git__strdup("libgit2test");
 
 	g_options.fetch_opts.callbacks.credentials = cred_failure_cb;
 
@@ -293,8 +293,8 @@ void test_online_clone__cred_callback_called_again_on_auth_failure(void)
 {
 	size_t counter = 0;
 
-	if (!_remote_url || !_remote_user)
-		clar__skip();
+	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
+	_remote_user = git__strdup("libgit2test");
 
 	g_options.fetch_opts.callbacks.credentials = cred_count_calls_cb;
 	g_options.fetch_opts.callbacks.payload = &counter;
-- 
cgit v1.2.1


From 637412cc475bdcade43b690779ccb260c0d12a9c Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Mon, 20 Nov 2017 13:26:33 +0000
Subject: tests: create new test target for all SSH-based tests

Some tests shall be run against our own SSH server we spin up in Travis.
As those need to be run separate from our previous tests which run
against git-daemon, we have to do this in a separate step. Instead of
bundling all that knowledge in the CI script, move it into the test
build instructions by creating a new test target.

(cherry picked from commit 5874e151d7b10de84fc1ca168339fdc622292219)
---
 CMakeLists.txt    |  5 ++---
 script/cibuild.sh | 11 ++++-------
 2 files changed, 6 insertions(+), 10 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 17c5e5a37..97c19a5d7 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -709,10 +709,9 @@ IF (BUILD_CLAR)
 		ADD_TEST(libgit2_clar libgit2_clar -v -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
 	ENDIF ()
 
-	# Add a test target which runs the cred callback tests, to be
-	# called after setting the url and user
+	# Add additional test targets that require special setup
 	ADD_TEST(libgit2_clar-proxy_credentials libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
-
+	ADD_TEST(libgit2_clar-ssh libgit2_clar -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
 ENDIF ()
 
 IF (TAGS)
diff --git a/script/cibuild.sh b/script/cibuild.sh
index 5cebb5c17..5d70e7506 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -85,21 +85,18 @@ else
     export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
 fi
 
+# Use the SSH server
 export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
 export GITTEST_REMOTE_USER=$USER
 export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
 export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
 export GITTEST_REMOTE_SSH_PASSPHRASE=""
+ctest -V -R libgit2_clar-ssh || exit $?
+
 # Use the proxy we started at the beginning
 export GITTEST_REMOTE_PROXY_URL="localhost:8080"
 export GITTEST_REMOTE_PROXY_USER="foo"
 export GITTEST_REMOTE_PROXY_PASS="bar"
-
-if [ -e ./libgit2_clar ]; then
-    ./libgit2_clar -sonline::push -sonline::clone::ssh_cert &&
-    ./libgit2_clar -sonline::clone::ssh_with_paths || exit $?
-
-    ctest -V -R libgit2_clar-proxy_credentials || exit $?
-fi
+ctest -V -R libgit2_clar-proxy_credentials || exit $?
 
 kill $(cat "$HOME/sshd/pid")
-- 
cgit v1.2.1


From 3dd462fde5d6137d6e5f64864173a6f98071e595 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 15 Sep 2017 10:01:36 +0200
Subject: appveyor: explicitly specify build images

AppVeyor currently does provide three standard build worker images with
VS2013, VS2015 and VS2017. Right now, we are using the implicitly, which
is the VS2015 one. We want to be more explicit about this, so that we
can easily switch build images based on the job. So starting from this
commit, we explicitly set the `APPVEYOR_BUILD_WORKER_IMAGE` variable per
job, which enables us to choose different images.

To be able to test a wider range of build configurations, this commit
also switches the jobs for VC2010 over to use the older, VS2013 based
images. As the next commit will introduce two new jobs for building with
VS2015, we have then covered both build environments.

Also, let us be a bit more explicit regarding the CMake generator.
Instead of only saying "Visual Studio 10", use the more descriptive
value "Visual Studio 10 2010" to at least avoid some confusion
surrounding the versioning scheme of Visual Studio.

(cherry picked from commit e1076dbfd84218af7870a8f527c37695918b5cde)
---
 appveyor.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/appveyor.yml b/appveyor.yml
index 9f5ca7c99..3cf489ad2 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -9,13 +9,17 @@ environment:
   GITTEST_INVASIVE_FS_SIZE: 1
 
   matrix:
-  - GENERATOR: "Visual Studio 11"
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
+    GENERATOR: "Visual Studio 10 2010"
     ARCH: 32
-  - GENERATOR: "Visual Studio 11 Win64"
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
+    GENERATOR: "Visual Studio 10 2010 Win64"
     ARCH: 64
-  - GENERATOR: "MSYS Makefiles"
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
+    GENERATOR: "MSYS Makefiles"
     ARCH: i686 # this is for 32-bit MinGW-w64
-  - GENERATOR: "MSYS Makefiles"
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
+    GENERATOR: "MSYS Makefiles"
     ARCH: 64
 cache:
 - i686-4.9.2-release-win32-sjlj-rt_v3-rev1.7z
-- 
cgit v1.2.1


From 1a62e303f44d36e16031e05783b7c4ae61c71545 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 15 Sep 2017 11:32:46 +0200
Subject: appveyor: add jobs to also build on Visual Studio 2015

In order to cover a wider range of build environments, add two more jobs
which build and test libgit2 on Visual Studio 14 2015.

(cherry picked from commit 03a95bc5f6418ffd0ebb7f904281935e856a1800)
---
 appveyor.yml | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/appveyor.yml b/appveyor.yml
index 3cf489ad2..9b14a9c81 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -15,6 +15,12 @@ environment:
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
     GENERATOR: "Visual Studio 10 2010 Win64"
     ARCH: 64
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
+    GENERATOR: "Visual Studio 14 2015"
+    ARCH: 32
+  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
+    GENERATOR: "Visual Studio 14 2015 Win64"
+    ARCH: 64
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
     GENERATOR: "MSYS Makefiles"
     ARCH: i686 # this is for 32-bit MinGW-w64
-- 
cgit v1.2.1


From cd14fca128acf8e23c0bd3536201d09cb5cf0644 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 29 Mar 2018 13:35:27 +0100
Subject: appveyor: disable DHE to avoid spurious failures

Our CI builds have intermittent failures in our online tests, e.g. with
the message "A provided buffer was too small". This is not a programming
error in libgit2 but rather an error in the SChannel component of
Windows. Under certain circumstances involving Diffie-Hellman key
exchange, SChannel is unable to correctly handle input from the server.
This bug has already been fixed in recent patches for Windows 10 and
Windows Server 2016, but they are not yet available for AppVeyor.

Manually pamper over that issue by disabling all ciphersuites using DHE
via the registry. While this disables more ciphers than necessary, we
really don't care for that at all but just want to avoid build failures
due to that bug.

See [1], [2] or [3] for additional information.

1: https://github.com/aws/aws-sdk-cpp/issues/671
2: https://github.com/dotnet/corefx/issues/7812
3: https://support.microsoft.com/en-us/help/2992611/ms14-066-vulnerability-in-schannel-could-allow-remote-code-execution-n
(cherry picked from commit 723e1e976d4a038d89940ecbcfb7ff685d204859)
---
 appveyor.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/appveyor.yml b/appveyor.yml
index 9b14a9c81..58f35ffa0 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -43,6 +43,11 @@ build_script:
     if "%GENERATOR%"=="MSYS Makefiles" (C:\MinGW\msys\1.0\bin\sh --login /c/projects/libgit2/script/appveyor-mingw.sh)
 test_script:
 - ps: |
+    # Disable DHE key exchange to fix intermittent build failures ("A buffer
+    # provided was too small") due to SChannel bug. See e.g.
+    # - https://github.com/aws/aws-sdk-cpp/issues/671
+    # - https://github.com/dotnet/corefx/issues/7812
+    New-Item HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithm\Diffie-Hellman -Force | New-ItemProperty -Name Enabled -Value 0 -Force
     $ErrorActionPreference="Stop"
     Start-FileDownload https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -FileName poxyproxy.jar
     # Run this early so we know it's ready by the time we need it
-- 
cgit v1.2.1


From 306ffba3308c2169acda3c4f318c487fb3b504fe Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Tue, 3 Apr 2018 12:31:35 +0100
Subject: appveyor: fix typo in registry key to disable DHE

Commit 723e1e976 (appveyor: disable DHE to avoid spurious failures,
2018-03-29) added a workaround to fix spurious test failures due to a
bug in Windows' SChannel implementation. The workaround only worked by
accident, though, as the registry key was in fact mistyped. Fix the
typo.

(cherry picked from commit 3a72b0e2569c03ed0bd7ca63572eaf6384a2c81f)
---
 appveyor.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/appveyor.yml b/appveyor.yml
index 58f35ffa0..f76830cb4 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -47,7 +47,7 @@ test_script:
     # provided was too small") due to SChannel bug. See e.g.
     # - https://github.com/aws/aws-sdk-cpp/issues/671
     # - https://github.com/dotnet/corefx/issues/7812
-    New-Item HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithm\Diffie-Hellman -Force | New-ItemProperty -Name Enabled -Value 0 -Force
+    New-Item HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman -Force | New-ItemProperty -Name Enabled -Value 0 -Force
     $ErrorActionPreference="Stop"
     Start-FileDownload https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -FileName poxyproxy.jar
     # Run this early so we know it's ready by the time we need it
-- 
cgit v1.2.1


From e5278f704ce1b1a090f2013ee3cea2b912c08e87 Mon Sep 17 00:00:00 2001
From: Yoney <alper_yoney@hotmail.com>
Date: Sat, 11 Nov 2017 15:38:27 +0000
Subject: clar: verify command line arguments before execute

When executing `libgit2_clar -smerge -invalid_option`, it will first execute
the merge test suite and afterwards output help because of the invalid option.

With this changa, it verifies all options before execute. If there are any
invalid options, it will output help and exit without actually executing
the test suites.

(cherry picked from commit 3275863134122892e2f8a8aa4ad0ce1c123a48ec)
---
 tests/clar.c | 11 +++++++++--
 1 file changed, 9 insertions(+), 2 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index 905d67db7..d5212d1ca 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -313,11 +313,18 @@ clar_parse_args(int argc, char **argv)
 {
 	int i;
 
+	/* Verify options before execute */
 	for (i = 1; i < argc; ++i) {
 		char *argument = argv[i];
 
-		if (argument[0] != '-')
+		if (argument[0] != '-' || argument[1] == '\0'
+		    || strchr("sixvqQl", argument[1]) == NULL) {
 			clar_usage(argv[0]);
+		}
+	}
+
+	for (i = 1; i < argc; ++i) {
+		char *argument = argv[i];
 
 		switch (argument[1]) {
 		case 's':
@@ -391,7 +398,7 @@ clar_parse_args(int argc, char **argv)
 			break;
 
 		default:
-			clar_usage(argv[0]);
+			assert(!"Unexpected commandline argument!");
 		}
 	}
 }
-- 
cgit v1.2.1


From e42f8f7363bf06f437608dcf4c277f8123d57c34 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:14 +0200
Subject: travis: split testing from building

(cherry picked from commit 2f4e7cb0e8c21cc2d673946eddf9278c2863427b)
---
 .travis.yml       |  1 +
 script/cibuild.sh | 74 -------------------------------------------------
 script/citest.sh  | 83 +++++++++++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 74 deletions(-)
 create mode 100755 script/citest.sh

diff --git a/.travis.yml b/.travis.yml
index d2782ca00..ca8d85149 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -65,6 +65,7 @@ install:
 # Run the Build script and tests
 script:
  - script/cibuild.sh
+ - script/citest.sh
 
 # Run Tests
 after_success:
diff --git a/script/cibuild.sh b/script/cibuild.sh
index 5d70e7506..42705b154 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -21,82 +21,8 @@ if [ "$TRAVIS_OS_NAME" = "osx" ]; then
 	mount -t hfs $device $CLAR_TMP
 fi
 
-# Should we ask Travis to cache this file?
-curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar || exit $?
-# Run this early so we know it's ready by the time we need it
-java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar &
-
 mkdir _build
 cd _build
 # shellcheck disable=SC2086
 cmake .. -DBUILD_EXAMPLES=ON -DCMAKE_INSTALL_PREFIX=../_install $OPTIONS || exit $?
 make -j2 install || exit $?
-
-# If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ];
-then
-	exit $?;
-fi
-
-# Create a test repo which we can use for the online::push tests
-mkdir "$HOME"/_temp
-git init --bare "$HOME"/_temp/test.git
-git daemon --listen=localhost --export-all --enable=receive-pack --base-path="$HOME"/_temp "$HOME"/_temp 2>/dev/null &
-export GITTEST_REMOTE_URL="git://localhost/test.git"
-
-# Run the test suite
-ctest -V -R libgit2_clar || exit $?
-
-# Now that we've tested the raw git protocol, let's set up ssh to we
-# can do the push tests over it
-
-killall git-daemon
-
-# Set up sshd
-mkdir ~/sshd/
-cat >~/sshd/sshd_config<<-EOF
-	Port 2222
-	ListenAddress 0.0.0.0
-	Protocol 2
-	HostKey ${HOME}/sshd/id_rsa
-	PidFile ${HOME}/sshd/pid
-	RSAAuthentication yes
-	PasswordAuthentication yes
-	PubkeyAuthentication yes
-	ChallengeResponseAuthentication no
-	# Required here as sshd will simply close connection otherwise
-	UsePAM no
-EOF
-ssh-keygen -t rsa -f ~/sshd/id_rsa -N "" -q
-/usr/sbin/sshd -f ~/sshd/sshd_config
-
-# Set up keys
-ssh-keygen -t rsa -f ~/.ssh/id_rsa -N "" -q
-cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys
-while read algorithm key comment; do
-    echo "[localhost]:2222 $algorithm $key" >>~/.ssh/known_hosts
-done <~/sshd/id_rsa.pub
-
-# Get the fingerprint for localhost and remove the colons so we can parse it as
-# a hex number. The Mac version is newer so it has a different output format.
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
-else
-    export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
-fi
-
-# Use the SSH server
-export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
-export GITTEST_REMOTE_USER=$USER
-export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
-export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
-export GITTEST_REMOTE_SSH_PASSPHRASE=""
-ctest -V -R libgit2_clar-ssh || exit $?
-
-# Use the proxy we started at the beginning
-export GITTEST_REMOTE_PROXY_URL="localhost:8080"
-export GITTEST_REMOTE_PROXY_USER="foo"
-export GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R libgit2_clar-proxy_credentials || exit $?
-
-kill $(cat "$HOME/sshd/pid")
diff --git a/script/citest.sh b/script/citest.sh
new file mode 100755
index 000000000..6be26e298
--- /dev/null
+++ b/script/citest.sh
@@ -0,0 +1,83 @@
+#!/bin/sh
+
+set -x
+
+# If this platform doesn't support test execution, bail out now
+if [ -n "$SKIP_TESTS" ];
+then
+	exit $?;
+fi
+
+if [ ! -d _build ]; then
+	echo "no _build dir found; you should run cibuild.sh first"
+	exit 1
+fi
+cd _build
+
+# Should we ask Travis to cache this file?
+curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar || exit $?
+# Run this early so we know it's ready by the time we need it
+java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar &
+
+# Create a test repo which we can use for the online::push tests
+mkdir "$HOME"/_temp
+git init --bare "$HOME"/_temp/test.git
+git daemon --listen=localhost --export-all --enable=receive-pack --base-path="$HOME"/_temp "$HOME"/_temp 2>/dev/null &
+export GITTEST_REMOTE_URL="git://localhost/test.git"
+
+# Run the test suite
+ctest -V -R libgit2_clar || exit $?
+
+# Now that we've tested the raw git protocol, let's set up ssh to we
+# can do the push tests over it
+
+killall git-daemon
+
+# Set up sshd
+mkdir ~/sshd/
+cat >~/sshd/sshd_config<<-EOF
+	Port 2222
+	ListenAddress 0.0.0.0
+	Protocol 2
+	HostKey ${HOME}/sshd/id_rsa
+	PidFile ${HOME}/sshd/pid
+	RSAAuthentication yes
+	PasswordAuthentication yes
+	PubkeyAuthentication yes
+	ChallengeResponseAuthentication no
+	# Required here as sshd will simply close connection otherwise
+	UsePAM no
+EOF
+ssh-keygen -t rsa -f ~/sshd/id_rsa -N "" -q
+/usr/sbin/sshd -f ~/sshd/sshd_config
+
+# Set up keys
+ssh-keygen -t rsa -f ~/.ssh/id_rsa -N "" -q
+cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys
+while read algorithm key comment; do
+	echo "[localhost]:2222 $algorithm $key" >>~/.ssh/known_hosts
+done <~/sshd/id_rsa.pub
+
+# Get the fingerprint for localhost and remove the colons so we can parse it as
+# a hex number. The Mac version is newer so it has a different output format.
+if [ "$TRAVIS_OS_NAME" = "osx" ]; then
+	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
+else
+	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+fi
+
+# Use the SSH server
+export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
+export GITTEST_REMOTE_USER=$USER
+export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
+export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
+export GITTEST_REMOTE_SSH_PASSPHRASE=""
+ctest -V -R libgit2_clar-ssh || exit $?
+
+# Use the proxy we started at the beginning
+export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+export GITTEST_REMOTE_PROXY_USER="foo"
+export GITTEST_REMOTE_PROXY_PASS="bar"
+ctest -V -R libgit2_clar-proxy_credentials || exit $?
+
+kill $(cat "$HOME/sshd/pid")
-- 
cgit v1.2.1


From 243ee6c6338595af2a2365a0bd5109c697f5f8fe Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:16 +0200
Subject: travis: split valgrind check in its own script

(cherry picked from commit 74b0a4320726cb557bcf73f47ba25ee10c430066)
---
 .travis.yml       |  5 +----
 script/cileaks.sh | 13 +++++++++++++
 2 files changed, 14 insertions(+), 4 deletions(-)
 create mode 100755 script/cileaks.sh

diff --git a/.travis.yml b/.travis.yml
index ca8d85149..70ba9e50b 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -66,10 +66,7 @@ install:
 script:
  - script/cibuild.sh
  - script/citest.sh
-
-# Run Tests
-after_success:
- - if [ "$TRAVIS_OS_NAME" = "linux" -a -n "$VALGRIND" ]; then valgrind --leak-check=full --show-reachable=yes --suppressions=./libgit2_clar.supp _build/libgit2_clar -ionline; fi
+ - script/cileaks.sh
 
 # Only watch the development and master branches
 branches:
diff --git a/script/cileaks.sh b/script/cileaks.sh
new file mode 100755
index 000000000..1946e8cb0
--- /dev/null
+++ b/script/cileaks.sh
@@ -0,0 +1,13 @@
+#!/bin/sh
+
+set -x
+
+# If this platform doesn't support test execution, bail out now
+if [ -n "$SKIP_TESTS" ];
+then
+	exit $?;
+fi
+
+if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
+	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline
+fi
-- 
cgit v1.2.1


From 727183c75cdffb4ccd9c9882b350763df42af729 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:17 +0200
Subject: valgrind: silence curl_global_init leaks

==18109== 664 bytes in 1 blocks are still reachable in loss record 279 of 339
==18109==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==18109==    by 0x675B120: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==18109==    by 0x675C13C: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==18109==    by 0x675C296: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==18109==    by 0x679BD14: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==18109==    by 0x679CC64: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==18109==    by 0x6A64946: ??? (in /usr/lib/x86_64-linux-gnu/libgnutls.so.26.22.6)
==18109==    by 0x6A116E8: ??? (in /usr/lib/x86_64-linux-gnu/libgnutls.so.26.22.6)
==18109==    by 0x6A01114: gnutls_global_init (in /usr/lib/x86_64-linux-gnu/libgnutls.so.26.22.6)
==18109==    by 0x52A6C78: ??? (in /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4.3.0)
==18109==    by 0x5285ADC: curl_global_init (in /usr/lib/x86_64-linux-gnu/libcurl-gnutls.so.4.3.0)
==18109==    by 0x663524: git_curl_stream_global_init (curl.c:44)

(cherry picked from commit c0c9e9eeee5b4577eb930f56b8ddaf788f809067)
---
 libgit2_clar.supp | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/libgit2_clar.supp b/libgit2_clar.supp
index bd22ada46..17d105343 100644
--- a/libgit2_clar.supp
+++ b/libgit2_clar.supp
@@ -47,3 +47,10 @@
 	...
 	fun:__check_pf
 }
+
+{
+	ignore-curl-global-init
+	Memcheck:Leak
+	...
+	fun:curl_global_init
+}
-- 
cgit v1.2.1


From 16a2fc530339c3a13fbcb8f767a1efd816049776 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:19 +0200
Subject: valgrind: skip buf::oom test

(cherry picked from commit 573c408921e02f61501b2982fc10af77a8412631)
---
 script/cileaks.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/cileaks.sh b/script/cileaks.sh
index 1946e8cb0..6b53984d9 100755
--- a/script/cileaks.sh
+++ b/script/cileaks.sh
@@ -9,5 +9,5 @@ then
 fi
 
 if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
-	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline
+	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
 fi
-- 
cgit v1.2.1


From 70df0721a03c69a6d14e357a6356c9192f17310a Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:20 +0200
Subject: valgrind: silence libssh2 leaking something from gcrypt

==2957== 912 bytes in 19 blocks are still reachable in loss record 323 of 369
==2957==    at 0x4C2AB80: malloc (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==2957==    by 0x675B120: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x675BDF8: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x675FE0D: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x6761DC4: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x676477E: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x675B071: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x675B544: ??? (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x675914B: gcry_control (in /lib/x86_64-linux-gnu/libgcrypt.so.11.8.2)
==2957==    by 0x5D30EC9: libssh2_init (in /usr/lib/x86_64-linux-gnu/libssh2.so.1.0.1)
==2957==    by 0x66BCCD: git_transport_ssh_global_init (ssh.c:910)
==2957==    by 0x616443: init_common (global.c:65)

(cherry picked from commit dd75885ab45a590ff20404a3a0f20a1148cd4f64)
---
 libgit2_clar.supp | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/libgit2_clar.supp b/libgit2_clar.supp
index 17d105343..be876f4f9 100644
--- a/libgit2_clar.supp
+++ b/libgit2_clar.supp
@@ -54,3 +54,11 @@
 	...
 	fun:curl_global_init
 }
+
+{
+	ignore-libssh2-gcrypt-leak
+	Memcheck:Leak
+	...
+	fun:gcry_control
+	obj:*libssh2.so*
+}
-- 
cgit v1.2.1


From 6b63e4bf1342f4e79fc7b6659aad55c909c7812f Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:22 +0200
Subject: valgrind: silence invalid free in libc atexit handler

==17851== Invalid free() / delete / delete[] / realloc()
==17851==    at 0x4C2BDEC: free (in /usr/lib/valgrind/vgpreload_memcheck-amd64-linux.so)
==17851==    by 0x60BBE2B: __libc_freeres (in /lib/x86_64-linux-gnu/libc-2.19.so)
==17851==    by 0x4A256BC: _vgnU_freeres (in /usr/lib/valgrind/vgpreload_core-amd64-linux.so)
==17851==    by 0x5F8F16A: __run_exit_handlers (exit.c:97)
==17851==    by 0x5F8F1F4: exit (exit.c:104)
==17851==    by 0x5F74F4B: (below main) (libc-start.c:321)
==17851==  Address 0x63153c0 is 0 bytes inside data symbol "noai6ai_cached"

(cherry picked from commit 234443e38be92ce14cff8574050f4714485a0102)
---
 libgit2_clar.supp | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/libgit2_clar.supp b/libgit2_clar.supp
index be876f4f9..0cc89b57f 100644
--- a/libgit2_clar.supp
+++ b/libgit2_clar.supp
@@ -62,3 +62,13 @@
 	fun:gcry_control
 	obj:*libssh2.so*
 }
+
+{
+	ignore-noai6ai_cached-double-free
+	Memcheck:Free
+	fun:free
+	fun:__libc_freeres
+	...
+	fun:exit
+	...
+}
-- 
cgit v1.2.1


From 4e7bff0d1fc6d34c0ecb2616a80ba96f541fa480 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:23 +0200
Subject: travis: let cmake perform the build & install step

The goal is to let cmake manage the parallelism

(cherry picked from commit 1f4ada2a428c8d4af3cc0f12086700cda6e19e3a)
---
 script/cibuild.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 42705b154..43ca976cc 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -25,4 +25,4 @@ mkdir _build
 cd _build
 # shellcheck disable=SC2086
 cmake .. -DBUILD_EXAMPLES=ON -DCMAKE_INSTALL_PREFIX=../_install $OPTIONS || exit $?
-make -j2 install || exit $?
+cmake --build . --target install || exit $?
-- 
cgit v1.2.1


From 1ef1895756a27f6e5ed99511f5725cf031a66722 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:25 +0200
Subject: valgrind: bump num-callers to 50 for fuller stack traces

(cherry picked from commit 0fb8c1d09ca55751aec5f42bae9a3bc19da3248d)
---
 script/cileaks.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/script/cileaks.sh b/script/cileaks.sh
index 6b53984d9..61b255712 100755
--- a/script/cileaks.sh
+++ b/script/cileaks.sh
@@ -9,5 +9,5 @@ then
 fi
 
 if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
-	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
+	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
 fi
-- 
cgit v1.2.1


From 84656a18f9ce6444e13f921faa5943a8869fc2e6 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:27 +0200
Subject: scripts: use leaks on macOS

(cherry picked from commit 4c969618f6ec6caa8facd199c3a6de0e6b06396f)
---
 script/cileaks.sh | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/script/cileaks.sh b/script/cileaks.sh
index 61b255712..ab35e0a03 100755
--- a/script/cileaks.sh
+++ b/script/cileaks.sh
@@ -10,4 +10,6 @@ fi
 
 if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
 	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
+elif [ -n "$LEAKS" -a -e "$(which leaks)" ]; then
+	MallocStackLogging=1 MallocScribble=1 leaks -atExit -- _build/libgit2_clar -ionline
 fi
-- 
cgit v1.2.1


From 590d46d6870039195d8becd13169ad016569de6e Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 20 Apr 2018 23:11:28 +0200
Subject: scripts: remove extraneous semicolons

(cherry picked from commit 149790b96eda8a1e48408decf92ba327479c2c33)
---
 script/cibuild.sh | 7 +++----
 script/cileaks.sh | 2 +-
 script/citest.sh  | 5 ++---
 3 files changed, 6 insertions(+), 8 deletions(-)

diff --git a/script/cibuild.sh b/script/cibuild.sh
index 43ca976cc..c062c112e 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -2,10 +2,9 @@
 
 set -x
 
-if [ -n "$COVERITY" ];
-then
-	./script/coverity.sh;
-	exit $?;
+if [ -n "$COVERITY" ]; then
+	./script/coverity.sh
+	exit $?
 fi
 
 if [ "$TRAVIS_OS_NAME" = "osx" ]; then
diff --git a/script/cileaks.sh b/script/cileaks.sh
index ab35e0a03..4163613af 100755
--- a/script/cileaks.sh
+++ b/script/cileaks.sh
@@ -5,7 +5,7 @@ set -x
 # If this platform doesn't support test execution, bail out now
 if [ -n "$SKIP_TESTS" ];
 then
-	exit $?;
+	exit $?
 fi
 
 if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
diff --git a/script/citest.sh b/script/citest.sh
index 6be26e298..7e6cdb7d7 100755
--- a/script/citest.sh
+++ b/script/citest.sh
@@ -3,9 +3,8 @@
 set -x
 
 # If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ];
-then
-	exit $?;
+if [ -n "$SKIP_TESTS" ]; then
+	exit $?
 fi
 
 if [ ! -d _build ]; then
-- 
cgit v1.2.1


From 5c4b7472da2993b8d13d211cf1f1978456985509 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 26 Oct 2018 13:49:48 +0200
Subject: tests: simplify cmake test configuration

Simplify the names for the tests, removing the unnecessary
"libgit2-clar" prefix.  Make "all" the new default test run, and include
the online tests by default (since HTTPS should always be enabled).

For the CI tests, create an offline-only test, then the various online
tests.

(cherry picked from commit ce798b256b071f57bfd62664626c10339b3e36f7)
---
 CMakeLists.txt   | 13 +++++--------
 appveyor.yml     |  5 +++--
 script/citest.sh |  8 +++++---
 3 files changed, 13 insertions(+), 13 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 97c19a5d7..2eca57d42 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -703,15 +703,12 @@ IF (BUILD_CLAR)
 	ENDIF ()
 
 	ENABLE_TESTING()
-	IF (WINHTTP OR OPENSSL_FOUND OR SECURITY_FOUND)
-		ADD_TEST(libgit2_clar libgit2_clar -ionline -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
-	ELSE ()
-		ADD_TEST(libgit2_clar libgit2_clar -v -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
-	ENDIF ()
 
-	# Add additional test targets that require special setup
-	ADD_TEST(libgit2_clar-proxy_credentials libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
-	ADD_TEST(libgit2_clar-ssh libgit2_clar -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+	ADD_TEST(offline   libgit2_clar -v -xonline)
+	ADD_TEST(online    libgit2_clar -v -sonline)
+	ADD_TEST(gitdaemon libgit2_clar -v -sonline::push)
+	ADD_TEST(ssh       libgit2_clar -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+	ADD_TEST(proxy     libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
 ENDIF ()
 
 IF (TAGS)
diff --git a/appveyor.yml b/appveyor.yml
index f76830cb4..5eac5f1b4 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -52,9 +52,10 @@ test_script:
     Start-FileDownload https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -FileName poxyproxy.jar
     # Run this early so we know it's ready by the time we need it
     $proxyJob = Start-Job { java -jar $Env:APPVEYOR_BUILD_FOLDER\build\poxyproxy.jar -d --port 8080 --credentials foo:bar }
-    ctest -V -R libgit2_clar
+    ctest -V -R offline
+    ctest -V -R online
     Receive-Job -Job $proxyJob
     $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
     $env:GITTEST_REMOTE_PROXY_USER = "foo"
     $env:GITTEST_REMOTE_PROXY_PASS = "bar"
-    ctest -V -R libgit2_clar-proxy_credentials
+    ctest -V -R proxy
diff --git a/script/citest.sh b/script/citest.sh
index 7e6cdb7d7..281c01a78 100755
--- a/script/citest.sh
+++ b/script/citest.sh
@@ -25,7 +25,9 @@ git daemon --listen=localhost --export-all --enable=receive-pack --base-path="$H
 export GITTEST_REMOTE_URL="git://localhost/test.git"
 
 # Run the test suite
-ctest -V -R libgit2_clar || exit $?
+ctest -V -R offline || exit $?
+ctest -V -R online || exit $?
+ctest -V -R gitdaemon || exit $?
 
 # Now that we've tested the raw git protocol, let's set up ssh to we
 # can do the push tests over it
@@ -71,12 +73,12 @@ export GITTEST_REMOTE_USER=$USER
 export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
 export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
 export GITTEST_REMOTE_SSH_PASSPHRASE=""
-ctest -V -R libgit2_clar-ssh || exit $?
+ctest -V -R ssh || exit $?
 
 # Use the proxy we started at the beginning
 export GITTEST_REMOTE_PROXY_URL="localhost:8080"
 export GITTEST_REMOTE_PROXY_USER="foo"
 export GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R libgit2_clar-proxy_credentials || exit $?
+ctest -V -R proxy || exit $?
 
 kill $(cat "$HOME/sshd/pid")
-- 
cgit v1.2.1


From faeb081c9d844dc0c1cf4c73a5f6e173b6995ea6 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:22:16 +0100
Subject: ci: Windows PowerShell build script

(cherry picked from commit 3b6281fac165bd910abe7e961e5e65168723a187)
---
 ci/build.ps1 | 50 ++++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 50 insertions(+)
 create mode 100644 ci/build.ps1

diff --git a/ci/build.ps1 b/ci/build.ps1
new file mode 100644
index 000000000..12cc4fb54
--- /dev/null
+++ b/ci/build.ps1
@@ -0,0 +1,50 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+if ($Env:SOURCE_DIR) { $SourceDirectory = $Env:SOURCE_DIR } else { $SourceDirectory = Split-Path (Split-Path $MyInvocation.MyCommand.Path -Parent) -Parent }
+$BuildDirectory = $(Get-Location).Path
+
+Write-Host "Source directory: ${SourceDirectory}"
+Write-Host "Build directory:  ${BuildDirectory}"
+Write-Host ""
+Write-Host "Operating system version:"
+Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, BuildNumber, OSArchitecture | Format-List
+Write-Host "PATH:"
+Write-Host "${Env:PATH}"
+Write-Host ""
+
+Write-Host "##############################################################################"
+Write-Host "## Configuring build environment"
+Write-Host "##############################################################################"
+
+cmake $SourceDirectory -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Building libgit2"
+Write-Host "##############################################################################"
+
+cmake --build .
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+if ($Env:SKIP_TESTS) { exit }
+
+Write-Host ""
+Write-Host "#######################################################################"
+Write-Host "## Running (offline) tests"
+Write-Host "#######################################################################"
+
+ctest -V -R offline
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "#######################################################################"
+Write-Host "## Running (online) tests"
+Write-Host "#######################################################################"
+
+ctest -V -R online
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
-- 
cgit v1.2.1


From ce3dd8fcf1f0d8962d83429ed8f14e1b3bac997d Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:22:47 +0100
Subject: ci: move tests into citest.ps1

Add citest.ps1 PowerShell script to run the tests.

(cherry picked from commit e2cc5b6d9739591703cfb7f04efa84425ed63332)
---
 ci/build.ps1 | 19 -------------------
 ci/test.ps1  | 45 +++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 45 insertions(+), 19 deletions(-)
 create mode 100644 ci/test.ps1

diff --git a/ci/build.ps1 b/ci/build.ps1
index 12cc4fb54..c5c7c870a 100644
--- a/ci/build.ps1
+++ b/ci/build.ps1
@@ -29,22 +29,3 @@ Write-Host "####################################################################
 
 cmake --build .
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
-
-if ($Env:SKIP_TESTS) { exit }
-
-Write-Host ""
-Write-Host "#######################################################################"
-Write-Host "## Running (offline) tests"
-Write-Host "#######################################################################"
-
-ctest -V -R offline
-if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
-
-Write-Host ""
-Write-Host "#######################################################################"
-Write-Host "## Running (online) tests"
-Write-Host "#######################################################################"
-
-ctest -V -R online
-if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
-
diff --git a/ci/test.ps1 b/ci/test.ps1
new file mode 100644
index 000000000..843df7034
--- /dev/null
+++ b/ci/test.ps1
@@ -0,0 +1,45 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+if ($Env:SKIP_TESTS) { exit }
+
+Write-Host "##############################################################################"
+Write-Host "## Configuring test environment"
+Write-Host "##############################################################################"
+
+Write-Host ""
+Write-Host "Starting HTTP proxy..."
+Invoke-WebRequest -Method GET -Uri https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -OutFile poxyproxy.jar
+javaw -jar poxyproxy.jar -d --port 8080 --credentials foo:bar
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Running (offline) tests"
+Write-Host "##############################################################################"
+
+ctest -V -R offline
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "##############################################################################"
+Write-Host "## Running (online) tests"
+Write-Host "##############################################################################"
+
+ctest -V -R online
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+Write-Host ""
+Write-Host "Running proxy tests"
+Write-Host ""
+
+$Env:GITTEST_REMOTE_PROXY_URL="localhost:8080"
+$Env:GITTEST_REMOTE_PROXY_USER="foo"
+$Env:GITTEST_REMOTE_PROXY_PASS="bar"
+ctest -V -R proxy
+if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+taskkill /F /IM javaw.exe
-- 
cgit v1.2.1


From fb578b036dfd86cbdcf28dfc590c8039be794683 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:24:40 +0100
Subject: ci: refactor unix ci build/test scripts

(cherry picked from commit bf418f09ce20f9e70c416288798bd7054a5e28d0)
---
 ci/build.sh |  37 ++++++++++++++++++++++
 ci/test.sh  | 101 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 138 insertions(+)
 create mode 100755 ci/build.sh
 create mode 100644 ci/test.sh

diff --git a/ci/build.sh b/ci/build.sh
new file mode 100755
index 000000000..39d35f1b5
--- /dev/null
+++ b/ci/build.sh
@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+#
+# Environment variables:
+#
+# SOURCE_DIR: Set to the directory of the libgit2 source (optional)
+#     If not set, it will be derived relative to this script.
+
+set -e
+
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+
+indent() { sed "s/^/    /"; }
+
+echo "Source directory: ${SOURCE_DIR}"
+echo "Build directory:  ${BUILD_DIR}"
+echo ""
+echo "Operating system version:"
+uname -a 2>&1 | indent
+echo "CMake version:"
+cmake --version 2>&1 | indent
+echo "Compiler version:"
+gcc --version 2>&1 | indent
+echo ""
+
+echo "##############################################################################"
+echo "## Configuring build environment"
+echo "##############################################################################"
+
+cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
+
+echo ""
+echo "##############################################################################"
+echo "## Building libgit2"
+echo "##############################################################################"
+
+cmake --build .
diff --git a/ci/test.sh b/ci/test.sh
new file mode 100644
index 000000000..89bf658bf
--- /dev/null
+++ b/ci/test.sh
@@ -0,0 +1,101 @@
+#!/bin/sh
+
+set -e
+
+if [ -n "$SKIP_TESTS" ]; then
+	exit $?
+fi
+
+# Configure the test environment; run them early so that we're certain
+# that they're started by the time we need them.
+
+echo "################################################################################"
+echo "## Configuring test environment"
+echo "################################################################################"
+
+echo "Starting HTTP proxy..."
+curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar
+java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar >/dev/null 2>&1 &
+
+echo "Starting git daemon..."
+GITDAEMON_DIR=`mktemp -d ${TMPDIR}/gitdaemon.XXXXXXXX`
+git init --bare "${GITDAEMON_DIR}/test.git"
+git daemon --listen=localhost --export-all --enable=receive-pack --base-path="${GITDAEMON_DIR}" "${GITDAEMON_DIR}" 2>/dev/null &
+
+echo "Starting ssh daemon..."
+HOME=`mktemp -d ${TMPDIR}/home.XXXXXXXX`
+SSH_DIR="${HOME}/.ssh"
+SSHD_DIR=`mktemp -d ${TMPDIR}/sshd.XXXXXXXX`
+mkdir ${SSH_DIR}
+cat >"${SSHD_DIR}/sshd_config" <<-EOF
+	Port 2222
+	ListenAddress 0.0.0.0
+	Protocol 2
+	HostKey ${SSHD_DIR}/id_rsa
+	PidFile ${SSHD_DIR}/pid
+	RSAAuthentication yes
+	PasswordAuthentication yes
+	PubkeyAuthentication yes
+	ChallengeResponseAuthentication no
+	# Required here as sshd will simply close connection otherwise
+	UsePAM no
+EOF
+ssh-keygen -t rsa -f "${SSHD_DIR}/id_rsa" -N "" -q
+/usr/sbin/sshd -f "${SSHD_DIR}/sshd_config"
+
+# Set up keys
+ssh-keygen -t rsa -f "${SSH_DIR}/id_rsa" -N "" -q
+cat "${SSH_DIR}/id_rsa.pub" >>"${SSH_DIR}/authorized_keys"
+while read algorithm key comment; do
+	echo "[localhost]:2222 $algorithm $key" >>"${SSH_DIR}/known_hosts"
+done <"${SSHD_DIR}/id_rsa.pub"
+
+# Get the fingerprint for localhost and remove the colons so we can parse it as
+# a hex number. The Mac version is newer so it has a different output format.
+if [ "$TRAVIS_OS_NAME" = "osx" ]; then
+	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
+else
+	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+fi
+
+# Run the tests that do not require network connectivity.
+
+echo ""
+echo "################################################################################"
+echo "## Running (non-online) tests                                                 ##"
+echo "################################################################################"
+
+#ctest -V -R offline
+
+# Run the various online tests.  The "online" test suite only includes the
+# default online tests that do not require additional configuration.  The
+# "proxy" and "ssh" test suites require further setup.
+
+echo ""
+echo "################################################################################"
+echo "## Running (online) tests                                                     ##"
+echo "################################################################################"
+
+#ctest -V -R online
+
+echo ""
+echo "Running proxy tests"
+echo ""
+
+export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+export GITTEST_REMOTE_PROXY_USER="foo"
+export GITTEST_REMOTE_PROXY_PASS="bar"
+ctest -V -R proxy
+
+echo ""
+echo "Running ssh tests"
+echo ""
+
+export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
+export GITTEST_REMOTE_USER=$USER
+export GITTEST_REMOTE_SSH_KEY="${SSH_DIR}/id_rsa"
+export GITTEST_REMOTE_SSH_PUBKEY="${SSH_DIR}/id_rsa.pub"
+export GITTEST_REMOTE_SSH_PASSPHRASE=""
+ctest -V -R ssh
+
+kill $(cat "${SSHD_DIR}/pid")
-- 
cgit v1.2.1


From b006379835972f536d55f3aa3499831f023ca407 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:25:32 +0100
Subject: ci: improved flexibility for citest.sh

Refactor citest.sh to enable local testing by developers.

(cherry picked from commit 451b001725e4a97f0a9f1ff1d87a2bf5666850a3)
---
 ci/test.sh | 192 ++++++++++++++++++++++++++++++++++++++++---------------------
 1 file changed, 125 insertions(+), 67 deletions(-)
 mode change 100644 => 100755 ci/test.sh

diff --git a/ci/test.sh b/ci/test.sh
old mode 100644
new mode 100755
index 89bf658bf..228901fa9
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -1,101 +1,159 @@
-#!/bin/sh
+#!/usr/bin/env bash
 
 set -e
 
 if [ -n "$SKIP_TESTS" ]; then
-	exit $?
+	exit 0
 fi
 
+cleanup() {
+	echo "Cleaning up..."
+
+	if [ ! -z "$GITDAEMON_DIR" -a -f "${GITDAEMON_DIR}/pid" ]; then
+		kill $(cat "${GITDAEMON_DIR}/pid")
+	fi
+
+	if [ ! -z "$SSHD_DIR" -a -f "${SSHD_DIR}/pid" ]; then
+		kill $(cat "${SSHD_DIR}/pid")
+	fi
+}
+
+die() {
+	cleanup
+	exit $1
+}
+
+TMPDIR=${TMPDIR:-/tmp}
+USER=${USER:-$(whoami)}
+
 # Configure the test environment; run them early so that we're certain
 # that they're started by the time we need them.
 
-echo "################################################################################"
+echo "##############################################################################"
 echo "## Configuring test environment"
-echo "################################################################################"
-
-echo "Starting HTTP proxy..."
-curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar
-java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar >/dev/null 2>&1 &
-
-echo "Starting git daemon..."
-GITDAEMON_DIR=`mktemp -d ${TMPDIR}/gitdaemon.XXXXXXXX`
-git init --bare "${GITDAEMON_DIR}/test.git"
-git daemon --listen=localhost --export-all --enable=receive-pack --base-path="${GITDAEMON_DIR}" "${GITDAEMON_DIR}" 2>/dev/null &
-
-echo "Starting ssh daemon..."
-HOME=`mktemp -d ${TMPDIR}/home.XXXXXXXX`
-SSH_DIR="${HOME}/.ssh"
-SSHD_DIR=`mktemp -d ${TMPDIR}/sshd.XXXXXXXX`
-mkdir ${SSH_DIR}
-cat >"${SSHD_DIR}/sshd_config" <<-EOF
+echo "##############################################################################"
+
+if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+	echo "Starting git daemon..."
+	GITDAEMON_DIR=`mktemp -d ${TMPDIR}/gitdaemon.XXXXXXXX`
+	git init --bare "${GITDAEMON_DIR}/test.git"
+	git daemon --listen=localhost --export-all --enable=receive-pack --pid-file="${GITDAEMON_DIR}/pid" --base-path="${GITDAEMON_DIR}" "${GITDAEMON_DIR}" 2>/dev/null &
+fi
+
+if [ -z "$SKIP_PROXY_TESTS" ]; then
+	echo "Starting HTTP proxy..."
+	curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar
+	java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar >/dev/null 2>&1 &
+fi
+
+if [ -z "$SKIP_SSH_TESTS" ]; then
+	echo "Starting ssh daemon..."
+	HOME=`mktemp -d ${TMPDIR}/home.XXXXXXXX`
+	SSHD_DIR=`mktemp -d ${TMPDIR}/sshd.XXXXXXXX`
+	git init --bare "${SSHD_DIR}/test.git"
+	cat >"${SSHD_DIR}/sshd_config" <<-EOF
 	Port 2222
 	ListenAddress 0.0.0.0
 	Protocol 2
 	HostKey ${SSHD_DIR}/id_rsa
 	PidFile ${SSHD_DIR}/pid
+	AuthorizedKeysFile ${HOME}/.ssh/authorized_keys
+	LogLevel DEBUG
 	RSAAuthentication yes
 	PasswordAuthentication yes
 	PubkeyAuthentication yes
 	ChallengeResponseAuthentication no
+	StrictModes no
 	# Required here as sshd will simply close connection otherwise
 	UsePAM no
-EOF
-ssh-keygen -t rsa -f "${SSHD_DIR}/id_rsa" -N "" -q
-/usr/sbin/sshd -f "${SSHD_DIR}/sshd_config"
-
-# Set up keys
-ssh-keygen -t rsa -f "${SSH_DIR}/id_rsa" -N "" -q
-cat "${SSH_DIR}/id_rsa.pub" >>"${SSH_DIR}/authorized_keys"
-while read algorithm key comment; do
-	echo "[localhost]:2222 $algorithm $key" >>"${SSH_DIR}/known_hosts"
-done <"${SSHD_DIR}/id_rsa.pub"
-
-# Get the fingerprint for localhost and remove the colons so we can parse it as
-# a hex number. The Mac version is newer so it has a different output format.
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
-else
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+	EOF
+	ssh-keygen -t rsa -f "${SSHD_DIR}/id_rsa" -N "" -q
+	/usr/sbin/sshd -f "${SSHD_DIR}/sshd_config" -E "${SSHD_DIR}/log"
+
+	# Set up keys
+	mkdir "${HOME}/.ssh"
+	ssh-keygen -t rsa -f "${HOME}/.ssh/id_rsa" -N "" -q
+	cat "${HOME}/.ssh/id_rsa.pub" >>"${HOME}/.ssh/authorized_keys"
+	while read algorithm key comment; do
+		echo "[localhost]:2222 $algorithm $key" >>"${HOME}/.ssh/known_hosts"
+	done <"${SSHD_DIR}/id_rsa.pub"
+
+	# Get the fingerprint for localhost and remove the colons so we can
+	# parse it as a hex number. Older versions have a different output
+	# format.
+	if [[ $(ssh -V 2>&1) == OpenSSH_6* ]]; then
+		SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -f "${HOME}/.ssh/known_hosts" -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
+	else
+		SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -f "${HOME}/.ssh/known_hosts" -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
+	fi
 fi
 
 # Run the tests that do not require network connectivity.
 
-echo ""
-echo "################################################################################"
-echo "## Running (non-online) tests                                                 ##"
-echo "################################################################################"
+if [ -z "$SKIP_OFFLINE_TESTS" ]; then
+	echo ""
+	echo "##############################################################################"
+	echo "## Running (offline) tests"
+	echo "##############################################################################"
 
-#ctest -V -R offline
+	ctest -V -R offline || die $?
+fi
 
-# Run the various online tests.  The "online" test suite only includes the
-# default online tests that do not require additional configuration.  The
-# "proxy" and "ssh" test suites require further setup.
+if [ -z "$SKIP_ONLINE_TESTS" ]; then
+	# Run the various online tests.  The "online" test suite only includes the
+	# default online tests that do not require additional configuration.  The
+	# "proxy" and "ssh" test suites require further setup.
 
-echo ""
-echo "################################################################################"
-echo "## Running (online) tests                                                     ##"
-echo "################################################################################"
+	echo ""
+	echo "##############################################################################"
+	echo "## Running (online) tests"
+	echo "##############################################################################"
 
-#ctest -V -R online
+	ctest -V -R online || die $?
+fi
 
-echo ""
-echo "Running proxy tests"
-echo ""
+if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
+	echo ""
+	echo "Running gitdaemon tests"
+	echo ""
 
-export GITTEST_REMOTE_PROXY_URL="localhost:8080"
-export GITTEST_REMOTE_PROXY_USER="foo"
-export GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R proxy
+	export GITTEST_REMOTE_URL="git://localhost/test.git"
+	ctest -V -R gitdaemon || die $?
+	unset GITTEST_REMOTE_URL
+fi
 
-echo ""
-echo "Running ssh tests"
-echo ""
+if [ -z "$SKIP_PROXY_TESTS" ]; then
+	echo ""
+	echo "Running proxy tests"
+	echo ""
+
+	export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+	export GITTEST_REMOTE_PROXY_USER="foo"
+	export GITTEST_REMOTE_PROXY_PASS="bar"
+	ctest -V -R proxy || die $?
+	unset GITTEST_REMOTE_PROXY_URL
+	unset GITTEST_REMOTE_PROXY_USER
+	unset GITTEST_REMOTE_PROXY_PASS
+fi
 
-export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
-export GITTEST_REMOTE_USER=$USER
-export GITTEST_REMOTE_SSH_KEY="${SSH_DIR}/id_rsa"
-export GITTEST_REMOTE_SSH_PUBKEY="${SSH_DIR}/id_rsa.pub"
-export GITTEST_REMOTE_SSH_PASSPHRASE=""
-ctest -V -R ssh
+if [ -z "$SKIP_SSH_TESTS" ]; then
+	echo ""
+	echo "Running ssh tests"
+	echo ""
+
+	export GITTEST_REMOTE_URL="ssh://localhost:2222/$SSHD_DIR/test.git"
+	export GITTEST_REMOTE_USER=$USER
+	export GITTEST_REMOTE_SSH_KEY="${HOME}/.ssh/id_rsa"
+	export GITTEST_REMOTE_SSH_PUBKEY="${HOME}/.ssh/id_rsa.pub"
+	export GITTEST_REMOTE_SSH_PASSPHRASE=""
+	export GITTEST_REMOTE_SSH_FINGERPRINT="${SSH_FINGERPRINT}"
+	ctest -V -R ssh || die $?
+	unset GITTEST_REMOTE_URL
+	unset GITTEST_REMOTE_USER
+	unset GITTEST_REMOTE_SSH_KEY
+	unset GITTEST_REMOTE_SSH_PUBKEY
+	unset GITTEST_REMOTE_SSH_PASSPHRASE
+	unset GITTEST_REMOTE_SSH_FINGERPRINT
+fi
 
-kill $(cat "${SSHD_DIR}/pid")
+cleanup
-- 
cgit v1.2.1


From e0ad161403c05198278e9bdfe03e7aa21a149844 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:34:05 +0100
Subject: ci: setup a linux host

Sets up a linux host to prepare for a build.

(cherry picked from commit 5bb2087b7c60da5c2ce50b9eefeebfbe255c9a0d)
---
 ci/setup-linux.sh | 8 ++++++++
 1 file changed, 8 insertions(+)
 create mode 100755 ci/setup-linux.sh

diff --git a/ci/setup-linux.sh b/ci/setup-linux.sh
new file mode 100755
index 000000000..5de286668
--- /dev/null
+++ b/ci/setup-linux.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -x
+
+apt-get update
+apt-get -y install build-essential pkg-config cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+
+mkdir -p /var/run/sshd
-- 
cgit v1.2.1


From 6b5881bbb8ad8d1fcaf31585b31773df3ed6dc21 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:35:02 +0100
Subject: ci: set up a macos host

Script to set up dependencies on a macOS build system.

(cherry picked from commit 8734240417a02930593e3a76b56ce6b51441723c)
---
 ci/setup-macos.sh | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100755 ci/setup-macos.sh

diff --git a/ci/setup-macos.sh b/ci/setup-macos.sh
new file mode 100755
index 000000000..a90669185
--- /dev/null
+++ b/ci/setup-macos.sh
@@ -0,0 +1,6 @@
+#!/bin/sh
+
+set -x
+
+brew update
+brew install pkgconfig zlib curl openssl libssh2
-- 
cgit v1.2.1


From a64ce2dad4c0bd697ffd119d0ccd91fb9720ec0e Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 13:03:16 +0100
Subject: ci: scripts to setup mingw build environment

(cherry picked from commit 9e588060d93da064ca288db021def3d81fa13790)
---
 ci/setup-mingw-amd64.ps1 | 20 ++++++++++++++++++++
 ci/setup-mingw-x86.ps1   | 20 ++++++++++++++++++++
 2 files changed, 40 insertions(+)
 create mode 100644 ci/setup-mingw-amd64.ps1
 create mode 100644 ci/setup-mingw-x86.ps1

diff --git a/ci/setup-mingw-amd64.ps1 b/ci/setup-mingw-amd64.ps1
new file mode 100644
index 000000000..eaa670968
--- /dev/null
+++ b/ci/setup-mingw-amd64.ps1
@@ -0,0 +1,20 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
+
+Write-Host "##############################################################################"
+Write-Host "## Downloading mingw"
+Write-Host "##############################################################################"
+
+$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-x86_64-8.1.0-release-win32-seh-rt_v6-rev0.zip"
+$platform = "x86_64"
+
+$wc = New-Object net.webclient
+$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${platform}.zip")
+
+[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${platform}.zip", $Env:TEMP)
diff --git a/ci/setup-mingw-x86.ps1 b/ci/setup-mingw-x86.ps1
new file mode 100644
index 000000000..832c0f537
--- /dev/null
+++ b/ci/setup-mingw-x86.ps1
@@ -0,0 +1,20 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
+
+Write-Host "##############################################################################"
+Write-Host "## Downloading mingw"
+Write-Host "##############################################################################"
+
+$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-i686-8.1.0-release-win32-sjlj-rt_v6-rev0.zip"
+$platform = "x86"
+
+$wc = New-Object net.webclient
+$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${platform}.zip")
+
+[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${platform}.zip", $Env:TEMP)
-- 
cgit v1.2.1


From bfb2d7907181f6e561958436394601bceb414b1a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 14 Jul 2018 12:42:50 +0100
Subject: ci: introduce vsts builds

(cherry picked from commit 67f5304f552a287dd46951b8ef96695f080c5ff2)
---
 .vsts-ci.yml | 105 +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
 ci/build.sh  |   1 +
 2 files changed, 106 insertions(+)
 create mode 100644 .vsts-ci.yml

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
new file mode 100644
index 000000000..cbd7f1171
--- /dev/null
+++ b/.vsts-ci.yml
@@ -0,0 +1,105 @@
+resources:
+- repo: self
+
+phases:
+- phase: linux_trusty_openssl
+  displayName: 'Linux (Trusty; OpenSSL)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: macos
+  displayName: 'macOS'
+  queue:
+    name: 'Hosted macOS Preview'
+  steps:
+  - bash: . '$(Build.SourcesDirectory)/ci/setup-macos.sh'
+    displayName: Setup
+  - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
+    displayName: Build
+    env:
+      PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
+  - bash: . '$(Build.SourcesDirectory)/ci/test.sh'
+    displayName: Test
+    env:
+      TMPDIR: $(Agent.TempDirectory)
+
+- phase: windows_vs_amd64
+  displayName: 'Windows (Visual Studio; amd64)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"Visual Studio 12 2013 Win64"
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_vs_x86
+  displayName: 'Windows (Visual Studio; x86)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"Visual Studio 12 2013"
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_mingw_amd64
+  displayName: 'Windows (MinGW; amd64)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw-amd64.ps1'
+    displayName: Setup
+    env:
+      TEMP: $(Agent.TempDirectory)
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"MinGW Makefiles"
+      PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
+
+- phase: windows_mingw_x86
+  displayName: 'Windows (MinGW; x86)'
+  queue:
+    name: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw-x86.ps1'
+    displayName: Setup
+    env:
+      TEMP: $(Agent.TempDirectory)
+  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+    displayName: Build
+    env:
+      CMAKE_OPTIONS: -G"MinGW Makefiles"
+      PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
+  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+    displayName: Test
diff --git a/ci/build.sh b/ci/build.sh
index 39d35f1b5..45f074810 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -27,6 +27,7 @@ echo "##########################################################################
 echo "## Configuring build environment"
 echo "##############################################################################"
 
+echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
 cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
 
 echo ""
-- 
cgit v1.2.1


From 586da0db4852da37a40b5c5014a4569613c3cf50 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:07:09 +0200
Subject: ci: valgrind leak-checking

(cherry picked from commit 6d6700d23860d21e8e5043e5c7689a6ed4d8fc70)
---
 .vsts-ci.yml |  1 +
 ci/test.sh   | 33 ++++++++++++++++++++++++++-------
 2 files changed, 27 insertions(+), 7 deletions(-)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index cbd7f1171..32bab549f 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -26,6 +26,7 @@ phases:
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
+      envVars: 'LEAK_CHECK=valgrind'
       workDir: '/build'
       containerCommand: '/src/ci/test.sh'
       detached: false
diff --git a/ci/test.sh b/ci/test.sh
index 228901fa9..fe46fdbf0 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -6,6 +6,13 @@ if [ -n "$SKIP_TESTS" ]; then
 	exit 0
 fi
 
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+TMPDIR=${TMPDIR:-/tmp}
+USER=${USER:-$(whoami)}
+
+VALGRIND="valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=\"$SOURCE_DIR/libgit2_clar.supp\""
+
 cleanup() {
 	echo "Cleaning up..."
 
@@ -23,8 +30,20 @@ die() {
 	exit $1
 }
 
-TMPDIR=${TMPDIR:-/tmp}
-USER=${USER:-$(whoami)}
+# Ask ctest what it would run if we were to invoke it directly.  This lets us manage the
+# test configuration in a single place (tests/CMakeLists.txt) instead of running clar
+# here as well.  But it allows us to wrap our test harness with a leak checker like valgrind.
+run_test() {
+	TEST_CMD=$(ctest -N -V -R $1 | sed -n 's/^[0-9]*: Test command: //p')
+
+	if [ "$LEAK_CHECK" = "valgrind" ]; then
+		RUNNER="$VALGRIND $TEST_CMD"
+	else
+		RUNNER="$TEST_CMD"
+	fi
+
+	eval $RUNNER || die $?
+}
 
 # Configure the test environment; run them early so that we're certain
 # that they're started by the time we need them.
@@ -96,7 +115,7 @@ if [ -z "$SKIP_OFFLINE_TESTS" ]; then
 	echo "## Running (offline) tests"
 	echo "##############################################################################"
 
-	ctest -V -R offline || die $?
+	run_test offline
 fi
 
 if [ -z "$SKIP_ONLINE_TESTS" ]; then
@@ -109,7 +128,7 @@ if [ -z "$SKIP_ONLINE_TESTS" ]; then
 	echo "## Running (online) tests"
 	echo "##############################################################################"
 
-	ctest -V -R online || die $?
+	run_test online
 fi
 
 if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
@@ -118,7 +137,7 @@ if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
 	echo ""
 
 	export GITTEST_REMOTE_URL="git://localhost/test.git"
-	ctest -V -R gitdaemon || die $?
+	run_test gitdaemon
 	unset GITTEST_REMOTE_URL
 fi
 
@@ -130,7 +149,7 @@ if [ -z "$SKIP_PROXY_TESTS" ]; then
 	export GITTEST_REMOTE_PROXY_URL="localhost:8080"
 	export GITTEST_REMOTE_PROXY_USER="foo"
 	export GITTEST_REMOTE_PROXY_PASS="bar"
-	ctest -V -R proxy || die $?
+	run_test proxy
 	unset GITTEST_REMOTE_PROXY_URL
 	unset GITTEST_REMOTE_PROXY_USER
 	unset GITTEST_REMOTE_PROXY_PASS
@@ -147,7 +166,7 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	export GITTEST_REMOTE_SSH_PUBKEY="${HOME}/.ssh/id_rsa.pub"
 	export GITTEST_REMOTE_SSH_PASSPHRASE=""
 	export GITTEST_REMOTE_SSH_FINGERPRINT="${SSH_FINGERPRINT}"
-	ctest -V -R ssh || die $?
+	run_test ssh
 	unset GITTEST_REMOTE_URL
 	unset GITTEST_REMOTE_USER
 	unset GITTEST_REMOTE_SSH_KEY
-- 
cgit v1.2.1


From 69e864331c553306710854ec656e29dedac255f4 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 14:14:16 -0700
Subject: buf tests: allocate a smaller size for the oom

On Linux (where we run valgrind) allocate a smaller buffer, but still an
insanely large size.  This will cause malloc to fail but will not cause
valgrind to report a likely error with a negative-sized malloc.

Keep the original buffer size on non-Linux platforms: this is
well-tested on them and changing it may be problematic.  On macOS, for
example, using the new size causes `malloc` to print a warning to
stderr.

(cherry picked from commit 219512e7989340d9efae8480fb79c08b91724014)
---
 tests/buf/oom.c | 18 +++++++++++++++---
 1 file changed, 15 insertions(+), 3 deletions(-)

diff --git a/tests/buf/oom.c b/tests/buf/oom.c
index b9fd29cbb..16a03cc1a 100644
--- a/tests/buf/oom.c
+++ b/tests/buf/oom.c
@@ -1,10 +1,22 @@
 #include "clar_libgit2.h"
 #include "buffer.h"
 
-#if defined(GIT_ARCH_64)
-#define TOOBIG 0xffffffffffffff00
+/*
+ * We want to use some ridiculous size that `malloc` will fail with
+ * but that does not otherwise interfere with testing.  On Linux, choose
+ * a number that is large enough to fail immediately but small enough
+ * that valgrind doesn't believe it to erroneously be a negative number.
+ * On macOS, choose a number that is large enough to fail immediately
+ * without having libc print warnings to stderr.
+ */
+#if defined(GIT_ARCH_64) && defined(__linux__)
+# define TOOBIG 0x0fffffffffffffff
+#elif defined(__linux__)
+# define TOOBIG 0x0fffffff
+#elif defined(GIT_ARCH_64)
+# define TOOBIG 0xffffffffffffff00
 #else
-#define TOOBIG 0xffffff00
+# define TOOBIG 0xffffff00
 #endif
 
 /**
-- 
cgit v1.2.1


From f659263840679d69e7c8c25c976b9188c528f633 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 17:20:15 -0700
Subject: ci: xcode leaks leak-checking

(cherry picked from commit 7f12c12394ce3f5b76a32a312461e95fe9e78ce7)
---
 ci/test.sh | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/ci/test.sh b/ci/test.sh
index fe46fdbf0..361479b68 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -12,6 +12,7 @@ TMPDIR=${TMPDIR:-/tmp}
 USER=${USER:-$(whoami)}
 
 VALGRIND="valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=\"$SOURCE_DIR/libgit2_clar.supp\""
+LEAKS="MallocStackLogging=1 MallocScribble=1 leaks -quiet -atExit --"
 
 cleanup() {
 	echo "Cleaning up..."
@@ -38,6 +39,9 @@ run_test() {
 
 	if [ "$LEAK_CHECK" = "valgrind" ]; then
 		RUNNER="$VALGRIND $TEST_CMD"
+	elif [ "$LEAK_CHECK" = "leaks" ]; then
+		RUNNER="$LEAKS $TEST_CMD"
+		echo $RUNNER
 	else
 		RUNNER="$TEST_CMD"
 	fi
-- 
cgit v1.2.1


From 91cbbf8d2b6bb6363cd47e95e064d52083ab7ae0 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 18:09:38 -0700
Subject: ci: msvc leak-checking

(cherry picked from commit afecd15cf6de53b8a0d28061fd9ffaeac358b91f)
---
 .vsts-ci.yml | 4 ++--
 ci/build.ps1 | 5 ++---
 2 files changed, 4 insertions(+), 5 deletions(-)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 32bab549f..fecbf52c0 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -55,7 +55,7 @@ phases:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
     env:
-      CMAKE_OPTIONS: -G"Visual Studio 12 2013 Win64"
+      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
 
@@ -67,7 +67,7 @@ phases:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
     env:
-      CMAKE_OPTIONS: -G"Visual Studio 12 2013"
+      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
 
diff --git a/ci/build.ps1 b/ci/build.ps1
index c5c7c870a..159c1dd1b 100644
--- a/ci/build.ps1
+++ b/ci/build.ps1
@@ -11,15 +11,14 @@ Write-Host "Build directory:  ${BuildDirectory}"
 Write-Host ""
 Write-Host "Operating system version:"
 Get-CimInstance Win32_OperatingSystem | Select-Object Caption, Version, ServicePackMajorVersion, BuildNumber, OSArchitecture | Format-List
-Write-Host "PATH:"
-Write-Host "${Env:PATH}"
+Write-Host "PATH: ${Env:PATH}"
 Write-Host ""
 
 Write-Host "##############################################################################"
 Write-Host "## Configuring build environment"
 Write-Host "##############################################################################"
 
-cmake $SourceDirectory -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}
+Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}"
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
 
 Write-Host ""
-- 
cgit v1.2.1


From 1ef99442850ab97563f04ea840bf1d355af889fb Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 19:47:40 -0700
Subject: ci: enable leak checking on osx

(cherry picked from commit b00672b9e404adb771601408d4b02711085d6f90)
---
 .vsts-ci.yml               | 1 +
 ci/setup-macos.sh          | 2 ++
 script/install-deps-osx.sh | 2 ++
 3 files changed, 5 insertions(+)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index fecbf52c0..2e2cbed20 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -46,6 +46,7 @@ phases:
     displayName: Test
     env:
       TMPDIR: $(Agent.TempDirectory)
+      LEAK_CHECK: leaks
 
 - phase: windows_vs_amd64
   displayName: 'Windows (Visual Studio; amd64)'
diff --git a/ci/setup-macos.sh b/ci/setup-macos.sh
index a90669185..564910e41 100755
--- a/ci/setup-macos.sh
+++ b/ci/setup-macos.sh
@@ -4,3 +4,5 @@ set -x
 
 brew update
 brew install pkgconfig zlib curl openssl libssh2
+
+ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/script/install-deps-osx.sh b/script/install-deps-osx.sh
index 94314dbaa..8b88f8471 100755
--- a/script/install-deps-osx.sh
+++ b/script/install-deps-osx.sh
@@ -7,3 +7,5 @@ brew install zlib
 brew install curl
 brew install openssl
 brew install libssh2
+
+ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
-- 
cgit v1.2.1


From eee66c03d0c2f73fde6a15dfc74d149da9fa597b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 21 Jul 2018 10:49:23 -0700
Subject: ci: some additional debugging

(cherry picked from commit 230eeda8e464a4675e82007d0c505617a6c243ed)
---
 ci/test.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/ci/test.sh b/ci/test.sh
index 361479b68..013476aa0 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -18,15 +18,21 @@ cleanup() {
 	echo "Cleaning up..."
 
 	if [ ! -z "$GITDAEMON_DIR" -a -f "${GITDAEMON_DIR}/pid" ]; then
+		echo "Stopping git daemon..."
 		kill $(cat "${GITDAEMON_DIR}/pid")
 	fi
 
 	if [ ! -z "$SSHD_DIR" -a -f "${SSHD_DIR}/pid" ]; then
+		echo "Stopping SSH..."
 		kill $(cat "${SSHD_DIR}/pid")
 	fi
+
+	echo "Done."
 }
 
 die() {
+	echo "Test exited with code: $1"
+
 	cleanup
 	exit $1
 }
@@ -179,4 +185,6 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	unset GITTEST_REMOTE_SSH_FINGERPRINT
 fi
 
+echo "Success."
 cleanup
+exit 0
-- 
cgit v1.2.1


From d92cff1985aba56cacb3b183aa422bfb9a9ab0f1 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Wed, 25 Jul 2018 01:04:55 +0100
Subject: ci: dissociate test from leaks process

The leaks process is not good about handling children.  Ensure that its
child is `nohup`ed so that the grandparent shell won't wait for it to
exit.

(cherry picked from commit 6eb97b6ba93019741e7cf6147f0fab05dd3f831d)
---
 ci/test.sh | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/ci/test.sh b/ci/test.sh
index 013476aa0..28f76029a 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -12,7 +12,7 @@ TMPDIR=${TMPDIR:-/tmp}
 USER=${USER:-$(whoami)}
 
 VALGRIND="valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=\"$SOURCE_DIR/libgit2_clar.supp\""
-LEAKS="MallocStackLogging=1 MallocScribble=1 leaks -quiet -atExit --"
+LEAKS="MallocStackLogging=1 MallocScribble=1 leaks -quiet -atExit -- nohup"
 
 cleanup() {
 	echo "Cleaning up..."
@@ -47,7 +47,6 @@ run_test() {
 		RUNNER="$VALGRIND $TEST_CMD"
 	elif [ "$LEAK_CHECK" = "leaks" ]; then
 		RUNNER="$LEAKS $TEST_CMD"
-		echo $RUNNER
 	else
 		RUNNER="$TEST_CMD"
 	fi
-- 
cgit v1.2.1


From e0ce3d9d34cbabc208afdd0640a0854d4adb4fb6 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:07:30 +0200
Subject: ci: perform clang builds on Linux

(cherry picked from commit dc6e80e2ce7c4d1017ce41a67a0df50b29b36cc4)
---
 .vsts-ci.yml      | 39 ++++++++++++++++++++++++++++++++++++---
 ci/build.sh       |  3 ++-
 ci/setup-linux.sh |  2 +-
 3 files changed, 39 insertions(+), 5 deletions(-)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 2e2cbed20..0bdb98d12 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -2,8 +2,8 @@ resources:
 - repo: self
 
 phases:
-- phase: linux_trusty_openssl
-  displayName: 'Linux (Trusty; OpenSSL)'
+- phase: linux_trusty_gcc_openssl
+  displayName: 'Linux (Trusty; GCC; OpenSSL)'
   queue:
     name: 'Hosted Linux Preview'
   steps:
@@ -26,7 +26,40 @@ phases:
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
-      envVars: 'LEAK_CHECK=valgrind'
+      envVars: |
+       CC=gcc
+       LEAK_CHECK=valgrind
+      workDir: '/build'
+      containerCommand: '/src/ci/test.sh'
+      detached: false
+
+- phase: linux_trusty_clang_openssl
+  displayName: 'Linux (Trusty; Clang; OpenSSL)'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      workDir: '/build'
+      containerCommand: '/src/ci/build.sh'
+      detached: false
+  - task: Docker@0
+    displayName: Test
+    inputs:
+      action: 'Run an image'
+      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       CC=clang
+       LEAK_CHECK=valgrind
       workDir: '/build'
       containerCommand: '/src/ci/test.sh'
       detached: false
diff --git a/ci/build.sh b/ci/build.sh
index 45f074810..a1deab3f2 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -9,6 +9,7 @@ set -e
 
 SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
 BUILD_DIR=$(pwd)
+CC=${CC:-cc}
 
 indent() { sed "s/^/    /"; }
 
@@ -20,7 +21,7 @@ uname -a 2>&1 | indent
 echo "CMake version:"
 cmake --version 2>&1 | indent
 echo "Compiler version:"
-gcc --version 2>&1 | indent
+$CC --version 2>&1 | indent
 echo ""
 
 echo "##############################################################################"
diff --git a/ci/setup-linux.sh b/ci/setup-linux.sh
index 5de286668..03e4a1d2f 100755
--- a/ci/setup-linux.sh
+++ b/ci/setup-linux.sh
@@ -3,6 +3,6 @@
 set -x
 
 apt-get update
-apt-get -y install build-essential pkg-config cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
 
 mkdir -p /var/run/sshd
-- 
cgit v1.2.1


From a9d1f73713eb8d2bc3522ba737a38f1db15ca531 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:07:48 +0200
Subject: ci: use docker containers from libgit2 account

(cherry picked from commit 6fb63c9285b79bc2c6b67845273abdc7eaacaa1c)
---
 .vsts-ci.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 0bdb98d12..d5c556839 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -11,7 +11,7 @@ phases:
     displayName: Build
     inputs:
       action: 'Run an image'
-      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      imageName: 'libgit2/trusty-openssl:latest'
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
@@ -22,7 +22,7 @@ phases:
     displayName: Test
     inputs:
       action: 'Run an image'
-      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      imageName: 'libgit2/trusty-openssl:latest'
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
@@ -42,7 +42,7 @@ phases:
     displayName: Build
     inputs:
       action: 'Run an image'
-      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      imageName: 'libgit2/trusty-openssl:latest'
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
@@ -53,7 +53,7 @@ phases:
     displayName: Test
     inputs:
       action: 'Run an image'
-      imageName: 'ethomson/libgit2-trusty-openssl:latest'
+      imageName: 'libgit2/trusty-openssl:latest'
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
-- 
cgit v1.2.1


From 2d22fffc25e666f7a961527588ad6e10a78931f6 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 26 Jul 2018 15:06:01 +0100
Subject: ci: use a single setup script for mingw

(cherry picked from commit f7bb4ff80bfa5e5173232685b13f143b572f36de)
---
 .vsts-ci.yml             |  6 ++++--
 ci/setup-mingw-amd64.ps1 | 20 --------------------
 ci/setup-mingw-x86.ps1   | 20 --------------------
 ci/setup-mingw.ps1       | 25 +++++++++++++++++++++++++
 4 files changed, 29 insertions(+), 42 deletions(-)
 delete mode 100644 ci/setup-mingw-amd64.ps1
 delete mode 100644 ci/setup-mingw-x86.ps1
 create mode 100644 ci/setup-mingw.ps1

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index d5c556839..633390654 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -110,10 +110,11 @@ phases:
   queue:
     name: Hosted
   steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw-amd64.ps1'
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
     env:
       TEMP: $(Agent.TempDirectory)
+      ARCH: amd64
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
     env:
@@ -127,10 +128,11 @@ phases:
   queue:
     name: Hosted
   steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw-x86.ps1'
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
     env:
       TEMP: $(Agent.TempDirectory)
+      ARCH: x86
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
     env:
diff --git a/ci/setup-mingw-amd64.ps1 b/ci/setup-mingw-amd64.ps1
deleted file mode 100644
index eaa670968..000000000
--- a/ci/setup-mingw-amd64.ps1
+++ /dev/null
@@ -1,20 +0,0 @@
-Set-StrictMode -Version Latest
-
-$ErrorActionPreference = "Stop"
-$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
-
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
-
-Write-Host "##############################################################################"
-Write-Host "## Downloading mingw"
-Write-Host "##############################################################################"
-
-$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-x86_64-8.1.0-release-win32-seh-rt_v6-rev0.zip"
-$platform = "x86_64"
-
-$wc = New-Object net.webclient
-$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${platform}.zip")
-
-[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${platform}.zip", $Env:TEMP)
diff --git a/ci/setup-mingw-x86.ps1 b/ci/setup-mingw-x86.ps1
deleted file mode 100644
index 832c0f537..000000000
--- a/ci/setup-mingw-x86.ps1
+++ /dev/null
@@ -1,20 +0,0 @@
-Set-StrictMode -Version Latest
-
-$ErrorActionPreference = "Stop"
-$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
-
-[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
-
-[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
-
-Write-Host "##############################################################################"
-Write-Host "## Downloading mingw"
-Write-Host "##############################################################################"
-
-$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-i686-8.1.0-release-win32-sjlj-rt_v6-rev0.zip"
-$platform = "x86"
-
-$wc = New-Object net.webclient
-$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${platform}.zip")
-
-[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${platform}.zip", $Env:TEMP)
diff --git a/ci/setup-mingw.ps1 b/ci/setup-mingw.ps1
new file mode 100644
index 000000000..76ecd3987
--- /dev/null
+++ b/ci/setup-mingw.ps1
@@ -0,0 +1,25 @@
+Set-StrictMode -Version Latest
+
+$ErrorActionPreference = "Stop"
+$PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
+
+[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
+
+[Reflection.Assembly]::LoadWithPartialName("System.IO.Compression.FileSystem");
+
+Write-Host "##############################################################################"
+Write-Host "## Downloading mingw"
+Write-Host "##############################################################################"
+
+if ($env:ARCH -eq "amd64") {
+	$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-x86_64-8.1.0-release-win32-seh-rt_v6-rev0.zip"
+	$platform = "x86_64"
+} else {
+	$mingw_uri = "https://bintray.com/libgit2/build-dependencies/download_file?file_path=mingw-w64-i686-8.1.0-release-win32-sjlj-rt_v6-rev0.zip"
+	$platform = "x86"
+}
+
+$wc = New-Object net.webclient
+$wc.Downloadfile($mingw_uri, "${Env:TEMP}/mingw-${Env:ARCH}.zip")
+
+[System.IO.Compression.ZipFile]::ExtractToDirectory("${Env:TEMP}/mingw-${Env:ARCH}.zip", $Env:TEMP)
-- 
cgit v1.2.1


From 60f5d780e82e26b30af076cf1594793dc005691b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 26 Jul 2018 15:14:37 +0100
Subject: ci: move appveyor to new scripts

(cherry picked from commit 465f8b5163cdee708a6ee81a7c210b2a8baedde4)
---
 appveyor.yml             | 59 +++++++++++++++++-------------------------------
 script/appveyor-mingw.sh | 23 -------------------
 2 files changed, 21 insertions(+), 61 deletions(-)
 delete mode 100755 script/appveyor-mingw.sh

diff --git a/appveyor.yml b/appveyor.yml
index 5eac5f1b4..d89e3fb6c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -10,52 +10,35 @@ environment:
 
   matrix:
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    GENERATOR: "Visual Studio 10 2010"
-    ARCH: 32
+    CMAKE_OPTIONS: -G"Visual Studio 10 2010"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    GENERATOR: "Visual Studio 10 2010 Win64"
-    ARCH: 64
+    CMAKE_OPTIONS: -G"Visual Studio 10 2010 Win64"
+    ARCH: amd64
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "Visual Studio 14 2015"
-    ARCH: 32
+    CMAKE_OPTIONS: -G"Visual Studio 14 2015"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "Visual Studio 14 2015 Win64"
-    ARCH: 64
+    CMAKE_OPTIONS: -G"Visual Studio 14 2015 Win64"
+    ARCH: amd64
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "MSYS Makefiles"
-    ARCH: i686 # this is for 32-bit MinGW-w64
+    CMAKE_OPTIONS: -G"MinGW Makefiles"
+    ARCH: x86
   - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    GENERATOR: "MSYS Makefiles"
-    ARCH: 64
-cache:
-- i686-4.9.2-release-win32-sjlj-rt_v3-rev1.7z
-- x86_64-4.9.2-release-win32-seh-rt_v3-rev1.7z
+    CMAKE_OPTIONS: -G"MinGW Makefiles"
+    ARCH: amd64
 
-build_script:
+install:
+- set PATH=%TEMP%\mingw64\bin;%TEMP%\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
 - ps: |
     mkdir build
     cd build
-    if ($env:GENERATOR -ne "MSYS Makefiles") {
-      cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON -D MSVC_CRTDBG=ON .. -G"$env:GENERATOR"
-      cmake --build . --config Debug
+    if ($env:CMAKE_OPTIONS -eq '-G"MinGW Makefiles"') {
+      ../ci/setup-mingw.ps1
     }
-- cmd: |
-    if "%GENERATOR%"=="MSYS Makefiles" (C:\MinGW\msys\1.0\bin\sh --login /c/projects/libgit2/script/appveyor-mingw.sh)
+
+build_script:
+- cmd: powershell ../ci/build.ps1
+
 test_script:
-- ps: |
-    # Disable DHE key exchange to fix intermittent build failures ("A buffer
-    # provided was too small") due to SChannel bug. See e.g.
-    # - https://github.com/aws/aws-sdk-cpp/issues/671
-    # - https://github.com/dotnet/corefx/issues/7812
-    New-Item HKLM:\SYSTEM\CurrentControlSet\Control\SecurityProviders\SCHANNEL\KeyExchangeAlgorithms\Diffie-Hellman -Force | New-ItemProperty -Name Enabled -Value 0 -Force
-    $ErrorActionPreference="Stop"
-    Start-FileDownload https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -FileName poxyproxy.jar
-    # Run this early so we know it's ready by the time we need it
-    $proxyJob = Start-Job { java -jar $Env:APPVEYOR_BUILD_FOLDER\build\poxyproxy.jar -d --port 8080 --credentials foo:bar }
-    ctest -V -R offline
-    ctest -V -R online
-    Receive-Job -Job $proxyJob
-    $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
-    $env:GITTEST_REMOTE_PROXY_USER = "foo"
-    $env:GITTEST_REMOTE_PROXY_PASS = "bar"
-    ctest -V -R proxy
+- cmd: powershell ../ci/test.ps1
diff --git a/script/appveyor-mingw.sh b/script/appveyor-mingw.sh
deleted file mode 100755
index 6b2a9425e..000000000
--- a/script/appveyor-mingw.sh
+++ /dev/null
@@ -1,23 +0,0 @@
-#!/bin/sh
-set -e
-cd `dirname "$0"`/..
-if [ "$ARCH" = "i686" ]; then
-  f=i686-4.9.2-release-win32-sjlj-rt_v3-rev1.7z
-  if ! [ -e $f ]; then
-    curl -LsSO http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win32/Personal%20Builds/mingw-builds/4.9.2/threads-win32/sjlj/$f
-  fi
-  7z x $f > /dev/null
-  export PATH=`pwd`/mingw32/bin:$PATH
-else
-  f=x86_64-4.9.2-release-win32-seh-rt_v3-rev1.7z
-  if ! [ -e $f ]; then
-    curl -LsSO http://sourceforge.net/projects/mingw-w64/files/Toolchains%20targetting%20Win64/Personal%20Builds/mingw-builds/4.9.2/threads-win32/seh/$f
-  fi
-  7z x $f > /dev/null
-  export PATH=`pwd`/mingw64/bin:$PATH
-fi
-cd build
-gcc --version
-cmake --version
-cmake -D ENABLE_TRACE=ON -D BUILD_CLAR=ON -D BUILD_EXAMPLES=ON .. -G"$GENERATOR"
-cmake --build . --config RelWithDebInfo
-- 
cgit v1.2.1


From bdafcaf1fad0bb371b40a597819344ea6154397b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 27 Jul 2018 12:31:32 +0100
Subject: ci: move travis to the new scripts

(cherry picked from commit 24b8dd8275adb13acc68281c200623f636690666)
---
 .travis.yml        | 18 ++++++++------
 .vsts-ci.yml       |  2 +-
 ci/coverity.sh     | 68 +++++++++++++++++++++++++++++++++++++++++++++++++++
 ci/setup-linux.sh  |  9 +++++--
 ci/setup-macos.sh  |  8 ------
 ci/setup-osx.sh    |  8 ++++++
 script/coverity.sh | 71 ------------------------------------------------------
 7 files changed, 94 insertions(+), 90 deletions(-)
 create mode 100755 ci/coverity.sh
 delete mode 100755 ci/setup-macos.sh
 create mode 100755 ci/setup-osx.sh
 delete mode 100755 script/coverity.sh

diff --git a/.travis.yml b/.travis.yml
index 70ba9e50b..182801be0 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,9 +16,10 @@ env:
  global:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
+  - SKIP_APT=1
  matrix:
-  - OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
-  - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
+  - CMAKE_OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
+  - CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
 
 dist: trusty
 osx_image: xcode8.3
@@ -52,21 +53,22 @@ matrix:
      dist: trusty
    - compiler: gcc
      env:
-       - VALGRIND=1
-         OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
+       - LEAK_CHECK=valgrind
+         CMAKE_OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
      os: linux
      dist: trusty
  allow_failures:
    - env: COVERITY=1
 
 install:
-  - if [ -f ./script/install-deps-${TRAVIS_OS_NAME}.sh ]; then ./script/install-deps-${TRAVIS_OS_NAME}.sh; fi
+  - if [ -f ./ci/setup-${TRAVIS_OS_NAME}.sh ]; then ./ci/setup-${TRAVIS_OS_NAME}.sh; fi
 
 # Run the Build script and tests
 script:
- - script/cibuild.sh
- - script/citest.sh
- - script/cileaks.sh
+ - mkdir build
+ - cd build
+ - if [ "$COVERITY" ]; then ../ci/coverity.sh; fi
+ - if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi
 
 # Only watch the development and master branches
 branches:
diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 633390654..4879aeab8 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -69,7 +69,7 @@ phases:
   queue:
     name: 'Hosted macOS Preview'
   steps:
-  - bash: . '$(Build.SourcesDirectory)/ci/setup-macos.sh'
+  - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
   - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
     displayName: Build
diff --git a/ci/coverity.sh b/ci/coverity.sh
new file mode 100755
index 000000000..57f411174
--- /dev/null
+++ b/ci/coverity.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+set -e
+
+# Only run this on our branches
+echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
+if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
+then
+	echo "Only analyzing the 'master' brach of the main repository."
+	exit 0
+fi
+
+# Environment check
+[ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
+
+case $(uname -m) in
+	i?86)				BITS=32 ;;
+	amd64|x86_64)	BITS=64 ;;
+esac
+SCAN_TOOL=https://scan.coverity.com/download/cxx/linux${BITS}
+TOOL_BASE=$(pwd)/_coverity-scan
+
+# Install coverity tools
+if [ ! -d "$TOOL_BASE" ]; then
+	echo "Downloading coverity..."
+	mkdir -p "$TOOL_BASE"
+	pushd "$TOOL_BASE"
+	wget -O coverity_tool.tgz $SCAN_TOOL \
+		--post-data "project=libgit2&token=$COVERITY_TOKEN"
+	tar xzf coverity_tool.tgz
+	popd
+	TOOL_DIR=$(find "$TOOL_BASE" -type d -name 'cov-analysis*')
+	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
+fi
+
+cp ../script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
+
+COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
+
+# Configure and build
+cmake .. -DTHREADSAFE=ON
+COVERITY_UNSUPPORTED=1 \
+	$COV_BUILD --dir cov-int \
+	cmake --build .
+
+# Upload results
+tar czf libgit2.tgz cov-int
+SHA=$(git rev-parse --short HEAD)
+
+HTML="$(curl \
+	--silent \
+	--write-out "\n%{http_code}" \
+	--form token="$COVERITY_TOKEN" \
+	--form email=bs@github.com \
+	--form file=@libgit2.tgz \
+	--form version="$SHA" \
+	--form description="Travis build" \
+	https://scan.coverity.com/builds?project=libgit2)"
+# Body is everything up to the last line
+BODY="$(echo "$HTML" | head -n-1)"
+# Status code is the last line
+STATUS_CODE="$(echo "$HTML" | tail -n1)"
+
+echo "${BODY}"
+
+if [ "${STATUS_CODE}" != "201" ]; then
+	echo "Received error code ${STATUS_CODE} from Coverity"
+	exit 1
+fi
diff --git a/ci/setup-linux.sh b/ci/setup-linux.sh
index 03e4a1d2f..a0db14ee0 100755
--- a/ci/setup-linux.sh
+++ b/ci/setup-linux.sh
@@ -1,8 +1,13 @@
 #!/bin/sh
 
+set -e
 set -x
 
-apt-get update
-apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+TMPDIR=${TMPDIR:-/tmp}
+
+if [ -z "$SKIP_APT" ]; then
+	apt-get update
+	apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+fi
 
 mkdir -p /var/run/sshd
diff --git a/ci/setup-macos.sh b/ci/setup-macos.sh
deleted file mode 100755
index 564910e41..000000000
--- a/ci/setup-macos.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-set -x
-
-brew update
-brew install pkgconfig zlib curl openssl libssh2
-
-ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/ci/setup-osx.sh b/ci/setup-osx.sh
new file mode 100755
index 000000000..564910e41
--- /dev/null
+++ b/ci/setup-osx.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -x
+
+brew update
+brew install pkgconfig zlib curl openssl libssh2
+
+ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/script/coverity.sh b/script/coverity.sh
deleted file mode 100755
index 5fe16c031..000000000
--- a/script/coverity.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/bin/bash
-set -e
-
-# Only run this on our branches
-echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
-if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
-then
-	echo "Only analyzing the 'master' brach of the main repository."
-	exit 0
-fi
-
-# Environment check
-[ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
-
-case $(uname -m) in
-	i?86)				BITS=32 ;;
-	amd64|x86_64)	BITS=64 ;;
-esac
-SCAN_TOOL=https://scan.coverity.com/download/cxx/linux${BITS}
-TOOL_BASE=$(pwd)/_coverity-scan
-
-# Install coverity tools
-if [ ! -d "$TOOL_BASE" ]; then
-	echo "Downloading coverity..."
-	mkdir -p "$TOOL_BASE"
-	pushd "$TOOL_BASE"
-	wget -O coverity_tool.tgz $SCAN_TOOL \
-		--post-data "project=libgit2&token=$COVERITY_TOKEN"
-	tar xzf coverity_tool.tgz
-	popd
-	TOOL_DIR=$(find "$TOOL_BASE" -type d -name 'cov-analysis*')
-	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
-fi
-
-cp script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
-
-COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
-
-# Configure and build
-rm -rf _build
-mkdir _build
-cd _build
-cmake .. -DTHREADSAFE=ON
-COVERITY_UNSUPPORTED=1 \
-	$COV_BUILD --dir cov-int \
-	cmake --build .
-
-# Upload results
-tar czf libgit2.tgz cov-int
-SHA=$(git rev-parse --short HEAD)
-
-HTML="$(curl \
-	--silent \
-	--write-out "\n%{http_code}" \
-	--form token="$COVERITY_TOKEN" \
-	--form email=bs@github.com \
-	--form file=@libgit2.tgz \
-	--form version="$SHA" \
-	--form description="Travis build" \
-	https://scan.coverity.com/builds?project=libgit2)"
-# Body is everything up to the last line
-BODY="$(echo "$HTML" | head -n-1)"
-# Status code is the last line
-STATUS_CODE="$(echo "$HTML" | tail -n1)"
-
-echo "${BODY}"
-
-if [ "${STATUS_CODE}" != "201" ]; then
-	echo "Received error code ${STATUS_CODE} from Coverity"
-	exit 1
-fi
-- 
cgit v1.2.1


From a5604c6f891417e442b9d46858af1477dae118f0 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 13:47:12 +0200
Subject: ci: remove unused old ci scripts

(cherry picked from commit 24d175621b7ca6a218c7150ac47ea296f0766fa4)
---
 script/cileaks.sh          | 15 ---------
 script/citest.sh           | 84 ----------------------------------------------
 script/install-deps-osx.sh | 11 ------
 3 files changed, 110 deletions(-)
 delete mode 100755 script/cileaks.sh
 delete mode 100755 script/citest.sh
 delete mode 100755 script/install-deps-osx.sh

diff --git a/script/cileaks.sh b/script/cileaks.sh
deleted file mode 100755
index 4163613af..000000000
--- a/script/cileaks.sh
+++ /dev/null
@@ -1,15 +0,0 @@
-#!/bin/sh
-
-set -x
-
-# If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ];
-then
-	exit $?
-fi
-
-if [ -n "$VALGRIND" -a -e "$(which valgrind)" ]; then
-	valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=./libgit2_clar.supp _build/libgit2_clar $@ -ionline -xbuf::oom
-elif [ -n "$LEAKS" -a -e "$(which leaks)" ]; then
-	MallocStackLogging=1 MallocScribble=1 leaks -atExit -- _build/libgit2_clar -ionline
-fi
diff --git a/script/citest.sh b/script/citest.sh
deleted file mode 100755
index 281c01a78..000000000
--- a/script/citest.sh
+++ /dev/null
@@ -1,84 +0,0 @@
-#!/bin/sh
-
-set -x
-
-# If this platform doesn't support test execution, bail out now
-if [ -n "$SKIP_TESTS" ]; then
-	exit $?
-fi
-
-if [ ! -d _build ]; then
-	echo "no _build dir found; you should run cibuild.sh first"
-	exit 1
-fi
-cd _build
-
-# Should we ask Travis to cache this file?
-curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar || exit $?
-# Run this early so we know it's ready by the time we need it
-java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar &
-
-# Create a test repo which we can use for the online::push tests
-mkdir "$HOME"/_temp
-git init --bare "$HOME"/_temp/test.git
-git daemon --listen=localhost --export-all --enable=receive-pack --base-path="$HOME"/_temp "$HOME"/_temp 2>/dev/null &
-export GITTEST_REMOTE_URL="git://localhost/test.git"
-
-# Run the test suite
-ctest -V -R offline || exit $?
-ctest -V -R online || exit $?
-ctest -V -R gitdaemon || exit $?
-
-# Now that we've tested the raw git protocol, let's set up ssh to we
-# can do the push tests over it
-
-killall git-daemon
-
-# Set up sshd
-mkdir ~/sshd/
-cat >~/sshd/sshd_config<<-EOF
-	Port 2222
-	ListenAddress 0.0.0.0
-	Protocol 2
-	HostKey ${HOME}/sshd/id_rsa
-	PidFile ${HOME}/sshd/pid
-	RSAAuthentication yes
-	PasswordAuthentication yes
-	PubkeyAuthentication yes
-	ChallengeResponseAuthentication no
-	# Required here as sshd will simply close connection otherwise
-	UsePAM no
-EOF
-ssh-keygen -t rsa -f ~/sshd/id_rsa -N "" -q
-/usr/sbin/sshd -f ~/sshd/sshd_config
-
-# Set up keys
-ssh-keygen -t rsa -f ~/.ssh/id_rsa -N "" -q
-cat ~/.ssh/id_rsa.pub >>~/.ssh/authorized_keys
-while read algorithm key comment; do
-	echo "[localhost]:2222 $algorithm $key" >>~/.ssh/known_hosts
-done <~/sshd/id_rsa.pub
-
-# Get the fingerprint for localhost and remove the colons so we can parse it as
-# a hex number. The Mac version is newer so it has a different output format.
-if [ "$TRAVIS_OS_NAME" = "osx" ]; then
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -E md5 -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 3 | cut -d : -f2- | tr -d :)
-else
-	export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
-fi
-
-# Use the SSH server
-export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
-export GITTEST_REMOTE_USER=$USER
-export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
-export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
-export GITTEST_REMOTE_SSH_PASSPHRASE=""
-ctest -V -R ssh || exit $?
-
-# Use the proxy we started at the beginning
-export GITTEST_REMOTE_PROXY_URL="localhost:8080"
-export GITTEST_REMOTE_PROXY_USER="foo"
-export GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R proxy || exit $?
-
-kill $(cat "$HOME/sshd/pid")
diff --git a/script/install-deps-osx.sh b/script/install-deps-osx.sh
deleted file mode 100755
index 8b88f8471..000000000
--- a/script/install-deps-osx.sh
+++ /dev/null
@@ -1,11 +0,0 @@
-#!/bin/sh
-
-set -x
-
-brew update
-brew install zlib
-brew install curl
-brew install openssl
-brew install libssh2
-
-ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
-- 
cgit v1.2.1


From 15256b7b27e21e6140dfc5f33a924a525de6ab20 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 28 Jul 2018 22:29:53 +0100
Subject: ci: run coverity from travis's cron

Instead of trying to run coverity builds during the regular PR process,
run them during a regularly scheduled cron process.  These only need to
run nightly, so it makes sense to bring them out of the PR process.

(cherry picked from commit 6b92368c859d0bf0dcdb15ca8bee520e0f4e84f2)
---
 .travis.yml    |  8 ++------
 ci/coverity.sh | 25 +++++++++++--------------
 2 files changed, 13 insertions(+), 20 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index 182801be0..3b0b3481f 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -47,10 +47,6 @@ matrix:
    - os: osx
      compiler: gcc
  include:
-   - compiler: gcc
-     env: COVERITY=1
-     os: linux
-     dist: trusty
    - compiler: gcc
      env:
        - LEAK_CHECK=valgrind
@@ -67,8 +63,8 @@ install:
 script:
  - mkdir build
  - cd build
- - if [ "$COVERITY" ]; then ../ci/coverity.sh; fi
- - if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi
+ - if [ "$TRAVIS_EVENT_TYPE" = "cron" ]; then ../ci/coverity.sh; fi
+ - if [ "$TRAVIS_EVENT_TYPE" != "cron" ]; then ../ci/build.sh && ../ci/test.sh; fi
 
 # Only watch the development and master branches
 branches:
diff --git a/ci/coverity.sh b/ci/coverity.sh
index 57f411174..ae6d46ef4 100755
--- a/ci/coverity.sh
+++ b/ci/coverity.sh
@@ -1,17 +1,13 @@
 #!/bin/bash
-set -e
 
-# Only run this on our branches
-echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
-if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
-then
-	echo "Only analyzing the 'master' brach of the main repository."
-	exit 0
-fi
+set -e
 
 # Environment check
 [ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
 
+SOURCE_DIR=${SOURCE_DIR:-$( cd "$( dirname "${BASH_SOURCE[0]}" )" && dirname $( pwd ) )}
+BUILD_DIR=$(pwd)
+
 case $(uname -m) in
 	i?86)				BITS=32 ;;
 	amd64|x86_64)	BITS=64 ;;
@@ -32,28 +28,29 @@ if [ ! -d "$TOOL_BASE" ]; then
 	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
 fi
 
-cp ../script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
+cp "${SOURCE_DIR}/script/user_nodefs.h" "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
 
 COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
 
 # Configure and build
-cmake .. -DTHREADSAFE=ON
+cmake ${SOURCE_DIR}
+
 COVERITY_UNSUPPORTED=1 \
 	$COV_BUILD --dir cov-int \
 	cmake --build .
 
 # Upload results
 tar czf libgit2.tgz cov-int
-SHA=$(git rev-parse --short HEAD)
+SHA=$(cd ${SOURCE_DIR} && git rev-parse --short HEAD)
 
 HTML="$(curl \
 	--silent \
 	--write-out "\n%{http_code}" \
 	--form token="$COVERITY_TOKEN" \
-	--form email=bs@github.com \
+	--form email=libgit2@gmail.com \
 	--form file=@libgit2.tgz \
 	--form version="$SHA" \
-	--form description="Travis build" \
+	--form description="libgit2 build" \
 	https://scan.coverity.com/builds?project=libgit2)"
 # Body is everything up to the last line
 BODY="$(echo "$HTML" | head -n-1)"
@@ -62,7 +59,7 @@ STATUS_CODE="$(echo "$HTML" | tail -n1)"
 
 echo "${BODY}"
 
-if [ "${STATUS_CODE}" != "201" ]; then
+if [ "${STATUS_CODE}" != "200" -o "${STATUS_CODE}" != "201" ]; then
 	echo "Received error code ${STATUS_CODE} from Coverity"
 	exit 1
 fi
-- 
cgit v1.2.1


From 892be4c4ea6616c557b810fa22a877c0804c865a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 29 Jul 2018 17:26:44 +0100
Subject: ci: run coverity from a nightly VSTS build

(cherry picked from commit d076db11a84b278e260139269c25fe692930f238)
---
 .vsts-nightly.yml | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)
 create mode 100644 .vsts-nightly.yml

diff --git a/.vsts-nightly.yml b/.vsts-nightly.yml
new file mode 100644
index 000000000..6c5d0ebb4
--- /dev/null
+++ b/.vsts-nightly.yml
@@ -0,0 +1,22 @@
+resources:
+- repo: self
+
+phases:
+- phase: coverity
+  displayName: 'Coverity'
+  queue:
+    name: 'Hosted Linux Preview'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       COVERITY_TOKEN=$(COVERITY_TOKEN)
+      workDir: '/build'
+      containerCommand: '/src/ci/coverity.sh'
+      detached: false
-- 
cgit v1.2.1


From d2f4546e98e76d816b2ef5c770cce481afc6c21f Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 2 Aug 2018 14:47:03 +0100
Subject: ci: set PKG_CONFIG_PATH on travis

Homebrew's formula for openssl is "keg-only", which means it does not
install it into /usr/local.  On macOS builds, we need to set
PKG_CONFIG_PATH to include it.

(cherry picked from commit abf5336304ad7df85bbca2289a61b7799029fa1b)
---
 .travis.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.travis.yml b/.travis.yml
index 3b0b3481f..c36224b21 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,6 +17,7 @@ env:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
   - SKIP_APT=1
+  - PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig
  matrix:
   - CMAKE_OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
   - CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
-- 
cgit v1.2.1


From 0f09c492ed60eba4843b5a08dc6236c737afdb87 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 2 Aug 2018 20:43:21 +0100
Subject: ci: run VSTS builds on master and maint branches

(cherry picked from commit cd7883145f76a24db47dfd911cc8b0b387813c7c)
---
 .vsts-ci.yml | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 4879aeab8..36ce77760 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -1,6 +1,10 @@
 resources:
 - repo: self
 
+trigger:
+- master
+- maint/*
+
 phases:
 - phase: linux_trusty_gcc_openssl
   displayName: 'Linux (Trusty; GCC; OpenSSL)'
-- 
cgit v1.2.1


From 9c4a467d03e94840bdcb272039aa8709d9944453 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Mon, 6 Aug 2018 07:13:56 +0200
Subject: travis: do not execute Coverity analysis for all cron jobs

The new Travis cron job gets executed daily, but our current
configuration will cause each job to execute our Coverity script instead
of the default build and testing scripts. This cannot work, as Coverity
is heavily rate-limiting its API, so our cron builds are doomed to
always fail. What we want to do instead is execute our normal builds,
but add an additional Coverity jobs.

This can easily be done by adding another Coverity-specific job with a
conditional "type = cron", which sets the "COVERITY" environment
variable. Instead of checking the build type, we then simply check
whether "COVERITY" is set or not.

(cherry picked from commit 0a6c13a239ef5e1427d8317b36c202ca9a580754)
---
 .travis.yml | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/.travis.yml b/.travis.yml
index c36224b21..b1a7fcfa1 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -54,8 +54,12 @@ matrix:
          CMAKE_OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
      os: linux
      dist: trusty
- allow_failures:
-   - env: COVERITY=1
+   - compiler: gcc
+     if: type = cron
+     env:
+       - CMAKE_OPTIONS="-DBUILD_CLAR=ON -DCMAKE_BUILD_TYPE=Debug"
+         COVERITY=1
+     os: linux
 
 install:
   - if [ -f ./ci/setup-${TRAVIS_OS_NAME}.sh ]; then ./ci/setup-${TRAVIS_OS_NAME}.sh; fi
@@ -64,8 +68,8 @@ install:
 script:
  - mkdir build
  - cd build
- - if [ "$TRAVIS_EVENT_TYPE" = "cron" ]; then ../ci/coverity.sh; fi
- - if [ "$TRAVIS_EVENT_TYPE" != "cron" ]; then ../ci/build.sh && ../ci/test.sh; fi
+ - if [ -n "$COVERITY" ]; then ../ci/coverity.sh; fi
+ - if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi
 
 # Only watch the development and master branches
 branches:
-- 
cgit v1.2.1


From 445fd84677d4711ea4fffe8f14304e98d5d14b63 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 2 Aug 2018 14:57:54 +0100
Subject: ci: add VSTS build badge to README

(cherry picked from commit a1ae41b80b56cd49ecec049b7d2509f17596e116)
---
 README.md | 1 +
 1 file changed, 1 insertion(+)

diff --git a/README.md b/README.md
index 1bbd37134..a0ea48db5 100644
--- a/README.md
+++ b/README.md
@@ -3,6 +3,7 @@ libgit2 - the Git linkable library
 
 [![Travis Build Status](https://secure.travis-ci.org/libgit2/libgit2.svg?branch=master)](http://travis-ci.org/libgit2/libgit2)
 [![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/xvof5b4t5480a2q3/branch/master?svg=true)](https://ci.appveyor.com/project/libgit2/libgit2/branch/master)
+[![VSTS Build Status](https://libgit2.visualstudio.com/libgit2/_apis/build/status/libgit2)](https://libgit2.visualstudio.com/libgit2/_build/latest?definitionId=7)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/639/badge.svg)](https://scan.coverity.com/projects/639)
 
 `libgit2` is a portable, pure C implementation of the Git core methods
-- 
cgit v1.2.1


From c4dce7b1be1db407d4534f9d2b83367de315a2a4 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 6 Aug 2018 16:33:15 -0500
Subject: ci: remove appveyor

(cherry picked from commit 3ce31df3ff34b494a67f7d18dced9930c69883bd)
---
 appveyor.yml | 44 --------------------------------------------
 1 file changed, 44 deletions(-)
 delete mode 100644 appveyor.yml

diff --git a/appveyor.yml b/appveyor.yml
deleted file mode 100644
index d89e3fb6c..000000000
--- a/appveyor.yml
+++ /dev/null
@@ -1,44 +0,0 @@
-version: '{build}'
-branches:
-  only:
-  - master
-  - appveyor
-  - /^maint.*/
-environment:
-  GITTEST_INVASIVE_FS_STRUCTURE: 1
-  GITTEST_INVASIVE_FS_SIZE: 1
-
-  matrix:
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    CMAKE_OPTIONS: -G"Visual Studio 10 2010"
-    ARCH: x86
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2013
-    CMAKE_OPTIONS: -G"Visual Studio 10 2010 Win64"
-    ARCH: amd64
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    CMAKE_OPTIONS: -G"Visual Studio 14 2015"
-    ARCH: x86
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    CMAKE_OPTIONS: -G"Visual Studio 14 2015 Win64"
-    ARCH: amd64
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    CMAKE_OPTIONS: -G"MinGW Makefiles"
-    ARCH: x86
-  - APPVEYOR_BUILD_WORKER_IMAGE: Visual Studio 2015
-    CMAKE_OPTIONS: -G"MinGW Makefiles"
-    ARCH: amd64
-
-install:
-- set PATH=%TEMP%\mingw64\bin;%TEMP%\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
-- ps: |
-    mkdir build
-    cd build
-    if ($env:CMAKE_OPTIONS -eq '-G"MinGW Makefiles"') {
-      ../ci/setup-mingw.ps1
-    }
-
-build_script:
-- cmd: powershell ../ci/build.ps1
-
-test_script:
-- cmd: powershell ../ci/test.ps1
-- 
cgit v1.2.1


From 72b38a34fc06ebb74364fafd9d53b22c58398b4a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 9 Aug 2018 09:39:39 -0500
Subject: readme: remove appveyor build badge

(cherry picked from commit 658b8e8a59341a7042a839d0417723d494d7b4cb)
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index a0ea48db5..ba3d92fbc 100644
--- a/README.md
+++ b/README.md
@@ -2,7 +2,6 @@ libgit2 - the Git linkable library
 ==================================
 
 [![Travis Build Status](https://secure.travis-ci.org/libgit2/libgit2.svg?branch=master)](http://travis-ci.org/libgit2/libgit2)
-[![AppVeyor Build Status](https://ci.appveyor.com/api/projects/status/xvof5b4t5480a2q3/branch/master?svg=true)](https://ci.appveyor.com/project/libgit2/libgit2/branch/master)
 [![VSTS Build Status](https://libgit2.visualstudio.com/libgit2/_apis/build/status/libgit2)](https://libgit2.visualstudio.com/libgit2/_build/latest?definitionId=7)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/639/badge.svg)](https://scan.coverity.com/projects/639)
 
-- 
cgit v1.2.1


From 778d5f0a727acb733efcc8c551dd3d280174adda Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Tue, 14 Aug 2018 21:26:14 +0200
Subject: ci: Correct the status code check so Coverity doesn't force-fail
 Travis
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Otherwise you get something like

Emitted 525 C/C++ compilation units (100%) successfully

525 C/C++ compilation units (100%) are ready for analysis
The cov-build utility completed successfully.
Build successfully submitted.
Received error code 200 from Coverity

travis_time:end:14cf6373:start=1534254309066933889,finish=1534254728190974302,duration=419124040413
The command "if [ -n "$COVERITY" ]; then ../ci/coverity.sh; fi" exited with 1.
travis_time:start:01ed61d4
$ if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi

travis_time:end:01ed61d4:start=1534254728197560961,finish=1534254728202711214,duration=5150253
The command "if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi" exited with 0.

Done. Your build exited with 1.

(cherry picked from commit 351ca66126b08530d96556eb4521b601c69125e3)
---
 ci/coverity.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/coverity.sh b/ci/coverity.sh
index ae6d46ef4..a97fae8c8 100755
--- a/ci/coverity.sh
+++ b/ci/coverity.sh
@@ -59,7 +59,7 @@ STATUS_CODE="$(echo "$HTML" | tail -n1)"
 
 echo "${BODY}"
 
-if [ "${STATUS_CODE}" != "200" -o "${STATUS_CODE}" != "201" ]; then
+if [ "${STATUS_CODE}" != "200" -a "${STATUS_CODE}" != "201" ]; then
 	echo "Received error code ${STATUS_CODE} from Coverity"
 	exit 1
 fi
-- 
cgit v1.2.1


From cf20bb017b4eec3c22bb540daa60e0baa4d51f34 Mon Sep 17 00:00:00 2001
From: David Staheli <dastahel@microsoft.com>
Date: Fri, 31 Aug 2018 14:07:59 -0400
Subject: Update .vsts-nightly.yml

(cherry picked from commit 40c3a974656a3a9bb0b63e0bb0eb770bb1648303)
---
 .vsts-nightly.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.vsts-nightly.yml b/.vsts-nightly.yml
index 6c5d0ebb4..4d6d8a3e8 100644
--- a/.vsts-nightly.yml
+++ b/.vsts-nightly.yml
@@ -1,11 +1,11 @@
 resources:
 - repo: self
 
-phases:
-- phase: coverity
+jobs:
+- job: coverity
   displayName: 'Coverity'
-  queue:
-    name: 'Hosted Linux Preview'
+  pool:
+    vmImage: 'Ubuntu 16.04'
   steps:
   - task: Docker@0
     displayName: Build
-- 
cgit v1.2.1


From 2d72495bdd90d62f08986980ecee502cea6d3233 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:08:00 +0200
Subject: Update .vsts-ci.yml

(cherry picked from commit 7238a1e8c7e6b48439ce553c99b83915cb33b394)
---
 .vsts-ci.yml | 40 ++++++++++++++++++----------------------
 1 file changed, 18 insertions(+), 22 deletions(-)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 36ce77760..be8cdb344 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -5,11 +5,11 @@ trigger:
 - master
 - maint/*
 
-phases:
-- phase: linux_trusty_gcc_openssl
+jobs:
+- job: linux_trusty_gcc_openssl
   displayName: 'Linux (Trusty; GCC; OpenSSL)'
-  queue:
-    name: 'Hosted Linux Preview'
+  pool:
+    vmImage: 'Ubuntu 16.04'
   steps:
   - task: Docker@0
     displayName: Build
@@ -37,10 +37,10 @@ phases:
       containerCommand: '/src/ci/test.sh'
       detached: false
 
-- phase: linux_trusty_clang_openssl
+- job: linux_trusty_clang_openssl
   displayName: 'Linux (Trusty; Clang; OpenSSL)'
-  queue:
-    name: 'Hosted Linux Preview'
+  pool:
+    vmImage: 'Ubuntu 16.04'
   steps:
   - task: Docker@0
     displayName: Build
@@ -68,10 +68,10 @@ phases:
       containerCommand: '/src/ci/test.sh'
       detached: false
 
-- phase: macos
+- job: macos
   displayName: 'macOS'
-  queue:
-    name: 'Hosted macOS Preview'
+  pool:
+    vmImage: 'macOS 10.13'
   steps:
   - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
@@ -85,10 +85,9 @@ phases:
       TMPDIR: $(Agent.TempDirectory)
       LEAK_CHECK: leaks
 
-- phase: windows_vs_amd64
+- job: windows_vs_amd64
   displayName: 'Windows (Visual Studio; amd64)'
-  queue:
-    name: Hosted
+  pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
@@ -97,10 +96,9 @@ phases:
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
 
-- phase: windows_vs_x86
+- job: windows_vs_x86
   displayName: 'Windows (Visual Studio; x86)'
-  queue:
-    name: Hosted
+  pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
@@ -109,10 +107,9 @@ phases:
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
 
-- phase: windows_mingw_amd64
+- job: windows_mingw_amd64
   displayName: 'Windows (MinGW; amd64)'
-  queue:
-    name: Hosted
+  pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
@@ -127,10 +124,9 @@ phases:
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
 
-- phase: windows_mingw_x86
+- job: windows_mingw_x86
   displayName: 'Windows (MinGW; x86)'
-  queue:
-    name: Hosted
+  pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
-- 
cgit v1.2.1


From dfbf791db6aac27fedfd431e2fbfd697d71dc053 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 30 Aug 2018 21:53:58 +0100
Subject: ci: remove travis

(cherry picked from commit 6fc946e87025f22315c481509b6658726725b7a4)
---
 .travis.yml | 93 -------------------------------------------------------------
 1 file changed, 93 deletions(-)
 delete mode 100644 .travis.yml

diff --git a/.travis.yml b/.travis.yml
deleted file mode 100644
index b1a7fcfa1..000000000
--- a/.travis.yml
+++ /dev/null
@@ -1,93 +0,0 @@
-# Travis-CI Build for libgit2
-# see travis-ci.org for details
-
-language: c
-
-os:
-  - linux
-  - osx
-
-compiler:
-  - gcc
-  - clang
-
-# Settings to try
-env:
- global:
-  - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
-  - GITTEST_INVASIVE_FS_SIZE=1
-  - SKIP_APT=1
-  - PKG_CONFIG_PATH=/usr/local/opt/openssl/lib/pkgconfig
- matrix:
-  - CMAKE_OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
-  - CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
-
-dist: trusty
-osx_image: xcode8.3
-sudo: false
-
-addons:
- apt:
-  sources:
-   - sourceline: 'deb https://dl.bintray.com/libgit2/ci-dependencies trusty libgit2deps'
-     key_url: 'https://bintray.com/user/downloadSubjectPublicKey?username=bintray'
-  packages:
-   cmake
-   curl
-   libcurl3
-   libcurl3-gnutls
-   libcurl4-gnutls-dev
-   libssh2-1-dev
-   openssh-client
-   openssh-server
-   valgrind
-
-matrix:
- fast_finish: true
- exclude:
-   - os: osx
-     compiler: gcc
- include:
-   - compiler: gcc
-     env:
-       - LEAK_CHECK=valgrind
-         CMAKE_OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
-     os: linux
-     dist: trusty
-   - compiler: gcc
-     if: type = cron
-     env:
-       - CMAKE_OPTIONS="-DBUILD_CLAR=ON -DCMAKE_BUILD_TYPE=Debug"
-         COVERITY=1
-     os: linux
-
-install:
-  - if [ -f ./ci/setup-${TRAVIS_OS_NAME}.sh ]; then ./ci/setup-${TRAVIS_OS_NAME}.sh; fi
-
-# Run the Build script and tests
-script:
- - mkdir build
- - cd build
- - if [ -n "$COVERITY" ]; then ../ci/coverity.sh; fi
- - if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi
-
-# Only watch the development and master branches
-branches:
- only:
-   - master
-   - /^maint.*/
-
-# Notify development list when needed
-notifications:
- irc:
-  channels:
-    - irc.freenode.net#libgit2
-  on_success: change
-  on_failure: always
-  use_notice: true
-  skip_join: true
- campfire:
-  on_success: always
-  on_failure: always
-  rooms:
-   - secure: "sH0dpPWMirbEe7AvLddZ2yOp8rzHalGmv0bYL/LIhVw3JDI589HCYckeLMSB\n3e/FeXw4bn0EqXWEXijVa4ijbilVY6d8oprdqMdWHEodng4KvY5vID3iZSGT\nxylhahO1XHmRynKQLOAvxlc93IlpVW38vQfby8giIY1nkpspb2w="
-- 
cgit v1.2.1


From e36455c8d21d180040753bbb4b339d71c9f60cbd Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 3 Sep 2018 19:27:30 +0100
Subject: README: remove travis

(cherry picked from commit 76cfeb20fc75f02eee8e1b672889039be282666f)
---
 README.md | 1 -
 1 file changed, 1 deletion(-)

diff --git a/README.md b/README.md
index ba3d92fbc..82a745293 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,6 @@
 libgit2 - the Git linkable library
 ==================================
 
-[![Travis Build Status](https://secure.travis-ci.org/libgit2/libgit2.svg?branch=master)](http://travis-ci.org/libgit2/libgit2)
 [![VSTS Build Status](https://libgit2.visualstudio.com/libgit2/_apis/build/status/libgit2)](https://libgit2.visualstudio.com/libgit2/_build/latest?definitionId=7)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/639/badge.svg)](https://scan.coverity.com/projects/639)
 
-- 
cgit v1.2.1


From ad3a0f0c5266962b7eb8f4b9161476d0606699e5 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 26 Aug 2018 15:11:21 +0100
Subject: clar: refactor explicitly run test behavior

Previously, supplying `-s` to explicitly enable some test(s) would run
the tests immediately from the argument parser.  This forces us to set
up the entire clar environment (for example: sandboxing) before argument
parsing takes place.

Refactor the behavior of `-s` to add the explicitly chosen tests to a
list that is executed later.  This untangles the argument parsing from
the setup lifecycle, allowing us to use the arguments to perform the
setup.

(cherry picked from commit 90753a96515f85e2d0e79a16d3a06ba5b363c68e)
---
 tests/clar.c | 55 ++++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 44 insertions(+), 11 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index d5212d1ca..bef7c001d 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -106,10 +106,14 @@ struct clar_error {
 	struct clar_error *next;
 };
 
-static struct {
-	int argc;
-	char **argv;
+struct clar_explicit {
+	size_t suite_idx;
+	const char *filter;
+
+	struct clar_explicit *next;
+};
 
+static struct {
 	enum cl_test_status test_status;
 	const char *active_test;
 	const char *active_suite;
@@ -124,6 +128,9 @@ static struct {
 	int exit_on_error;
 	int report_suite_names;
 
+	struct clar_explicit *explicit;
+	struct clar_explicit *last_explicit;
+
 	struct clar_error *errors;
 	struct clar_error *last_error;
 
@@ -359,7 +366,24 @@ clar_parse_args(int argc, char **argv)
 						_clar.report_suite_names = 1;
 
 					switch (action) {
-					case 's': _clar_suites[j].enabled = 1; clar_run_suite(&_clar_suites[j], argument); break;
+					case 's': {
+						struct clar_explicit *explicit =
+							calloc(1, sizeof(struct clar_explicit));
+						assert(explicit);
+
+						explicit->suite_idx = j;
+						explicit->filter = argument;
+
+						if (_clar.explicit == NULL)
+							_clar.explicit = explicit;
+
+						if (_clar.last_explicit != NULL)
+							_clar.last_explicit->next = explicit;
+
+						_clar_suites[j].enabled = 1;
+						_clar.last_explicit = explicit;
+						break;
+					}
 					case 'i': _clar_suites[j].enabled = 1; break;
 					case 'x': _clar_suites[j].enabled = 0; break;
 					}
@@ -412,23 +436,25 @@ clar_test_init(int argc, char **argv)
 		""
 	);
 
+	if (argc > 1)
+		clar_parse_args(argc, argv);
+
 	if (clar_sandbox() < 0) {
 		clar_print_onabort("Failed to sandbox the test runner.\n");
 		exit(-1);
 	}
-
-	_clar.argc = argc;
-	_clar.argv = argv;
 }
 
 int
 clar_test_run(void)
 {
-	if (_clar.argc > 1)
-		clar_parse_args(_clar.argc, _clar.argv);
+	size_t i;
+	struct clar_explicit *explicit;
 
-	if (!_clar.suites_ran) {
-		size_t i;
+	if (_clar.explicit) {
+		for (explicit = _clar.explicit; explicit; explicit = explicit->next)
+			clar_run_suite(&_clar_suites[explicit->suite_idx], explicit->filter);
+	} else {
 		for (i = 0; i < _clar_suite_count; ++i)
 			clar_run_suite(&_clar_suites[i], NULL);
 	}
@@ -439,6 +465,8 @@ clar_test_run(void)
 void
 clar_test_shutdown(void)
 {
+	struct clar_explicit *explicit, *explicit_next;
+
 	clar_print_shutdown(
 		_clar.tests_ran,
 		(int)_clar_suite_count,
@@ -446,6 +474,11 @@ clar_test_shutdown(void)
 	);
 
 	clar_unsandbox();
+
+	for (explicit = _clar.explicit; explicit; explicit = explicit_next) {
+		explicit_next = explicit->next;
+		free(explicit);
+	}
 }
 
 int
-- 
cgit v1.2.1


From d8fd1c722fa0ad0f58903fb376ebcf0183748dfc Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Thu, 26 Jul 2018 23:02:20 +0200
Subject: Isolate test reports

This makes it possible to keep track of every test status (even
successful ones), and their errors, if any.

(cherry picked from commit bf9fc126709af948c2a324ceb1b2696046c91cfe)
---
 tests/clar.c       | 106 +++++++++++++++++++++++++++++++++++++----------------
 tests/clar.h       |   3 +-
 tests/clar/print.h |   9 +++--
 3 files changed, 82 insertions(+), 36 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index bef7c001d..38359dc57 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -95,9 +95,6 @@ static const char *
 fixture_path(const char *base, const char *fixture_name);
 
 struct clar_error {
-	const char *test;
-	int test_number;
-	const char *suite;
 	const char *file;
 	int line_number;
 	const char *error_msg;
@@ -113,8 +110,22 @@ struct clar_explicit {
 	struct clar_explicit *next;
 };
 
+struct clar_report {
+	const char *test;
+	int test_number;
+	const char *suite;
+
+	enum cl_test_status status;
+
+	struct clar_error *errors;
+	struct clar_error *last_error;
+
+	struct clar_report *next;
+};
+
 static struct {
 	enum cl_test_status test_status;
+
 	const char *active_test;
 	const char *active_suite;
 
@@ -131,8 +142,8 @@ static struct {
 	struct clar_explicit *explicit;
 	struct clar_explicit *last_explicit;
 
-	struct clar_error *errors;
-	struct clar_error *last_error;
+	struct clar_report *reports;
+	struct clar_report *last_report;
 
 	void (*local_cleanup)(void *);
 	void *local_cleanup_payload;
@@ -162,7 +173,7 @@ struct clar_suite {
 /* From clar_print_*.c */
 static void clar_print_init(int test_count, int suite_count, const char *suite_names);
 static void clar_print_shutdown(int test_count, int suite_count, int error_count);
-static void clar_print_error(int num, const struct clar_error *error);
+static void clar_print_error(int num, const struct clar_report *report, const struct clar_error *error);
 static void clar_print_ontest(const char *test_name, int test_number, enum cl_test_status failed);
 static void clar_print_onsuite(const char *suite_name, int suite_index);
 static void clar_print_onabort(const char *msg, ...);
@@ -193,21 +204,33 @@ void cl_trace_register(cl_trace_cb *cb, void *payload)
 
 /* Core test functions */
 static void
-clar_report_errors(void)
+clar_report(int *i, struct clar_error *error)
 {
-	int i = 1;
-	struct clar_error *error, *next;
-
-	error = _clar.errors;
 	while (error != NULL) {
-		next = error->next;
-		clar_print_error(i++, error);
-		free(error->description);
-		free(error);
-		error = next;
+		clar_print_error((*i)++, _clar.last_report, error);
+		error = error->next;
 	}
+}
 
-	_clar.errors = _clar.last_error = NULL;
+static void
+clar_report_errors(struct clar_error *error)
+{
+	int i = 1;
+	clar_report(&i, error);
+}
+
+static void
+clar_report_all(void)
+{
+	int i = 1;
+	struct clar_report *report;
+
+	report = _clar.reports;
+	while (report != NULL) {
+		if (report->status == CL_TEST_FAILURE)
+			clar_report(&i, report->errors);
+		report = report->next;
+	}
 }
 
 static void
@@ -216,7 +239,6 @@ clar_run_test(
 	const struct clar_func *initialize,
 	const struct clar_func *cleanup)
 {
-	_clar.test_status = CL_TEST_OK;
 	_clar.trampoline_enabled = 1;
 
 	CL_TRACE(CL_TRACE__TEST__BEGIN);
@@ -232,6 +254,9 @@ clar_run_test(
 
 	_clar.trampoline_enabled = 0;
 
+	if (_clar.last_report->status == CL_TEST_NOTRUN)
+		_clar.last_report->status = CL_TEST_OK;
+
 	if (_clar.local_cleanup != NULL)
 		_clar.local_cleanup(_clar.local_cleanup_payload);
 
@@ -247,9 +272,9 @@ clar_run_test(
 	_clar.local_cleanup_payload = NULL;
 
 	if (_clar.report_errors_only) {
-		clar_report_errors();
+		clar_report_errors(_clar.last_report->errors);
 	} else {
-		clar_print_ontest(test->name, _clar.tests_ran, _clar.test_status);
+		clar_print_ontest(test->name, _clar.tests_ran, _clar.last_report->status);
 	}
 }
 
@@ -258,6 +283,7 @@ clar_run_suite(const struct clar_suite *suite, const char *filter)
 {
 	const struct clar_func *test = suite->tests;
 	size_t i, matchlen;
+	struct clar_report *report;
 
 	if (!suite->enabled)
 		return;
@@ -290,6 +316,21 @@ clar_run_suite(const struct clar_suite *suite, const char *filter)
 			continue;
 
 		_clar.active_test = test[i].name;
+
+		report = calloc(1, sizeof(struct clar_report));
+		report->suite = _clar.active_suite;
+		report->test = _clar.active_test;
+		report->test_number = _clar.tests_ran;
+		report->status = CL_TEST_NOTRUN;
+
+		if (_clar.reports == NULL)
+			_clar.reports = report;
+
+		if (_clar.last_report != NULL)
+			_clar.last_report->next = report;
+
+		_clar.last_report = report;
+
 		clar_run_test(&test[i], &suite->initialize, &suite->cleanup);
 
 		if (_clar.exit_on_error && _clar.total_errors)
@@ -466,6 +507,7 @@ void
 clar_test_shutdown(void)
 {
 	struct clar_explicit *explicit, *explicit_next;
+	struct clar_report *report, *report_next;
 
 	clar_print_shutdown(
 		_clar.tests_ran,
@@ -479,6 +521,11 @@ clar_test_shutdown(void)
 		explicit_next = explicit->next;
 		free(explicit);
 	}
+
+	for (report = _clar.reports; report; report = report_next) {
+		report_next = report->next;
+		free(report);
+	}
 }
 
 int
@@ -498,7 +545,7 @@ static void abort_test(void)
 	if (!_clar.trampoline_enabled) {
 		clar_print_onabort(
 				"Fatal error: a cleanup method raised an exception.");
-		clar_report_errors();
+		clar_report_errors(_clar.last_report->errors);
 		exit(-1);
 	}
 
@@ -508,7 +555,7 @@ static void abort_test(void)
 
 void clar__skip(void)
 {
-	_clar.test_status = CL_TEST_SKIP;
+	_clar.last_report->status = CL_TEST_SKIP;
 	_clar.total_skipped++;
 	abort_test();
 }
@@ -522,17 +569,14 @@ void clar__fail(
 {
 	struct clar_error *error = calloc(1, sizeof(struct clar_error));
 
-	if (_clar.errors == NULL)
-		_clar.errors = error;
+	if (_clar.last_report->errors == NULL)
+		_clar.last_report->errors = error;
 
-	if (_clar.last_error != NULL)
-		_clar.last_error->next = error;
+	if (_clar.last_report->last_error != NULL)
+		_clar.last_report->last_error->next = error;
 
-	_clar.last_error = error;
+	_clar.last_report->last_error = error;
 
-	error->test = _clar.active_test;
-	error->test_number = _clar.tests_ran;
-	error->suite = _clar.active_suite;
 	error->file = file;
 	error->line_number = line;
 	error->error_msg = error_msg;
@@ -541,7 +585,7 @@ void clar__fail(
 		error->description = strdup(description);
 
 	_clar.total_errors++;
-	_clar.test_status = CL_TEST_FAILURE;
+	_clar.last_report->status = CL_TEST_FAILURE;
 
 	if (should_abort)
 		abort_test();
diff --git a/tests/clar.h b/tests/clar.h
index 5c674d70f..a842665c1 100644
--- a/tests/clar.h
+++ b/tests/clar.h
@@ -12,7 +12,8 @@
 enum cl_test_status {
 	CL_TEST_OK,
 	CL_TEST_FAILURE,
-	CL_TEST_SKIP
+	CL_TEST_SKIP,
+	CL_TEST_NOTRUN,
 };
 
 void clar_test_init(int argc, char *argv[]);
diff --git a/tests/clar/print.h b/tests/clar/print.h
index 6529b6b4c..40bdef8c7 100644
--- a/tests/clar/print.h
+++ b/tests/clar/print.h
@@ -13,16 +13,16 @@ static void clar_print_shutdown(int test_count, int suite_count, int error_count
 	(void)error_count;
 
 	printf("\n\n");
-	clar_report_errors();
+	clar_report_all();
 }
 
-static void clar_print_error(int num, const struct clar_error *error)
+static void clar_print_error(int num, const struct clar_report *report, const struct clar_error *error)
 {
 	printf("  %d) Failure:\n", num);
 
 	printf("%s::%s [%s:%d]\n",
-		error->suite,
-		error->test,
+		report->suite,
+		report->test,
 		error->file,
 		error->line_number);
 
@@ -44,6 +44,7 @@ static void clar_print_ontest(const char *test_name, int test_number, enum cl_te
 	case CL_TEST_OK: printf("."); break;
 	case CL_TEST_FAILURE: printf("F"); break;
 	case CL_TEST_SKIP: printf("S"); break;
+	case CL_TEST_NOTRUN: printf("N"); break;
 	}
 
 	fflush(stdout);
-- 
cgit v1.2.1


From a503a9ea424a68ecd9d8ab069e14c1a6b4d3fddb Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Thu, 26 Jul 2018 23:02:34 +0200
Subject: Documentation

(cherry picked from commit 3a9b96311d6f0ff364c6417cf3aab7c9745b18d4)
---
 tests/clar.h | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/clar.h b/tests/clar.h
index a842665c1..bdaab09d7 100644
--- a/tests/clar.h
+++ b/tests/clar.h
@@ -16,10 +16,12 @@ enum cl_test_status {
 	CL_TEST_NOTRUN,
 };
 
+/** Setup clar environment */
 void clar_test_init(int argc, char *argv[]);
 int clar_test_run(void);
 void clar_test_shutdown(void);
 
+/** One shot setup & run */
 int clar_test(int argc, char *argv[]);
 
 const char *clar_sandbox_path(void);
-- 
cgit v1.2.1


From 3c12187d3d1873416733a46455e5521934614c16 Mon Sep 17 00:00:00 2001
From: Etienne Samson <samson.etienne@gmail.com>
Date: Fri, 27 Jul 2018 23:00:09 +0000
Subject: Barebones JUnit XML output

(cherry picked from commit 59f1e477f772c73c76bc654a0853fdcf491a32a7)
---
 tests/clar.c         | 14 +++++++-
 tests/clar/summary.h | 98 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 111 insertions(+), 1 deletion(-)
 create mode 100644 tests/clar/summary.h

diff --git a/tests/clar.c b/tests/clar.c
index 38359dc57..fd5fcb600 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -138,6 +138,7 @@ static struct {
 	int report_errors_only;
 	int exit_on_error;
 	int report_suite_names;
+	int write_summary;
 
 	struct clar_explicit *explicit;
 	struct clar_explicit *last_explicit;
@@ -353,6 +354,7 @@ clar_usage(const char *arg)
 	printf("  -q    \tOnly report tests that had an error\n");
 	printf("  -Q    \tQuit as soon as a test fails\n");
 	printf("  -l    \tPrint suite names\n");
+	printf("  -r    \tWrite summary file\n");
 	exit(-1);
 }
 
@@ -366,7 +368,7 @@ clar_parse_args(int argc, char **argv)
 		char *argument = argv[i];
 
 		if (argument[0] != '-' || argument[1] == '\0'
-		    || strchr("sixvqQl", argument[1]) == NULL) {
+		    || strchr("sixvqQlr", argument[1]) == NULL) {
 			clar_usage(argv[0]);
 		}
 	}
@@ -462,6 +464,10 @@ clar_parse_args(int argc, char **argv)
 			_clar.report_suite_names = 1;
 			break;
 
+		case 'r':
+			_clar.write_summary = 1;
+			break;
+
 		default:
 			assert(!"Unexpected commandline argument!");
 		}
@@ -503,6 +509,8 @@ clar_test_run(void)
 	return _clar.total_errors;
 }
 
+static void clar_summary_write(void);
+
 void
 clar_test_shutdown(void)
 {
@@ -517,6 +525,9 @@ clar_test_shutdown(void)
 
 	clar_unsandbox();
 
+	if (_clar.write_summary)
+		clar_summary_write();
+
 	for (explicit = _clar.explicit; explicit; explicit = explicit_next) {
 		explicit_next = explicit->next;
 		free(explicit);
@@ -730,3 +741,4 @@ void cl_set_cleanup(void (*cleanup)(void *), void *opaque)
 #include "clar/fixtures.h"
 #include "clar/fs.h"
 #include "clar/print.h"
+#include "clar/summary.h"
diff --git a/tests/clar/summary.h b/tests/clar/summary.h
new file mode 100644
index 000000000..e3a5d780e
--- /dev/null
+++ b/tests/clar/summary.h
@@ -0,0 +1,98 @@
+
+#include <stdio.h>
+#include <time.h>
+
+static FILE *summary;
+
+int clar_summary_close_tag(const char *tag, int indent)
+{
+	const char *indt;
+
+	if (indent == 0) indt = "";
+	else if (indent == 1) indt = "\t";
+	else indt = "\t\t";
+
+	return fprintf(summary, "%s</%s>\n", indt, tag);
+}
+
+int clar_summary_testsuites(void)
+{
+	return fprintf(summary, "<testsuites>\n");
+}
+
+int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t timestamp, double time, int test_count, int fail_count, int error_count)
+{
+	struct tm *tm = localtime(&timestamp);
+	char iso_dt[20];
+
+	if (strftime(iso_dt, sizeof(iso_dt), "%FT%T", tm) == 0)
+		return -1;
+
+	return fprintf(summary, "\t<testsuite "
+		       " id=\"%d\""
+		       " name=\"%s\""
+		       " package=\"%s\""
+		       " hostname=\"localhost\""
+		       " timestamp=\"%s\""
+		       " time=\"%.2f\""
+		       " tests=\"%d\""
+		       " failures=\"%d\""
+		       " errors=\"%d\">\n",
+		       idn, name, pkg, iso_dt, time, test_count, fail_count, error_count);
+}
+
+int clar_summary_testcase(const char *name, const char *classname, double time)
+{
+	return fprintf(summary, "\t\t<testcase name=\"%s\" classname=\"%s\" time=\"%.2f\">\n", name, classname, time);
+}
+
+int clar_summary_failure(const char *type, const char *message, const char *desc)
+{
+	return fprintf(summary, "\t\t\t<failure type=\"%s\"><![CDATA[%s\n%s]]></failure>\n", type, message, desc);
+}
+
+void clar_summary_write(void)
+{
+	struct clar_report *report;
+	const char *last_suite = NULL;
+	char wd[1024];
+
+	summary = fopen("summary.xml", "w");
+	if (!summary) {
+		printf("failed to open summary.xml for writing\n");
+		return;
+	}
+
+	clar_summary_testsuites();
+
+	report = _clar.reports;
+	while (report != NULL) {
+		struct clar_error *error = report->errors;
+
+		if (last_suite == NULL || strcmp(last_suite, report->suite) != 0) {
+			clar_summary_testsuite(0, report->suite, "", time(NULL), 0, _clar.tests_ran, _clar.total_errors, 0);
+		}
+
+		last_suite = report->suite;
+
+		clar_summary_testcase(report->test, "what", 0);
+
+		while (error != NULL) {
+			clar_summary_failure("assert", error->error_msg, error->description);
+			error = error->next;
+		}
+
+		clar_summary_close_tag("testcase", 2);
+
+		report = report->next;
+
+		if (!report || strcmp(last_suite, report->suite) != 0)
+			clar_summary_close_tag("testsuite", 1);
+	}
+
+	clar_summary_close_tag("testsuites", 0);
+
+	fclose(summary);
+
+	printf("written summary file to %s\n", getcwd((char *)&wd, sizeof(wd)));
+}
-- 
cgit v1.2.1


From 5e8ac16499de41130dce50ad3016f1dc8d97e37b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 26 Aug 2018 15:25:15 +0100
Subject: clar: don't use a variable named `time`

(cherry picked from commit dbebcb04b42047df0d52ad3515077a134c5b7da7)
---
 tests/clar/summary.h | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/tests/clar/summary.h b/tests/clar/summary.h
index e3a5d780e..452c58c91 100644
--- a/tests/clar/summary.h
+++ b/tests/clar/summary.h
@@ -20,7 +20,7 @@ int clar_summary_testsuites(void)
 	return fprintf(summary, "<testsuites>\n");
 }
 
-int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t timestamp, double time, int test_count, int fail_count, int error_count)
+int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t timestamp, double elapsed, int test_count, int fail_count, int error_count)
 {
 	struct tm *tm = localtime(&timestamp);
 	char iso_dt[20];
@@ -38,12 +38,12 @@ int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t ti
 		       " tests=\"%d\""
 		       " failures=\"%d\""
 		       " errors=\"%d\">\n",
-		       idn, name, pkg, iso_dt, time, test_count, fail_count, error_count);
+		       idn, name, pkg, iso_dt, elapsed, test_count, fail_count, error_count);
 }
 
-int clar_summary_testcase(const char *name, const char *classname, double time)
+int clar_summary_testcase(const char *name, const char *classname, double elapsed)
 {
-	return fprintf(summary, "\t\t<testcase name=\"%s\" classname=\"%s\" time=\"%.2f\">\n", name, classname, time);
+	return fprintf(summary, "\t\t<testcase name=\"%s\" classname=\"%s\" time=\"%.2f\">\n", name, classname, elapsed);
 }
 
 int clar_summary_failure(const char *type, const char *message, const char *desc)
-- 
cgit v1.2.1


From d95d220181c8cd5e7e9a3163aa591a9dcf3c914d Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 26 Aug 2018 15:31:14 +0100
Subject: clar: accept a value for the summary filename

Accept an (optional) value for the summary filename.  Continues to
default to summary.xml.

(cherry picked from commit baa5c20d0815441cac2d2135d2b0190cb543e637)
---
 tests/clar.c         | 16 +++++++++++++---
 tests/clar/summary.h | 21 ++++++++++++---------
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index fd5fcb600..3eecd7810 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -139,6 +139,7 @@ static struct {
 	int exit_on_error;
 	int report_suite_names;
 	int write_summary;
+	const char *summary_file;
 
 	struct clar_explicit *explicit;
 	struct clar_explicit *last_explicit;
@@ -183,6 +184,10 @@ static void clar_print_onabort(const char *msg, ...);
 static void clar_unsandbox(void);
 static int clar_sandbox(void);
 
+/* From summary.h */
+static int clar_summary_init(const char *filename);
+static void clar_summary_shutdown(void);
+
 /* Load the declarations for the test suite */
 #include "clar.suite"
 
@@ -466,6 +471,8 @@ clar_parse_args(int argc, char **argv)
 
 		case 'r':
 			_clar.write_summary = 1;
+			_clar.summary_file = *(argument + 2) ? (argument + 2) :
+			    "summary.xml";
 			break;
 
 		default:
@@ -486,6 +493,11 @@ clar_test_init(int argc, char **argv)
 	if (argc > 1)
 		clar_parse_args(argc, argv);
 
+	if (_clar.write_summary && !clar_summary_init(_clar.summary_file)) {
+		clar_print_onabort("Failed to open the summary file: %s\n");
+		exit(-1);
+	}
+
 	if (clar_sandbox() < 0) {
 		clar_print_onabort("Failed to sandbox the test runner.\n");
 		exit(-1);
@@ -509,8 +521,6 @@ clar_test_run(void)
 	return _clar.total_errors;
 }
 
-static void clar_summary_write(void);
-
 void
 clar_test_shutdown(void)
 {
@@ -526,7 +536,7 @@ clar_test_shutdown(void)
 	clar_unsandbox();
 
 	if (_clar.write_summary)
-		clar_summary_write();
+		clar_summary_shutdown();
 
 	for (explicit = _clar.explicit; explicit; explicit = explicit_next) {
 		explicit_next = explicit->next;
diff --git a/tests/clar/summary.h b/tests/clar/summary.h
index 452c58c91..a6a475fb7 100644
--- a/tests/clar/summary.h
+++ b/tests/clar/summary.h
@@ -2,6 +2,7 @@
 #include <stdio.h>
 #include <time.h>
 
+static const char *filename;
 static FILE *summary;
 
 int clar_summary_close_tag(const char *tag, int indent)
@@ -51,17 +52,19 @@ int clar_summary_failure(const char *type, const char *message, const char *desc
 	return fprintf(summary, "\t\t\t<failure type=\"%s\"><![CDATA[%s\n%s]]></failure>\n", type, message, desc);
 }
 
-void clar_summary_write(void)
+int clar_summary_init(const char *fn)
+{
+	filename = fn;
+
+	summary = fopen(filename, "w");
+
+	return !!summary;
+}
+
+void clar_summary_shutdown(void)
 {
 	struct clar_report *report;
 	const char *last_suite = NULL;
-	char wd[1024];
-
-	summary = fopen("summary.xml", "w");
-	if (!summary) {
-		printf("failed to open summary.xml for writing\n");
-		return;
-	}
 
 	clar_summary_testsuites();
 
@@ -94,5 +97,5 @@ void clar_summary_write(void)
 
 	fclose(summary);
 
-	printf("written summary file to %s\n", getcwd((char *)&wd, sizeof(wd)));
+	printf("written summary file to %s\n", filename);
 }
-- 
cgit v1.2.1


From b3e00a010cc5615a37c6db1f3be277a8df306ce1 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 26 Oct 2018 13:52:35 +0200
Subject: clar: introduce CLAR_XML option

Introduce a CLAR_XML option, to run the `ctest` commands with the new
`-r` flag to clar.  Permitted values are `OFF`, `ON` and a directory to
write the XML test results to.

(cherry picked from commit a2d73f5643814cddf90d5bf489332e14ada89ab8)
---
 CMakeLists.txt | 26 +++++++++++++++++++++-----
 1 file changed, 21 insertions(+), 5 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index 2eca57d42..e4cda072e 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,6 +44,8 @@ OPTION( USE_GSSAPI			"Link with libgssapi for SPNEGO auth"   OFF )
 OPTION( VALGRIND			"Configure build for valgrind"			OFF )
 OPTION( CURL			"Use curl for HTTP if available" ON)
 OPTION( DEBUG_POOL			"Enable debug pool allocator"			OFF )
+   SET( CLAR_XML 			"OFF"					       CACHE STRING
+       "Writes test results in XML format.  One of ON, OFF or the directory to write to; this does not affect the output executables, this only affects the behavior of the ctest command.")
 
 IF(DEBUG_POOL)
 	ADD_DEFINITIONS(-DGIT_DEBUG_POOL)
@@ -704,11 +706,25 @@ IF (BUILD_CLAR)
 
 	ENABLE_TESTING()
 
-	ADD_TEST(offline   libgit2_clar -v -xonline)
-	ADD_TEST(online    libgit2_clar -v -sonline)
-	ADD_TEST(gitdaemon libgit2_clar -v -sonline::push)
-	ADD_TEST(ssh       libgit2_clar -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
-	ADD_TEST(proxy     libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
+	IF (CLAR_XML)
+		IF (CLAR_XML STREQUAL "ON")
+			SET(XML_PATH "")
+		ELSE ()
+			SET(XML_PATH "${CLAR_XML}/")
+		ENDIF ()
+
+		SET(TESTS_OFFLINE_XML   "-r${XML_PATH}results_offline.xml")
+		SET(TESTS_ONLINE_XML    "-r${XML_PATH}results_online.xml")
+		SET(TESTS_GITDAEMON_XML "-r${XML_PATH}results_gitdaemon.xml")
+		SET(TESTS_SSH_XML       "-r${XML_PATH}results_ssh.xml")
+		SET(TESTS_PROXY_XML     "-r${XML_PATH}results_proxy.xml")
+	ENDIF ()
+
+	ADD_TEST(offline   libgit2_clar -v ${TESTS_OFFLINE_XML} -xonline)
+	ADD_TEST(online    libgit2_clar -v ${TESTS_ONLINE_XML} -sonline)
+	ADD_TEST(gitdaemon libgit2_clar -v ${TESTS_GITDAEMON_XML} -sonline::push)
+	ADD_TEST(ssh       libgit2_clar -v ${TESTS_SSH_XML} -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+	ADD_TEST(proxy     libgit2_clar -v ${TESTS_PROXY_XML} -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
 ENDIF ()
 
 IF (TAGS)
-- 
cgit v1.2.1


From 61f5cb54f9f3bbc49f9e11bbe645401361cb37f3 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Tue, 4 Sep 2018 14:00:49 +0100
Subject: clar: remove globals; error-check fprintf/fclose

Remove the global summary filename and file pointer; pass them in to the
summary functions as needed.  Error check the results of buffered I/O
calls.

(cherry picked from commit b67a93ff81e2fbfcf9ebb52dd15db9aa4e9ca708)
---
 tests/clar.c         | 42 +++++++++++++++----------
 tests/clar/summary.h | 89 +++++++++++++++++++++++++++++++++++-----------------
 2 files changed, 87 insertions(+), 44 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index 3eecd7810..025f2f3ec 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -123,6 +123,11 @@ struct clar_report {
 	struct clar_report *next;
 };
 
+struct clar_summary {
+	const char *filename;
+	FILE *fp;
+};
+
 static struct {
 	enum cl_test_status test_status;
 
@@ -138,8 +143,10 @@ static struct {
 	int report_errors_only;
 	int exit_on_error;
 	int report_suite_names;
+
 	int write_summary;
-	const char *summary_file;
+	const char *summary_filename;
+	struct clar_summary *summary;
 
 	struct clar_explicit *explicit;
 	struct clar_explicit *last_explicit;
@@ -185,8 +192,8 @@ static void clar_unsandbox(void);
 static int clar_sandbox(void);
 
 /* From summary.h */
-static int clar_summary_init(const char *filename);
-static void clar_summary_shutdown(void);
+static struct clar_summary *clar_summary_init(const char *filename);
+static int clar_summary_shutdown(struct clar_summary *fp);
 
 /* Load the declarations for the test suite */
 #include "clar.suite"
@@ -352,14 +359,14 @@ clar_usage(const char *arg)
 {
 	printf("Usage: %s [options]\n\n", arg);
 	printf("Options:\n");
-	printf("  -sname\tRun only the suite with `name` (can go to individual test name)\n");
-	printf("  -iname\tInclude the suite with `name`\n");
-	printf("  -xname\tExclude the suite with `name`\n");
-	printf("  -v    \tIncrease verbosity (show suite names)\n");
-	printf("  -q    \tOnly report tests that had an error\n");
-	printf("  -Q    \tQuit as soon as a test fails\n");
-	printf("  -l    \tPrint suite names\n");
-	printf("  -r    \tWrite summary file\n");
+	printf("  -sname        Run only the suite with `name` (can go to individual test name)\n");
+	printf("  -iname        Include the suite with `name`\n");
+	printf("  -xname        Exclude the suite with `name`\n");
+	printf("  -v            Increase verbosity (show suite names)\n");
+	printf("  -q            Only report tests that had an error\n");
+	printf("  -Q            Quit as soon as a test fails\n");
+	printf("  -l            Print suite names\n");
+	printf("  -r[filename]  Write summary file (to the optional filename)\n");
 	exit(-1);
 }
 
@@ -471,7 +478,7 @@ clar_parse_args(int argc, char **argv)
 
 		case 'r':
 			_clar.write_summary = 1;
-			_clar.summary_file = *(argument + 2) ? (argument + 2) :
+			_clar.summary_filename = *(argument + 2) ? (argument + 2) :
 			    "summary.xml";
 			break;
 
@@ -493,8 +500,9 @@ clar_test_init(int argc, char **argv)
 	if (argc > 1)
 		clar_parse_args(argc, argv);
 
-	if (_clar.write_summary && !clar_summary_init(_clar.summary_file)) {
-		clar_print_onabort("Failed to open the summary file: %s\n");
+	if (_clar.write_summary &&
+	    !(_clar.summary = clar_summary_init(_clar.summary_filename))) {
+		clar_print_onabort("Failed to open the summary file\n");
 		exit(-1);
 	}
 
@@ -535,8 +543,10 @@ clar_test_shutdown(void)
 
 	clar_unsandbox();
 
-	if (_clar.write_summary)
-		clar_summary_shutdown();
+	if (_clar.write_summary && clar_summary_shutdown(_clar.summary) < 0) {
+		clar_print_onabort("Failed to write the summary file\n");
+		exit(-1);
+	}
 
 	for (explicit = _clar.explicit; explicit; explicit = explicit_next) {
 		explicit_next = explicit->next;
diff --git a/tests/clar/summary.h b/tests/clar/summary.h
index a6a475fb7..491f3451e 100644
--- a/tests/clar/summary.h
+++ b/tests/clar/summary.h
@@ -2,10 +2,8 @@
 #include <stdio.h>
 #include <time.h>
 
-static const char *filename;
-static FILE *summary;
-
-int clar_summary_close_tag(const char *tag, int indent)
+int clar_summary_close_tag(
+    struct clar_summary *summary, const char *tag, int indent)
 {
 	const char *indt;
 
@@ -13,15 +11,17 @@ int clar_summary_close_tag(const char *tag, int indent)
 	else if (indent == 1) indt = "\t";
 	else indt = "\t\t";
 
-	return fprintf(summary, "%s</%s>\n", indt, tag);
+	return fprintf(summary->fp, "%s</%s>\n", indt, tag);
 }
 
-int clar_summary_testsuites(void)
+int clar_summary_testsuites(struct clar_summary *summary)
 {
-	return fprintf(summary, "<testsuites>\n");
+	return fprintf(summary->fp, "<testsuites>\n");
 }
 
-int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t timestamp, double elapsed, int test_count, int fail_count, int error_count)
+int clar_summary_testsuite(struct clar_summary *summary,
+    int idn, const char *name, const char *pkg, time_t timestamp,
+    double elapsed, int test_count, int fail_count, int error_count)
 {
 	struct tm *tm = localtime(&timestamp);
 	char iso_dt[20];
@@ -29,7 +29,7 @@ int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t ti
 	if (strftime(iso_dt, sizeof(iso_dt), "%FT%T", tm) == 0)
 		return -1;
 
-	return fprintf(summary, "\t<testsuite "
+	return fprintf(summary->fp, "\t<testsuite "
 		       " id=\"%d\""
 		       " name=\"%s\""
 		       " package=\"%s\""
@@ -42,60 +42,93 @@ int clar_summary_testsuite(int idn, const char *name, const char *pkg, time_t ti
 		       idn, name, pkg, iso_dt, elapsed, test_count, fail_count, error_count);
 }
 
-int clar_summary_testcase(const char *name, const char *classname, double elapsed)
+int clar_summary_testcase(struct clar_summary *summary,
+    const char *name, const char *classname, double elapsed)
 {
-	return fprintf(summary, "\t\t<testcase name=\"%s\" classname=\"%s\" time=\"%.2f\">\n", name, classname, elapsed);
+	return fprintf(summary->fp,
+	    "\t\t<testcase name=\"%s\" classname=\"%s\" time=\"%.2f\">\n",
+		name, classname, elapsed);
 }
 
-int clar_summary_failure(const char *type, const char *message, const char *desc)
+int clar_summary_failure(struct clar_summary *summary,
+    const char *type, const char *message, const char *desc)
 {
-	return fprintf(summary, "\t\t\t<failure type=\"%s\"><![CDATA[%s\n%s]]></failure>\n", type, message, desc);
+	return fprintf(summary->fp,
+	    "\t\t\t<failure type=\"%s\"><![CDATA[%s\n%s]]></failure>\n",
+	    type, message, desc);
 }
 
-int clar_summary_init(const char *fn)
+struct clar_summary *clar_summary_init(const char *filename)
 {
-	filename = fn;
+	struct clar_summary *summary;
+	FILE *fp;
+
+	if ((fp = fopen(filename, "w")) == NULL)
+		return NULL;
+
+	if ((summary = malloc(sizeof(struct clar_summary))) == NULL) {
+		fclose(fp);
+		return NULL;
+	}
 
-	summary = fopen(filename, "w");
+	summary->filename = filename;
+	summary->fp = fp;
 
-	return !!summary;
+	return summary;
 }
 
-void clar_summary_shutdown(void)
+int clar_summary_shutdown(struct clar_summary *summary)
 {
 	struct clar_report *report;
 	const char *last_suite = NULL;
 
-	clar_summary_testsuites();
+	if (clar_summary_testsuites(summary) < 0)
+		goto on_error;
 
 	report = _clar.reports;
 	while (report != NULL) {
 		struct clar_error *error = report->errors;
 
 		if (last_suite == NULL || strcmp(last_suite, report->suite) != 0) {
-			clar_summary_testsuite(0, report->suite, "", time(NULL), 0, _clar.tests_ran, _clar.total_errors, 0);
+			if (clar_summary_testsuite(summary, 0, report->suite, "",
+			    time(NULL), 0, _clar.tests_ran, _clar.total_errors, 0) < 0)
+				goto on_error;
 		}
 
 		last_suite = report->suite;
 
-		clar_summary_testcase(report->test, "what", 0);
+		clar_summary_testcase(summary, report->test, "what", 0);
 
 		while (error != NULL) {
-			clar_summary_failure("assert", error->error_msg, error->description);
+			if (clar_summary_failure(summary, "assert",
+			    error->error_msg, error->description) < 0)
+				goto on_error;
+
 			error = error->next;
 		}
 
-		clar_summary_close_tag("testcase", 2);
+		if (clar_summary_close_tag(summary, "testcase", 2) < 0)
+			goto on_error;
 
 		report = report->next;
 
-		if (!report || strcmp(last_suite, report->suite) != 0)
-			clar_summary_close_tag("testsuite", 1);
+		if (!report || strcmp(last_suite, report->suite) != 0) {
+			if (clar_summary_close_tag(summary, "testsuite", 1) < 0)
+				goto on_error;
+		}
 	}
 
-	clar_summary_close_tag("testsuites", 0);
+	if (clar_summary_close_tag(summary, "testsuites", 0) < 0 ||
+	    fclose(summary->fp) != 0)
+		goto on_error;
+
+	printf("written summary file to %s\n", summary->filename);
 
-	fclose(summary);
+	free(summary);
+	return 0;
 
-	printf("written summary file to %s\n", filename);
+on_error:
+	fclose(summary->fp);
+	free(summary);
+	return -1;
 }
-- 
cgit v1.2.1


From ac3a5f65dff93ec791f415cc7a170e16e620b595 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 13:48:16 +0200
Subject: ci: write xml during test runs

(cherry picked from commit a84863fc8dfa51cafc1223181e17003383889350)
---
 ci/build.ps1 | 2 +-
 ci/build.sh  | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/build.ps1 b/ci/build.ps1
index 159c1dd1b..7762deba9 100644
--- a/ci/build.ps1
+++ b/ci/build.ps1
@@ -18,7 +18,7 @@ Write-Host "####################################################################
 Write-Host "## Configuring build environment"
 Write-Host "##############################################################################"
 
-Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}"
+Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON -DCLAR_XML=${BuildDirectory} ${Env:CMAKE_OPTIONS}"
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
 
 Write-Host ""
diff --git a/ci/build.sh b/ci/build.sh
index a1deab3f2..c09b31931 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -28,8 +28,8 @@ echo "##########################################################################
 echo "## Configuring build environment"
 echo "##############################################################################"
 
-echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
-cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
+echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DCLAR_XML=\"${BUILD_DIR}\" ${CMAKE_OPTIONS}
+cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DCLAR_XML="${BUILD_DIR}" ${CMAKE_OPTIONS}
 
 echo ""
 echo "##############################################################################"
-- 
cgit v1.2.1


From d5d2b800bafb7a507a4089d04e7d8216a9c381c2 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:08:17 +0200
Subject: ci: upload test results

(cherry picked from commit bfcbde5009db3175cb924687d9273e6f7c5aa1b7)
---
 .vsts-ci.yml | 49 +++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 49 insertions(+)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index be8cdb344..198236f52 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -36,6 +36,13 @@ jobs:
       workDir: '/build'
       containerCommand: '/src/ci/test.sh'
       detached: false
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: linux_trusty_clang_openssl
   displayName: 'Linux (Trusty; Clang; OpenSSL)'
@@ -67,6 +74,13 @@ jobs:
       workDir: '/build'
       containerCommand: '/src/ci/test.sh'
       detached: false
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: macos
   displayName: 'macOS'
@@ -84,6 +98,13 @@ jobs:
     env:
       TMPDIR: $(Agent.TempDirectory)
       LEAK_CHECK: leaks
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: windows_vs_amd64
   displayName: 'Windows (Visual Studio; amd64)'
@@ -95,6 +116,13 @@ jobs:
       CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: windows_vs_x86
   displayName: 'Windows (Visual Studio; x86)'
@@ -106,6 +134,13 @@ jobs:
       CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: windows_mingw_amd64
   displayName: 'Windows (MinGW; amd64)'
@@ -123,6 +158,13 @@ jobs:
       PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
 
 - job: windows_mingw_x86
   displayName: 'Windows (MinGW; x86)'
@@ -140,3 +182,10 @@ jobs:
       PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+  - task: PublishTestResults@2
+    displayName: Publish Test Results
+    condition: succeededOrFailed()
+    inputs:
+      testResultsFiles: 'results_*.xml'
+      searchFolder: '$(Build.BinariesDirectory)'
+      mergeTestResults: true
-- 
cgit v1.2.1


From 267052133aa53c8a5ff905d43b35f29c5f476460 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 26 Aug 2018 17:12:17 +0100
Subject: ci: escape xml output path on Windows

CMake treats backslashes as escape characters; use forward slashes for
the XML output path.

(cherry picked from commit f3f2c45ee6d8f46692ebcc71f2ee688868629830)
---
 ci/build.ps1 | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/ci/build.ps1 b/ci/build.ps1
index 7762deba9..c74717d10 100644
--- a/ci/build.ps1
+++ b/ci/build.ps1
@@ -18,7 +18,9 @@ Write-Host "####################################################################
 Write-Host "## Configuring build environment"
 Write-Host "##############################################################################"
 
-Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON -DCLAR_XML=${BuildDirectory} ${Env:CMAKE_OPTIONS}"
+$TestOutputDirectory = $BuildDirectory -replace "\\", "/"
+
+Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON -DCLAR_XML=${TestOutputDirectory} ${Env:CMAKE_OPTIONS}"
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
 
 Write-Host ""
-- 
cgit v1.2.1


From 51f1bfb94368684ccf5ff030371db4197e56e94a Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sun, 26 Aug 2018 17:27:54 +0100
Subject: ci: explicitly run in the build directory

Explicitly run from the build directory, not the source.  (I was
mistaken about the default working directory for VSTS agents.)

(cherry picked from commit 306875bc1c0c4cf82a4feb9436d161750c3f0aad)
---
 .vsts-ci.yml | 13 +++++++++++++
 1 file changed, 13 insertions(+)

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 198236f52..4501b664e 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -89,12 +89,15 @@ jobs:
   steps:
   - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
+    workingDirectory: '$(Build.BinariesDirectory)'
   - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
     displayName: Build
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
   - bash: . '$(Build.SourcesDirectory)/ci/test.sh'
     displayName: Test
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       TMPDIR: $(Agent.TempDirectory)
       LEAK_CHECK: leaks
@@ -112,10 +115,12 @@ jobs:
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+    workingDirectory: '$(Build.BinariesDirectory)'
   - task: PublishTestResults@2
     displayName: Publish Test Results
     condition: succeededOrFailed()
@@ -130,10 +135,12 @@ jobs:
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+    workingDirectory: '$(Build.BinariesDirectory)'
   - task: PublishTestResults@2
     displayName: Publish Test Results
     condition: succeededOrFailed()
@@ -148,16 +155,19 @@ jobs:
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: amd64
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       CMAKE_OPTIONS: -G"MinGW Makefiles"
       PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+    workingDirectory: '$(Build.BinariesDirectory)'
   - task: PublishTestResults@2
     displayName: Publish Test Results
     condition: succeededOrFailed()
@@ -172,16 +182,19 @@ jobs:
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: x86
   - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
     displayName: Build
+    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       CMAKE_OPTIONS: -G"MinGW Makefiles"
       PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
   - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
     displayName: Test
+    workingDirectory: '$(Build.BinariesDirectory)'
   - task: PublishTestResults@2
     displayName: Publish Test Results
     condition: succeededOrFailed()
-- 
cgit v1.2.1


From db7fd29fb2253c802540a04d16deeb80b26a4f66 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:08:32 +0200
Subject: ci: use templates for VSTS builds

Our build YAML is becoming unweildly and full of copy-pasta.  Simplify
with templates.

(cherry picked from commit 6b2d8f09bc9e5bdf74f98b7470ebc39436be600f)
---
 .vsts-ci.yml           | 170 +++++++++----------------------------------------
 ci/vsts-bash.yml       |  17 +++++
 ci/vsts-docker.yml     |  33 ++++++++++
 ci/vsts-powershell.yml |  17 +++++
 4 files changed, 97 insertions(+), 140 deletions(-)
 create mode 100644 ci/vsts-bash.yml
 create mode 100644 ci/vsts-docker.yml
 create mode 100644 ci/vsts-powershell.yml

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 4501b664e..f191f4dc6 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -11,76 +11,24 @@ jobs:
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - task: Docker@0
-    displayName: Build
-    inputs:
-      action: 'Run an image'
+  - template: ci/vsts-docker.yml
+    parameters:
       imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      workDir: '/build'
-      containerCommand: '/src/ci/build.sh'
-      detached: false
-  - task: Docker@0
-    displayName: Test
-    inputs:
-      action: 'Run an image'
-      imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      envVars: |
+      environmentVariables: |
        CC=gcc
        LEAK_CHECK=valgrind
-      workDir: '/build'
-      containerCommand: '/src/ci/test.sh'
-      detached: false
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
 
 - job: linux_trusty_clang_openssl
   displayName: 'Linux (Trusty; Clang; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - task: Docker@0
-    displayName: Build
-    inputs:
-      action: 'Run an image'
-      imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      workDir: '/build'
-      containerCommand: '/src/ci/build.sh'
-      detached: false
-  - task: Docker@0
-    displayName: Test
-    inputs:
-      action: 'Run an image'
+  - template: ci/vsts-docker.yml
+    parameters:
       imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      envVars: |
+      environmentVariables: |
        CC=clang
        LEAK_CHECK=valgrind
-      workDir: '/build'
-      containerCommand: '/src/ci/test.sh'
-      detached: false
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
 
 - job: macos
   displayName: 'macOS'
@@ -89,65 +37,30 @@ jobs:
   steps:
   - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
-    workingDirectory: '$(Build.BinariesDirectory)'
-  - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
-    displayName: Build
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
-  - bash: . '$(Build.SourcesDirectory)/ci/test.sh'
-    displayName: Test
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      TMPDIR: $(Agent.TempDirectory)
-      LEAK_CHECK: leaks
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
+  - template: ci/vsts-bash.yml
+    parameters:
+      environmentVariables:
+        TMPDIR: $(Agent.TempDirectory)
+        PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
+        LEAK_CHECK: leaks
 
 - job: windows_vs_amd64
   displayName: 'Windows (Visual Studio; amd64)'
   pool: Hosted
   steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-    displayName: Build
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
-  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-    displayName: Test
-    workingDirectory: '$(Build.BinariesDirectory)'
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
+  - template: ci/vsts-powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
 
 - job: windows_vs_x86
   displayName: 'Windows (Visual Studio; x86)'
   pool: Hosted
   steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-    displayName: Build
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
-  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-    displayName: Test
-    workingDirectory: '$(Build.BinariesDirectory)'
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
+  - template: ci/vsts-powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
 
 - job: windows_mingw_amd64
   displayName: 'Windows (MinGW; amd64)'
@@ -155,26 +68,14 @@ jobs:
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
     displayName: Setup
-    workingDirectory: '$(Build.BinariesDirectory)'
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: amd64
-  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-    displayName: Build
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      CMAKE_OPTIONS: -G"MinGW Makefiles"
-      PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
-  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-    displayName: Test
-    workingDirectory: '$(Build.BinariesDirectory)'
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
+  - template: ci/vsts-powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -G"MinGW Makefiles"
+        PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
 
 - job: windows_mingw_x86
   displayName: 'Windows (MinGW; x86)'
@@ -186,19 +87,8 @@ jobs:
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: x86
-  - powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-    displayName: Build
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      CMAKE_OPTIONS: -G"MinGW Makefiles"
-      PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
-  - powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-    displayName: Test
-    workingDirectory: '$(Build.BinariesDirectory)'
-  - task: PublishTestResults@2
-    displayName: Publish Test Results
-    condition: succeededOrFailed()
-    inputs:
-      testResultsFiles: 'results_*.xml'
-      searchFolder: '$(Build.BinariesDirectory)'
-      mergeTestResults: true
+  - template: ci/vsts-powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -G"MinGW Makefiles"
+        PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
diff --git a/ci/vsts-bash.yml b/ci/vsts-bash.yml
new file mode 100644
index 000000000..d776a3649
--- /dev/null
+++ b/ci/vsts-bash.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with bash.
+steps:
+- bash: . '$(Build.SourcesDirectory)/ci/build.sh'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- bash: . '$(Build.SourcesDirectory)/ci/test.sh'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/vsts-docker.yml b/ci/vsts-docker.yml
new file mode 100644
index 000000000..e92510478
--- /dev/null
+++ b/ci/vsts-docker.yml
@@ -0,0 +1,33 @@
+# These are the steps used in a container-based build in VSTS.
+steps:
+- task: docker@0
+  displayName: Build
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/build.sh'
+    detached: false
+- task: docker@0
+  displayName: Test
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/test.sh'
+    detached: false
+- task: publishtestresults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/vsts-powershell.yml b/ci/vsts-powershell.yml
new file mode 100644
index 000000000..a2eb175d5
--- /dev/null
+++ b/ci/vsts-powershell.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with PowerShell.
+steps:
+- powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
-- 
cgit v1.2.1


From 423cadbec7b66e7ddab92291d652db1ef35c0866 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 27 Aug 2018 01:06:37 +0100
Subject: ci: use more compatible strftime formats

Windows lacks %F and %T formats for strftime.  Expand them to the
year/month/day and hour/minute/second formats, respectively.

(cherry picked from commit e595eeb5ab88142b97798ed65e651de6560515e9)
---
 tests/clar/summary.h | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/clar/summary.h b/tests/clar/summary.h
index 491f3451e..1af110efa 100644
--- a/tests/clar/summary.h
+++ b/tests/clar/summary.h
@@ -26,7 +26,7 @@ int clar_summary_testsuite(struct clar_summary *summary,
 	struct tm *tm = localtime(&timestamp);
 	char iso_dt[20];
 
-	if (strftime(iso_dt, sizeof(iso_dt), "%FT%T", tm) == 0)
+	if (strftime(iso_dt, sizeof(iso_dt), "%Y-%m-%dT%H:%M:%S", tm) == 0)
 		return -1;
 
 	return fprintf(summary->fp, "\t<testsuite "
-- 
cgit v1.2.1


From 2de44f183c324117f0a957ed432dbd3897a604cf Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Sat, 8 Sep 2018 18:54:21 +0100
Subject: clar: iterate errors in report_all / report_errors

Instead of trying to have a clever iterator pattern that increments the
error number, just iterate over errors in the report errors or report
all functions as it's easier to reason about in this fashion.

(cherry picked from commit d17e67d08d6e73dbf0daeae5049f92a38c2d8bb6)
---
 tests/clar.c | 34 +++++++++++++++-------------------
 1 file changed, 15 insertions(+), 19 deletions(-)

diff --git a/tests/clar.c b/tests/clar.c
index 025f2f3ec..27d35e1c7 100644
--- a/tests/clar.c
+++ b/tests/clar.c
@@ -217,32 +217,28 @@ void cl_trace_register(cl_trace_cb *cb, void *payload)
 
 /* Core test functions */
 static void
-clar_report(int *i, struct clar_error *error)
-{
-	while (error != NULL) {
-		clar_print_error((*i)++, _clar.last_report, error);
-		error = error->next;
-	}
-}
-
-static void
-clar_report_errors(struct clar_error *error)
+clar_report_errors(struct clar_report *report)
 {
+	struct clar_error *error;
 	int i = 1;
-	clar_report(&i, error);
+
+	for (error = report->errors; error; error = error->next)
+		clar_print_error(i++, _clar.last_report, error);
 }
 
 static void
 clar_report_all(void)
 {
-	int i = 1;
 	struct clar_report *report;
+	struct clar_error *error;
+	int i = 1;
+
+	for (report = _clar.reports; report; report = report->next) {
+		if (report->status != CL_TEST_FAILURE)
+			continue;
 
-	report = _clar.reports;
-	while (report != NULL) {
-		if (report->status == CL_TEST_FAILURE)
-			clar_report(&i, report->errors);
-		report = report->next;
+		for (error = report->errors; error; error = error->next)
+			clar_print_error(i++, report, error);
 	}
 }
 
@@ -285,7 +281,7 @@ clar_run_test(
 	_clar.local_cleanup_payload = NULL;
 
 	if (_clar.report_errors_only) {
-		clar_report_errors(_clar.last_report->errors);
+		clar_report_errors(_clar.last_report);
 	} else {
 		clar_print_ontest(test->name, _clar.tests_ran, _clar.last_report->status);
 	}
@@ -576,7 +572,7 @@ static void abort_test(void)
 	if (!_clar.trampoline_enabled) {
 		clar_print_onabort(
 				"Fatal error: a cleanup method raised an exception.");
-		clar_report_errors(_clar.last_report->errors);
+		clar_report_errors(_clar.last_report);
 		exit(-1);
 	}
 
-- 
cgit v1.2.1


From 3d6aad17cf2847dcab84d69832f70d0b8f189b88 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 12 Oct 2018 12:08:53 +0200
Subject: ci: rename vsts to azure-pipelines

(cherry picked from commit d7d0139eb3ef9d306d0229223092a9cac7da1db5)
---
 .vsts-ci.yml           | 94 --------------------------------------------------
 .vsts-nightly.yml      | 22 ------------
 azure-pipelines.yml    | 94 ++++++++++++++++++++++++++++++++++++++++++++++++++
 ci/bash.yml            | 17 +++++++++
 ci/docker.yml          | 33 ++++++++++++++++++
 ci/nightly.yml         | 22 ++++++++++++
 ci/powershell.yml      | 17 +++++++++
 ci/vsts-bash.yml       | 17 ---------
 ci/vsts-docker.yml     | 33 ------------------
 ci/vsts-powershell.yml | 17 ---------
 10 files changed, 183 insertions(+), 183 deletions(-)
 delete mode 100644 .vsts-ci.yml
 delete mode 100644 .vsts-nightly.yml
 create mode 100644 azure-pipelines.yml
 create mode 100644 ci/bash.yml
 create mode 100644 ci/docker.yml
 create mode 100644 ci/nightly.yml
 create mode 100644 ci/powershell.yml
 delete mode 100644 ci/vsts-bash.yml
 delete mode 100644 ci/vsts-docker.yml
 delete mode 100644 ci/vsts-powershell.yml

diff --git a/.vsts-ci.yml b/.vsts-ci.yml
deleted file mode 100644
index f191f4dc6..000000000
--- a/.vsts-ci.yml
+++ /dev/null
@@ -1,94 +0,0 @@
-resources:
-- repo: self
-
-trigger:
-- master
-- maint/*
-
-jobs:
-- job: linux_trusty_gcc_openssl
-  displayName: 'Linux (Trusty; GCC; OpenSSL)'
-  pool:
-    vmImage: 'Ubuntu 16.04'
-  steps:
-  - template: ci/vsts-docker.yml
-    parameters:
-      imageName: 'libgit2/trusty-openssl:latest'
-      environmentVariables: |
-       CC=gcc
-       LEAK_CHECK=valgrind
-
-- job: linux_trusty_clang_openssl
-  displayName: 'Linux (Trusty; Clang; OpenSSL)'
-  pool:
-    vmImage: 'Ubuntu 16.04'
-  steps:
-  - template: ci/vsts-docker.yml
-    parameters:
-      imageName: 'libgit2/trusty-openssl:latest'
-      environmentVariables: |
-       CC=clang
-       LEAK_CHECK=valgrind
-
-- job: macos
-  displayName: 'macOS'
-  pool:
-    vmImage: 'macOS 10.13'
-  steps:
-  - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
-    displayName: Setup
-  - template: ci/vsts-bash.yml
-    parameters:
-      environmentVariables:
-        TMPDIR: $(Agent.TempDirectory)
-        PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
-        LEAK_CHECK: leaks
-
-- job: windows_vs_amd64
-  displayName: 'Windows (Visual Studio; amd64)'
-  pool: Hosted
-  steps:
-  - template: ci/vsts-powershell.yml
-    parameters:
-      environmentVariables:
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
-
-- job: windows_vs_x86
-  displayName: 'Windows (Visual Studio; x86)'
-  pool: Hosted
-  steps:
-  - template: ci/vsts-powershell.yml
-    parameters:
-      environmentVariables:
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
-
-- job: windows_mingw_amd64
-  displayName: 'Windows (MinGW; amd64)'
-  pool: Hosted
-  steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
-    displayName: Setup
-    env:
-      TEMP: $(Agent.TempDirectory)
-      ARCH: amd64
-  - template: ci/vsts-powershell.yml
-    parameters:
-      environmentVariables:
-        CMAKE_OPTIONS: -G"MinGW Makefiles"
-        PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
-
-- job: windows_mingw_x86
-  displayName: 'Windows (MinGW; x86)'
-  pool: Hosted
-  steps:
-  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
-    displayName: Setup
-    workingDirectory: '$(Build.BinariesDirectory)'
-    env:
-      TEMP: $(Agent.TempDirectory)
-      ARCH: x86
-  - template: ci/vsts-powershell.yml
-    parameters:
-      environmentVariables:
-        CMAKE_OPTIONS: -G"MinGW Makefiles"
-        PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
diff --git a/.vsts-nightly.yml b/.vsts-nightly.yml
deleted file mode 100644
index 4d6d8a3e8..000000000
--- a/.vsts-nightly.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-resources:
-- repo: self
-
-jobs:
-- job: coverity
-  displayName: 'Coverity'
-  pool:
-    vmImage: 'Ubuntu 16.04'
-  steps:
-  - task: Docker@0
-    displayName: Build
-    inputs:
-      action: 'Run an image'
-      imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      envVars: |
-       COVERITY_TOKEN=$(COVERITY_TOKEN)
-      workDir: '/build'
-      containerCommand: '/src/ci/coverity.sh'
-      detached: false
diff --git a/azure-pipelines.yml b/azure-pipelines.yml
new file mode 100644
index 000000000..64007d1a2
--- /dev/null
+++ b/azure-pipelines.yml
@@ -0,0 +1,94 @@
+resources:
+- repo: self
+
+trigger:
+- master
+- maint/*
+
+jobs:
+- job: linux_trusty_gcc_openssl
+  displayName: 'Linux (Trusty; GCC; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: ci/docker.yml
+    parameters:
+      imageName: 'libgit2/trusty-openssl:latest'
+      environmentVariables: |
+       CC=gcc
+       LEAK_CHECK=valgrind
+
+- job: linux_trusty_clang_openssl
+  displayName: 'Linux (Trusty; Clang; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: ci/docker.yml
+    parameters:
+      imageName: 'libgit2/trusty-openssl:latest'
+      environmentVariables: |
+       CC=clang
+       LEAK_CHECK=valgrind
+
+- job: macos
+  displayName: 'macOS'
+  pool:
+    vmImage: 'macOS 10.13'
+  steps:
+  - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
+    displayName: Setup
+  - template: ci/bash.yml
+    parameters:
+      environmentVariables:
+        TMPDIR: $(Agent.TempDirectory)
+        PKG_CONFIG_PATH: /usr/local/opt/openssl/lib/pkgconfig
+        LEAK_CHECK: leaks
+
+- job: windows_vs_amd64
+  displayName: 'Windows (Visual Studio; amd64)'
+  pool: Hosted
+  steps:
+  - template: ci/powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
+
+- job: windows_vs_x86
+  displayName: 'Windows (Visual Studio; x86)'
+  pool: Hosted
+  steps:
+  - template: ci/powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
+
+- job: windows_mingw_amd64
+  displayName: 'Windows (MinGW; amd64)'
+  pool: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
+    displayName: Setup
+    env:
+      TEMP: $(Agent.TempDirectory)
+      ARCH: amd64
+  - template: ci/powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -G"MinGW Makefiles"
+        PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
+
+- job: windows_mingw_x86
+  displayName: 'Windows (MinGW; x86)'
+  pool: Hosted
+  steps:
+  - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
+    displayName: Setup
+    workingDirectory: '$(Build.BinariesDirectory)'
+    env:
+      TEMP: $(Agent.TempDirectory)
+      ARCH: x86
+  - template: ci/powershell.yml
+    parameters:
+      environmentVariables:
+        CMAKE_OPTIONS: -G"MinGW Makefiles"
+        PATH: $(Agent.TempDirectory)\mingw32\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
diff --git a/ci/bash.yml b/ci/bash.yml
new file mode 100644
index 000000000..d776a3649
--- /dev/null
+++ b/ci/bash.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with bash.
+steps:
+- bash: . '$(Build.SourcesDirectory)/ci/build.sh'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- bash: . '$(Build.SourcesDirectory)/ci/test.sh'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/docker.yml b/ci/docker.yml
new file mode 100644
index 000000000..e92510478
--- /dev/null
+++ b/ci/docker.yml
@@ -0,0 +1,33 @@
+# These are the steps used in a container-based build in VSTS.
+steps:
+- task: docker@0
+  displayName: Build
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/build.sh'
+    detached: false
+- task: docker@0
+  displayName: Test
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/test.sh'
+    detached: false
+- task: publishtestresults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/nightly.yml b/ci/nightly.yml
new file mode 100644
index 000000000..4d6d8a3e8
--- /dev/null
+++ b/ci/nightly.yml
@@ -0,0 +1,22 @@
+resources:
+- repo: self
+
+jobs:
+- job: coverity
+  displayName: 'Coverity'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       COVERITY_TOKEN=$(COVERITY_TOKEN)
+      workDir: '/build'
+      containerCommand: '/src/ci/coverity.sh'
+      detached: false
diff --git a/ci/powershell.yml b/ci/powershell.yml
new file mode 100644
index 000000000..a2eb175d5
--- /dev/null
+++ b/ci/powershell.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with PowerShell.
+steps:
+- powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/vsts-bash.yml b/ci/vsts-bash.yml
deleted file mode 100644
index d776a3649..000000000
--- a/ci/vsts-bash.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-# These are the steps used for building on machines with bash.
-steps:
-- bash: . '$(Build.SourcesDirectory)/ci/build.sh'
-  displayName: Build
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- bash: . '$(Build.SourcesDirectory)/ci/test.sh'
-  displayName: Test
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- task: PublishTestResults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
diff --git a/ci/vsts-docker.yml b/ci/vsts-docker.yml
deleted file mode 100644
index e92510478..000000000
--- a/ci/vsts-docker.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# These are the steps used in a container-based build in VSTS.
-steps:
-- task: docker@0
-  displayName: Build
-  inputs:
-    action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
-    volumes: |
-     $(Build.SourcesDirectory):/src
-     $(Build.BinariesDirectory):/build
-    envVars: ${{ parameters.environmentVariables }}
-    workDir: '/build'
-    containerCommand: '/src/ci/build.sh'
-    detached: false
-- task: docker@0
-  displayName: Test
-  inputs:
-    action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
-    volumes: |
-     $(Build.SourcesDirectory):/src
-     $(Build.BinariesDirectory):/build
-    envVars: ${{ parameters.environmentVariables }}
-    workDir: '/build'
-    containerCommand: '/src/ci/test.sh'
-    detached: false
-- task: publishtestresults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
diff --git a/ci/vsts-powershell.yml b/ci/vsts-powershell.yml
deleted file mode 100644
index a2eb175d5..000000000
--- a/ci/vsts-powershell.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-# These are the steps used for building on machines with PowerShell.
-steps:
-- powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-  displayName: Build
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-  displayName: Test
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- task: PublishTestResults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
-- 
cgit v1.2.1


From 727ab5b9778e9a593727d70f4391302d8908c3f8 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Tue, 18 Sep 2018 13:51:25 +1000
Subject: README: update the build badge to Azure Pipelines

VSTS is now a family of components; "Azure Pipelines" is the build and
release pipeline application.

(cherry picked from commit 464305b74e87bd008cb9b18af632844f16806327)
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 82a745293..4fbdf1e70 100644
--- a/README.md
+++ b/README.md
@@ -1,7 +1,7 @@
 libgit2 - the Git linkable library
 ==================================
 
-[![VSTS Build Status](https://libgit2.visualstudio.com/libgit2/_apis/build/status/libgit2)](https://libgit2.visualstudio.com/libgit2/_build/latest?definitionId=7)
+[![Azure Pipelines Build Status](https://dev.azure.com/libgit2/libgit2/_apis/build/status/libgit2)](https://dev.azure.com/libgit2/libgit2/_build/latest?definitionId=7)
 [![Coverity Scan Build Status](https://scan.coverity.com/projects/639/badge.svg)](https://scan.coverity.com/projects/639)
 
 `libgit2` is a portable, pure C implementation of the Git core methods
-- 
cgit v1.2.1


From 2c0f905387c8780ce02c5f8f020a681a217afd58 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Tue, 18 Sep 2018 13:52:08 +1000
Subject: README: rename "VSTS" to "Azure DevOps"

Visual Studio Team Services is now a family of applications named "Azure
DevOps".  Update the README to refer to it thusly.

(cherry picked from commit e2613039b34b9f119ca948c70ba75dd93dc1803f)
---
 README.md | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 4fbdf1e70..98cd9584a 100644
--- a/README.md
+++ b/README.md
@@ -44,7 +44,7 @@ What It Can Do
 
 libgit2 provides you with the ability to manage Git repositories in the
 programming language of your choice.  It's used in production to power many
-applications including GitHub.com, Plastic SCM and Visual Studio Team Services.
+applications including GitHub.com, Plastic SCM and Azure DevOps.
 
 It does not aim to replace the git tool or its user-facing commands. Some APIs
 resemble the plumbing commands as those align closely with the concepts of the
-- 
cgit v1.2.1


From 4df0991552eacecde02d0c6324570c548e7569ff Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 10 Sep 2018 12:27:24 +0100
Subject: ci: only run the exact named test

Our CI test system invokes ctest with the name of the given tests it
wishes to invoke.  ctest (with the `-R` flag) treats this name as a
regular expression.  Provide anchors in the regular expression to avoid
matching additional tests in this search.

(cherry picked from commit 7e353b7a140dade32f1f1db6afd1721cf2c18a4a)
---
 ci/test.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/ci/test.sh b/ci/test.sh
index 28f76029a..e162a4469 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -41,7 +41,7 @@ die() {
 # test configuration in a single place (tests/CMakeLists.txt) instead of running clar
 # here as well.  But it allows us to wrap our test harness with a leak checker like valgrind.
 run_test() {
-	TEST_CMD=$(ctest -N -V -R $1 | sed -n 's/^[0-9]*: Test command: //p')
+	TEST_CMD=$(ctest -N -V -R "^${1}$" | sed -n 's/^[0-9]*: Test command: //p')
 
 	if [ "$LEAK_CHECK" = "valgrind" ]; then
 		RUNNER="$VALGRIND $TEST_CMD"
-- 
cgit v1.2.1


From a5a0c7699f64c6f8b1bad6fed094d63ffe3614cb Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 26 Oct 2018 13:53:40 +0200
Subject: Revert "clar: introduce CLAR_XML option"

This reverts commit a2d73f5643814cddf90d5bf489332e14ada89ab8.
Using clar to propagate the XML settings was a mistake.

(cherry picked from commit 943181c2efe20b705aa40d30197693e7a4c1d0ac)
---
 CMakeLists.txt | 26 +++++---------------------
 ci/build.ps1   |  4 +---
 ci/build.sh    |  4 ++--
 3 files changed, 8 insertions(+), 26 deletions(-)

diff --git a/CMakeLists.txt b/CMakeLists.txt
index e4cda072e..2eca57d42 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -44,8 +44,6 @@ OPTION( USE_GSSAPI			"Link with libgssapi for SPNEGO auth"   OFF )
 OPTION( VALGRIND			"Configure build for valgrind"			OFF )
 OPTION( CURL			"Use curl for HTTP if available" ON)
 OPTION( DEBUG_POOL			"Enable debug pool allocator"			OFF )
-   SET( CLAR_XML 			"OFF"					       CACHE STRING
-       "Writes test results in XML format.  One of ON, OFF or the directory to write to; this does not affect the output executables, this only affects the behavior of the ctest command.")
 
 IF(DEBUG_POOL)
 	ADD_DEFINITIONS(-DGIT_DEBUG_POOL)
@@ -706,25 +704,11 @@ IF (BUILD_CLAR)
 
 	ENABLE_TESTING()
 
-	IF (CLAR_XML)
-		IF (CLAR_XML STREQUAL "ON")
-			SET(XML_PATH "")
-		ELSE ()
-			SET(XML_PATH "${CLAR_XML}/")
-		ENDIF ()
-
-		SET(TESTS_OFFLINE_XML   "-r${XML_PATH}results_offline.xml")
-		SET(TESTS_ONLINE_XML    "-r${XML_PATH}results_online.xml")
-		SET(TESTS_GITDAEMON_XML "-r${XML_PATH}results_gitdaemon.xml")
-		SET(TESTS_SSH_XML       "-r${XML_PATH}results_ssh.xml")
-		SET(TESTS_PROXY_XML     "-r${XML_PATH}results_proxy.xml")
-	ENDIF ()
-
-	ADD_TEST(offline   libgit2_clar -v ${TESTS_OFFLINE_XML} -xonline)
-	ADD_TEST(online    libgit2_clar -v ${TESTS_ONLINE_XML} -sonline)
-	ADD_TEST(gitdaemon libgit2_clar -v ${TESTS_GITDAEMON_XML} -sonline::push)
-	ADD_TEST(ssh       libgit2_clar -v ${TESTS_SSH_XML} -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
-	ADD_TEST(proxy     libgit2_clar -v ${TESTS_PROXY_XML} -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
+	ADD_TEST(offline   libgit2_clar -v -xonline)
+	ADD_TEST(online    libgit2_clar -v -sonline)
+	ADD_TEST(gitdaemon libgit2_clar -v -sonline::push)
+	ADD_TEST(ssh       libgit2_clar -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
+	ADD_TEST(proxy     libgit2_clar -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
 ENDIF ()
 
 IF (TAGS)
diff --git a/ci/build.ps1 b/ci/build.ps1
index c74717d10..159c1dd1b 100644
--- a/ci/build.ps1
+++ b/ci/build.ps1
@@ -18,9 +18,7 @@ Write-Host "####################################################################
 Write-Host "## Configuring build environment"
 Write-Host "##############################################################################"
 
-$TestOutputDirectory = $BuildDirectory -replace "\\", "/"
-
-Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON -DCLAR_XML=${TestOutputDirectory} ${Env:CMAKE_OPTIONS}"
+Invoke-Expression "cmake ${SourceDirectory} -DBUILD_EXAMPLES=ON ${Env:CMAKE_OPTIONS}"
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
 
 Write-Host ""
diff --git a/ci/build.sh b/ci/build.sh
index c09b31931..a1deab3f2 100755
--- a/ci/build.sh
+++ b/ci/build.sh
@@ -28,8 +28,8 @@ echo "##########################################################################
 echo "## Configuring build environment"
 echo "##############################################################################"
 
-echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DCLAR_XML=\"${BUILD_DIR}\" ${CMAKE_OPTIONS}
-cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON -DCLAR_XML="${BUILD_DIR}" ${CMAKE_OPTIONS}
+echo cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
+cmake ${SOURCE_DIR} -DBUILD_EXAMPLES=ON ${CMAKE_OPTIONS}
 
 echo ""
 echo "##############################################################################"
-- 
cgit v1.2.1


From 643b71851efbf13bb5e998fcec8bf060ae94150b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 10 Sep 2018 14:59:20 +0100
Subject: ci: write test result XML

Add the clar flags to produce JUnit-style XML output before invocation.

(cherry picked from commit fff33a1b65994e1f781f73d06e22d3f8778eff02)
---
 ci/test.sh | 9 ++++++---
 1 file changed, 6 insertions(+), 3 deletions(-)

diff --git a/ci/test.sh b/ci/test.sh
index e162a4469..ff5e7a0ec 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -37,11 +37,14 @@ die() {
 	exit $1
 }
 
-# Ask ctest what it would run if we were to invoke it directly.  This lets us manage the
-# test configuration in a single place (tests/CMakeLists.txt) instead of running clar
-# here as well.  But it allows us to wrap our test harness with a leak checker like valgrind.
+# Ask ctest what it would run if we were to invoke it directly.  This lets
+# us manage the test configuration in a single place (tests/CMakeLists.txt)
+# instead of running clar here as well.  But it allows us to wrap our test
+# harness with a leak checker like valgrind.  Append the option to write
+# JUnit-style XML files.
 run_test() {
 	TEST_CMD=$(ctest -N -V -R "^${1}$" | sed -n 's/^[0-9]*: Test command: //p')
+	TEST_CMD="${TEST_CMD} -r${BUILD_DIR}/results_${1}.xml"
 
 	if [ "$LEAK_CHECK" = "valgrind" ]; then
 		RUNNER="$VALGRIND $TEST_CMD"
-- 
cgit v1.2.1


From 748f28e909d6f617bc9f5f6ec1a3d36c1b053330 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Tue, 11 Sep 2018 15:15:26 -0700
Subject: ci: add SKIP_*_TESTS for windows builds

Introduce SKIP_*_TEST variables for Windows builds to match POSIX
builds.

(cherry picked from commit a8301b0c19cc738961604a14b7e132b2b97e064c)
---
 ci/test.ps1 | 45 ++++++++++++++++++++++++++-------------------
 1 file changed, 26 insertions(+), 19 deletions(-)

diff --git a/ci/test.ps1 b/ci/test.ps1
index 843df7034..89301d45a 100644
--- a/ci/test.ps1
+++ b/ci/test.ps1
@@ -11,10 +11,12 @@ Write-Host "####################################################################
 Write-Host "## Configuring test environment"
 Write-Host "##############################################################################"
 
-Write-Host ""
-Write-Host "Starting HTTP proxy..."
-Invoke-WebRequest -Method GET -Uri https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -OutFile poxyproxy.jar
-javaw -jar poxyproxy.jar -d --port 8080 --credentials foo:bar
+if (-not $Env:SKIP_PROXY_TESTS) {
+	Write-Host ""
+	Write-Host "Starting HTTP proxy..."
+	Invoke-WebRequest -Method GET -Uri https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar -OutFile poxyproxy.jar
+	javaw -jar poxyproxy.jar -d --port 8080 --credentials foo:bar
+}
 
 Write-Host ""
 Write-Host "##############################################################################"
@@ -24,22 +26,27 @@ Write-Host "####################################################################
 ctest -V -R offline
 if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
 
-Write-Host ""
-Write-Host "##############################################################################"
-Write-Host "## Running (online) tests"
-Write-Host "##############################################################################"
+if (-not $Env:SKIP_ONLINE_TESTS) {
+	Write-Host ""
+	Write-Host "##############################################################################"
+	Write-Host "## Running (online) tests"
+	Write-Host "##############################################################################"
 
-ctest -V -R online
-if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+	ctest -V -R online
+	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+}
 
-Write-Host ""
-Write-Host "Running proxy tests"
-Write-Host ""
+if (-not $Env:SKIP_PROXY_TESTS) {
+	Write-Host ""
+	Write-Host "Running proxy tests"
+	Write-Host ""
 
-$Env:GITTEST_REMOTE_PROXY_URL="localhost:8080"
-$Env:GITTEST_REMOTE_PROXY_USER="foo"
-$Env:GITTEST_REMOTE_PROXY_PASS="bar"
-ctest -V -R proxy
-if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+	$Env:GITTEST_REMOTE_PROXY_URL="localhost:8080"
+	$Env:GITTEST_REMOTE_PROXY_USER="foo"
+	$Env:GITTEST_REMOTE_PROXY_PASS="bar"
+	ctest -V -R proxy
+	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+	taskkill /F /IM javaw.exe
+}
 
-taskkill /F /IM javaw.exe
-- 
cgit v1.2.1


From 0fe9313a36759ed9b4d5f817af320f88758bdc3b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 17 Sep 2018 19:57:26 -0700
Subject: ci: append -r flag to clar on windows

Similar to the way we parse the ctest output on POSIX systems, do the
same on Windows.  This allows us to append the `-r` flag to clar after
we've identified the command to run.

(cherry picked from commit 7c9769d94799c7bc6341d64e18bbd13bc8993ad6)
---
 ci/test.ps1 | 31 ++++++++++++++++++++++++-------
 1 file changed, 24 insertions(+), 7 deletions(-)

diff --git a/ci/test.ps1 b/ci/test.ps1
index 89301d45a..5f75c0b62 100644
--- a/ci/test.ps1
+++ b/ci/test.ps1
@@ -5,8 +5,28 @@ $PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
 
 [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
 
+$SourceDir = Split-Path (Split-Path (Get-Variable MyInvocation).Value.MyCommand.Path)
+$BuildDir = Get-Location
+
 if ($Env:SKIP_TESTS) { exit }
 
+# Ask ctest what it would run if we were to invoke it directly.  This lets
+# us manage the test configuration in a single place (tests/CMakeLists.txt)
+# instead of running clar here as well.  But it allows us to wrap our test
+# harness with a leak checker like valgrind.  Append the option to write
+# JUnit-style XML files.
+function run_test {
+	$TestName = $args[0]
+
+	$TestCommand = (ctest -N -V -R "^$TestName$") -join "`n" -replace "(?ms).*\n^[0-9]*: Test command: ","" -replace "\n.*",""
+	$TestCommand += " -r${BuildDir}\results_${TestName}.xml"
+
+	Write-Host $TestCommand
+	Invoke-Expression $TestCommand
+
+	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+}
+
 Write-Host "##############################################################################"
 Write-Host "## Configuring test environment"
 Write-Host "##############################################################################"
@@ -23,8 +43,7 @@ Write-Host "####################################################################
 Write-Host "## Running (offline) tests"
 Write-Host "##############################################################################"
 
-ctest -V -R offline
-if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+run_test offline
 
 if (-not $Env:SKIP_ONLINE_TESTS) {
 	Write-Host ""
@@ -32,8 +51,7 @@ if (-not $Env:SKIP_ONLINE_TESTS) {
 	Write-Host "## Running (online) tests"
 	Write-Host "##############################################################################"
 
-	ctest -V -R online
-	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+	run_test online
 }
 
 if (-not $Env:SKIP_PROXY_TESTS) {
@@ -44,9 +62,8 @@ if (-not $Env:SKIP_PROXY_TESTS) {
 	$Env:GITTEST_REMOTE_PROXY_URL="localhost:8080"
 	$Env:GITTEST_REMOTE_PROXY_USER="foo"
 	$Env:GITTEST_REMOTE_PROXY_PASS="bar"
-	ctest -V -R proxy
-	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+
+	run_test proxy
 
 	taskkill /F /IM javaw.exe
 }
-
-- 
cgit v1.2.1


From 125d80d0c09f7ce2789ee1ca2b6884b4aa0c2f8f Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Mon, 17 Sep 2018 20:12:59 -0700
Subject: ci: don't stop on failure

Don't stop on test failures; run all the tests, even when a test fails.

(cherry picked from commit 429c7f1141f812d266cfd7d33a142871c21f8874)
---
 ci/test.ps1 |  5 ++++-
 ci/test.sh  | 18 ++++++++++++------
 2 files changed, 16 insertions(+), 7 deletions(-)

diff --git a/ci/test.ps1 b/ci/test.ps1
index 5f75c0b62..7a55bff79 100644
--- a/ci/test.ps1
+++ b/ci/test.ps1
@@ -7,6 +7,7 @@ $PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
 
 $SourceDir = Split-Path (Split-Path (Get-Variable MyInvocation).Value.MyCommand.Path)
 $BuildDir = Get-Location
+$Success = $true
 
 if ($Env:SKIP_TESTS) { exit }
 
@@ -24,7 +25,7 @@ function run_test {
 	Write-Host $TestCommand
 	Invoke-Expression $TestCommand
 
-	if ($LastExitCode -ne 0) { [Environment]::Exit($LastExitCode) }
+	if ($LastExitCode -ne 0) { $Success = $false }
 }
 
 Write-Host "##############################################################################"
@@ -67,3 +68,5 @@ if (-not $Env:SKIP_PROXY_TESTS) {
 
 	taskkill /F /IM javaw.exe
 }
+
+if (-not $Success) { exit 1 }
diff --git a/ci/test.sh b/ci/test.sh
index ff5e7a0ec..fea9d82d7 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -11,6 +11,8 @@ BUILD_DIR=$(pwd)
 TMPDIR=${TMPDIR:-/tmp}
 USER=${USER:-$(whoami)}
 
+SUCCESS=1
+
 VALGRIND="valgrind --leak-check=full --show-reachable=yes --error-exitcode=125 --num-callers=50 --suppressions=\"$SOURCE_DIR/libgit2_clar.supp\""
 LEAKS="MallocStackLogging=1 MallocScribble=1 leaks -quiet -atExit -- nohup"
 
@@ -30,11 +32,9 @@ cleanup() {
 	echo "Done."
 }
 
-die() {
+failure() {
 	echo "Test exited with code: $1"
-
-	cleanup
-	exit $1
+	SUCCESS=0
 }
 
 # Ask ctest what it would run if we were to invoke it directly.  This lets
@@ -54,7 +54,7 @@ run_test() {
 		RUNNER="$TEST_CMD"
 	fi
 
-	eval $RUNNER || die $?
+	eval $RUNNER || failure
 }
 
 # Configure the test environment; run them early so that we're certain
@@ -187,6 +187,12 @@ if [ -z "$SKIP_SSH_TESTS" ]; then
 	unset GITTEST_REMOTE_SSH_FINGERPRINT
 fi
 
-echo "Success."
 cleanup
+
+if [ "$SUCCESS" -ne "1" ]; then
+	echo "Some tests failed."
+	exit 1
+fi
+
+echo "Success."
 exit 0
-- 
cgit v1.2.1


From 2dbb78f15efab71cc0b2ebbb921ba47951c5a0d9 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 25 Oct 2018 14:26:28 -0700
Subject: ci: fail on test failures

PowerShell can _read_ top-level variables in functions, but cannot _update_
top-level variables in functions unless they're explicitly prefixed with
`$global`.

(cherry picked from commit 0e26717a57169d1222bdebef3f0caa728fd85b75)
---
 ci/test.ps1 | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/ci/test.ps1 b/ci/test.ps1
index 7a55bff79..1cf02118f 100644
--- a/ci/test.ps1
+++ b/ci/test.ps1
@@ -7,7 +7,7 @@ $PSDefaultParameterValues['*:ErrorAction'] = 'Stop'
 
 $SourceDir = Split-Path (Split-Path (Get-Variable MyInvocation).Value.MyCommand.Path)
 $BuildDir = Get-Location
-$Success = $true
+$global:Success = $true
 
 if ($Env:SKIP_TESTS) { exit }
 
@@ -25,7 +25,7 @@ function run_test {
 	Write-Host $TestCommand
 	Invoke-Expression $TestCommand
 
-	if ($LastExitCode -ne 0) { $Success = $false }
+	if ($LastExitCode -ne 0) { $global:Success = $false }
 }
 
 Write-Host "##############################################################################"
@@ -69,4 +69,4 @@ if (-not $Env:SKIP_PROXY_TESTS) {
 	taskkill /F /IM javaw.exe
 }
 
-if (-not $Success) { exit 1 }
+if (-Not $global:Success) { exit 1 }
-- 
cgit v1.2.1


From 67182a2452c5b7613413360aefd2d315b7fd5046 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Jan 2018 07:48:28 +0000
Subject: tests: online::clone: fix memory leak due to not freeing URL

(cherry picked from commit 820fb71292c8065ee83b00f82b909806916e0df2)
---
 tests/online/clone.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tests/online/clone.c b/tests/online/clone.c
index a0e7ff45e..27b7b9661 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -738,4 +738,6 @@ void test_online_clone__proxy_credentials_in_url(void)
 	called_proxy_creds = 0;
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 	cl_assert(called_proxy_creds == 0);
+
+	git_buf_free(&url);
 }
-- 
cgit v1.2.1


From 49ee0ae6ff1621d3093947c08868f4a4aeb56a91 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 21:50:58 +0100
Subject: smart subtransport: free url when resetting stream

Free the url field when resetting the stream to avoid leaking it.

(cherry picked from commit ca2eb4608243162a13c427e74526b6422d5a6659)
---
 src/transports/smart.c | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/src/transports/smart.c b/src/transports/smart.c
index a96fdf6fb..5cf107dd9 100644
--- a/src/transports/smart.c
+++ b/src/transports/smart.c
@@ -43,6 +43,11 @@ GIT_INLINE(int) git_smart__reset_stream(transport_smart *t, bool close_subtransp
 		t->current_stream = NULL;
 	}
 
+	if (t->url) {
+		git__free(t->url);
+		t->url = NULL;
+	}
+
 	if (close_subtransport &&
 		t->wrapped->close(t->wrapped) < 0)
 		return -1;
-- 
cgit v1.2.1


From 49011d32deca7a2d2a3c6ceff3918ce634e270ce Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 21:51:36 +0100
Subject: push tests: deeply free the push status

Don't just free the push status structure, actually free the strings that were
strdup'd into the struct as well.

(cherry picked from commit dad9988121521ccc2ffff39299ca98dba160b857)
---
 tests/online/push.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/tests/online/push.c b/tests/online/push.c
index f72b4f8cb..cdfb5a64e 100644
--- a/tests/online/push.c
+++ b/tests/online/push.c
@@ -152,8 +152,12 @@ static void do_verify_push_status(record_callbacks_data *data, const push_status
 		git_buf_free(&msg);
 	}
 
-	git_vector_foreach(actual, i, iter)
-		git__free(iter);
+	git_vector_foreach(actual, i, iter) {
+		push_status *s = (push_status *)iter;
+		git__free(s->ref);
+		git__free(s->msg);
+		git__free(s);
+	}
 
 	git_vector_free(actual);
 }
-- 
cgit v1.2.1


From f93091c32daa96d9fca6ae90eae1605fb9296911 Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Fri, 20 Jul 2018 21:52:24 +0100
Subject: push tests: deeply free the specs

Don't just free the spec vector, also free the specs themselves.

(cherry picked from commit d285de73f9a09bc841b329267d1f61b9c03a7b68)
---
 tests/online/push.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/tests/online/push.c b/tests/online/push.c
index cdfb5a64e..3b98278e0 100644
--- a/tests/online/push.c
+++ b/tests/online/push.c
@@ -397,7 +397,7 @@ void test_online_push__initialize(void)
 	}
 
 	git_remote_disconnect(_remote);
-	git_vector_free(&delete_specs);
+	git_vector_free_deep(&delete_specs);
 
 	/* Now that we've deleted everything, fetch from the remote */
 	memcpy(&fetch_opts.callbacks, &_record_cbs, sizeof(git_remote_callbacks));
-- 
cgit v1.2.1


From 53b4c4ae333bd8c2f51ad52c9accd3526425570b Mon Sep 17 00:00:00 2001
From: Edward Thomson <ethomson@edwardthomson.com>
Date: Thu, 20 Sep 2018 20:11:36 +1000
Subject: online::clone: free url and username before resetting

Before resetting the url and username, ensure that we free them in case
they were set by environment variables.

(cherry picked from commit e84914fd30edc6702e368c8ccfc77dc5607c213c)
---
 tests/online/clone.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/tests/online/clone.c b/tests/online/clone.c
index 27b7b9661..3fc6ddd03 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -263,6 +263,9 @@ static int cred_failure_cb(
 
 void test_online_clone__cred_callback_failure_return_code_is_tunnelled(void)
 {
+	git__free(_remote_url);
+	git__free(_remote_user);
+
 	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
 	_remote_user = git__strdup("libgit2test");
 
@@ -293,6 +296,9 @@ void test_online_clone__cred_callback_called_again_on_auth_failure(void)
 {
 	size_t counter = 0;
 
+	git__free(_remote_url);
+	git__free(_remote_user);
+
 	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
 	_remote_user = git__strdup("libgit2test");
 
-- 
cgit v1.2.1


From 2b32806bc4734cb4e1f450276e98ff362b5224d3 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:25:59 +0200
Subject: commit_list: avoid use of strtol64 without length limit

When quick-parsing a commit, we use `git__strtol64` to parse the
commit's time. The buffer that's passed to `commit_quick_parse` is the
raw data of an ODB object, though, whose data may not be properly
formatted and also does not have to be `NUL` terminated. This may lead
to out-of-bound reads.

Use `git__strntol64` to avoid this problem.

(cherry picked from commit 1a3fa1f5fafd433bdcf1834426d6963eff532125)
---
 src/commit_list.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/src/commit_list.c b/src/commit_list.c
index 3bba58c27..7df79bfd6 100644
--- a/src/commit_list.c
+++ b/src/commit_list.c
@@ -171,7 +171,9 @@ static int commit_quick_parse(
 			buffer--;
 	}
 
-	if ((buffer == committer_start) || (git__strtol64(&commit_time, (char *)(buffer + 1), NULL, 10) < 0))
+	if ((buffer == committer_start) ||
+	    (git__strntol64(&commit_time, (char *)(buffer + 1),
+			    buffer_end - buffer + 1, NULL, 10) < 0))
 		return commit_error(commit, "cannot parse commit time");
 
 	commit->time = commit_time;
-- 
cgit v1.2.1


From da0e03ce0298dd0fc409ac4abf06fbad0d20e60a Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:29:06 +0200
Subject: index: avoid out-of-bounds read when reading reuc entry stage

We use `git__strtol64` to parse file modes of the index entries, which
does not limit the parsed buffer length. As the index can be essentially
treated as "untrusted" in that the data stems from the file system, it
may be misformatted and may not contain terminating `NUL` bytes. This
may lead to out-of-bounds reads when trying to parse index entries with
such malformatted modes.

Fix the issue by using `git__strntol64` instead.

(cherry picked from commit 600ceadd1426b874ae0618651210a690a68b27e9)
---
 src/index.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/index.c b/src/index.c
index c5f6550d6..d7952ac6e 100644
--- a/src/index.c
+++ b/src/index.c
@@ -2202,7 +2202,7 @@ static int read_reuc(git_index *index, const char *buffer, size_t size)
 		for (i = 0; i < 3; i++) {
 			int64_t tmp;
 
-			if (git__strtol64(&tmp, buffer, &endptr, 8) < 0 ||
+			if (git__strntol64(&tmp, buffer, size, &endptr, 8) < 0 ||
 				!endptr || endptr == buffer || *endptr ||
 				tmp < 0 || tmp > UINT32_MAX) {
 				index_entry_reuc_free(lost);
-- 
cgit v1.2.1


From ac1751f6df72b82df0e5f8b9ca4a8ad894d33ae1 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:32:48 +0200
Subject: signature: avoid out-of-bounds reads when parsing signature dates

We use `git__strtol64` and `git__strtol32` to parse the trailing commit
or author date and timezone of signatures. As signatures are usually
part of a commit or tag object and thus essentially untrusted data, the
buffer may be misformatted and may not be `NUL` terminated. This may
lead to an out-of-bounds read.

Fix the issue by using `git__strntol64` and `git__strntol32` instead.

(cherry picked from commit 3db9aa6f79711103a331a2bbbd044a3c37d4f136)
---
 src/signature.c | 8 +++++---
 1 file changed, 5 insertions(+), 3 deletions(-)

diff --git a/src/signature.c b/src/signature.c
index 25e0ee723..2e0cfe01a 100644
--- a/src/signature.c
+++ b/src/signature.c
@@ -228,7 +228,8 @@ int git_signature__parse(git_signature *sig, const char **buffer_out,
 		const char *time_start = email_end + 2;
 		const char *time_end;
 
-		if (git__strtol64(&sig->when.time, time_start, &time_end, 10) < 0) {
+		if (git__strntol64(&sig->when.time, time_start,
+				   buffer_end - time_start, &time_end, 10) < 0) {
 			git__free(sig->name);
 			git__free(sig->email);
 			sig->name = sig->email = NULL;
@@ -243,8 +244,9 @@ int git_signature__parse(git_signature *sig, const char **buffer_out,
 			tz_start = time_end + 1;
 
 			if ((tz_start[0] != '-' && tz_start[0] != '+') ||
-				git__strtol32(&offset, tz_start + 1, &tz_end, 10) < 0) {
-				//malformed timezone, just assume it's zero
+			    git__strntol32(&offset, tz_start + 1,
+					   buffer_end - tz_start + 1, &tz_end, 10) < 0) {
+				/* malformed timezone, just assume it's zero */
 				offset = 0;
 			}
 
-- 
cgit v1.2.1


From 7876381427b122fb2fc40685c59a7695041201b8 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:35:08 +0200
Subject: config: remove last instance of `git__strntol64`

When parsing integers from configuration values, we use `git__strtol64`.
This is fine to do, as we always sanitize values and can thus be sure
that they'll have a terminating `NUL` byte. But as this is the last
call-site of `git__strtol64`, let's just pass in the length explicitly
by calling `strlen` on the value to be able to remove `git__strtol64`
altogether.

(cherry picked from commit 1a2efd10bde66f798375e2f47ba57ef00ad5c193)
---
 src/config.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/config.c b/src/config.c
index 169a62880..b0cb2c117 100644
--- a/src/config.c
+++ b/src/config.c
@@ -1298,7 +1298,7 @@ int git_config_parse_int64(int64_t *out, const char *value)
 	const char *num_end;
 	int64_t num;
 
-	if (!value || git__strtol64(&num, value, &num_end, 0) < 0)
+	if (!value || git__strntol64(&num, value, strlen(value), &num_end, 0) < 0)
 		goto fail_parse;
 
 	switch (*num_end) {
-- 
cgit v1.2.1


From ef7b7c73c4a5725ac184fb02f67d3e3c20845c31 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:37:10 +0200
Subject: util: remove unsafe `git__strtol64` function

The function `git__strtol64` does not take a maximum buffer length as
parameter. This has led to some unsafe usages of this function, and as
such we may consider it as being unsafe to use. As we have now
eradicated all usages of this function, let's remove it completely to
avoid future misuse.

(cherry picked from commit 68deb2cc80ef19bf3a1915c26b5308b283a6d69a)
---
 src/util.c          |  6 ------
 src/util.h          |  1 -
 tests/core/strtol.c | 38 ++++++++++++++++----------------------
 3 files changed, 16 insertions(+), 29 deletions(-)

diff --git a/src/util.c b/src/util.c
index 964b0ab6a..9fd6e6cb1 100644
--- a/src/util.c
+++ b/src/util.c
@@ -64,12 +64,6 @@ int git_strarray_copy(git_strarray *tgt, const git_strarray *src)
 	return 0;
 }
 
-int git__strtol64(int64_t *result, const char *nptr, const char **endptr, int base)
-{
-
-	return git__strntol64(result, nptr, (size_t)-1, endptr, base);
-}
-
 int git__strntol64(int64_t *result, const char *nptr, size_t nptr_len, const char **endptr, int base)
 {
 	const char *p;
diff --git a/src/util.h b/src/util.h
index 8e666f9de..e82cbf531 100644
--- a/src/util.h
+++ b/src/util.h
@@ -265,7 +265,6 @@ GIT_INLINE(int) git__signum(int val)
 
 extern int git__strtol32(int32_t *n, const char *buff, const char **end_buf, int base);
 extern int git__strntol32(int32_t *n, const char *buff, size_t buff_len, const char **end_buf, int base);
-extern int git__strtol64(int64_t *n, const char *buff, const char **end_buf, int base);
 extern int git__strntol64(int64_t *n, const char *buff, size_t buff_len, const char **end_buf, int base);
 
 
diff --git a/tests/core/strtol.c b/tests/core/strtol.c
index 0d3b6a5e6..30109b438 100644
--- a/tests/core/strtol.c
+++ b/tests/core/strtol.c
@@ -17,29 +17,23 @@ void test_core_strtol__int32(void)
 	cl_git_fail(git__strtol32(&i, "  -2147483657 ", NULL, 10));
 }
 
-void test_core_strtol__int64(void)
+static void assert_l64_parses(const char *string, int64_t expected, int base)
 {
 	int64_t i;
-
-	cl_git_pass(git__strtol64(&i, "123", NULL, 10));
-	cl_assert(i == 123);
-	cl_git_pass(git__strtol64(&i, "  +123 ", NULL, 10));
-	cl_assert(i == 123);
-	cl_git_pass(git__strtol64(&i, "  +2147483647 ", NULL, 10));
-	cl_assert(i == 2147483647);
-	cl_git_pass(git__strtol64(&i, "  -2147483648 ", NULL, 10));
-	cl_assert(i == -2147483648LL);
-	cl_git_pass(git__strtol64(&i, "  2147483657 ", NULL, 10));
-	cl_assert(i == 2147483657LL);
-	cl_git_pass(git__strtol64(&i, "  -2147483657 ", NULL, 10));
-	cl_assert(i == -2147483657LL);
-	cl_git_pass(git__strtol64(&i, " 9223372036854775807  ", NULL, 10));
-	cl_assert(i == INT64_MAX);
-	cl_git_pass(git__strtol64(&i, "   -9223372036854775808  ", NULL, 10));
-	cl_assert(i == INT64_MIN);
-	cl_git_pass(git__strtol64(&i, "   0x7fffffffffffffff  ", NULL, 16));
-	cl_assert(i == INT64_MAX);
-	cl_git_pass(git__strtol64(&i, "   -0x8000000000000000   ", NULL, 16));
-	cl_assert(i == INT64_MIN);
+	cl_git_pass(git__strntol64(&i, string, strlen(string), NULL, base));
+	cl_assert_equal_i(i, expected);
 }
 
+void test_core_strtol__int64(void)
+{
+	assert_l64_parses("123", 123, 10);
+	assert_l64_parses("  +123 ", 123, 10);
+	assert_l64_parses("  +2147483647 ", 2147483647, 10);
+	assert_l64_parses("  -2147483648 ", -2147483648LL, 10);
+	assert_l64_parses("  2147483657 ", 2147483657LL, 10);
+	assert_l64_parses("  -2147483657 ", -2147483657LL, 10);
+	assert_l64_parses(" 9223372036854775807  ", INT64_MAX, 10);
+	assert_l64_parses("   -9223372036854775808  ", INT64_MIN, 10);
+	assert_l64_parses("   0x7fffffffffffffff  ", INT64_MAX, 16);
+	assert_l64_parses("   -0x8000000000000000   ", INT64_MIN, 16);
+}
-- 
cgit v1.2.1


From 49213f279a778b23937232733948e2966b930bd7 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:43:30 +0200
Subject: tree-cache: avoid out-of-bound reads when parsing trees

We use the `git__strtol32` function to parse the child and entry count
of treecaches from the index, which do not accept a buffer length. As
the buffer that is being passed in is untrusted data and may thus be
malformed and may not contain a terminating `NUL` byte, we can overrun
the buffer and thus perform an out-of-bounds read.

Fix the issue by uzing `git__strntol32` instead.

(cherry picked from commit 21652ee9de439e042cc2e69b208aa2ef8ce31147)
---
 src/tree-cache.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/src/tree-cache.c b/src/tree-cache.c
index 548054136..17f235977 100644
--- a/src/tree-cache.c
+++ b/src/tree-cache.c
@@ -90,7 +90,7 @@ static int read_tree_internal(git_tree_cache **out,
 		return -1;
 
 	/* Blank-terminated ASCII decimal number of entries in this tree */
-	if (git__strtol32(&count, buffer, &buffer, 10) < 0)
+	if (git__strntol32(&count, buffer, buffer_end - buffer, &buffer, 10) < 0)
 		goto corrupted;
 
 	tree->entry_count = count;
@@ -99,7 +99,7 @@ static int read_tree_internal(git_tree_cache **out,
 		goto corrupted;
 
 	 /* Number of children of the tree, newline-terminated */
-	if (git__strtol32(&count, buffer, &buffer, 10) < 0 || count < 0)
+	if (git__strntol32(&count, buffer, buffer_end - buffer, &buffer, 10) < 0 || count < 0)
 		goto corrupted;
 
 	tree->children_count = count;
-- 
cgit v1.2.1


From f4f6eb592380523ce31b2a7fe2beab03837e589d Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 11:58:14 +0200
Subject: global: replace remaining use of `git__strtol32`

Replace remaining uses of the `git__strtol32` function. While these uses
are all safe as the strings were either sanitized or from a trusted
source, we want to remove `git__strtol32` altogether to avoid future
misuse.

(cherry picked from commit 2613fbb26a3e1a34dda8a5d198c108626cfd6cc3)
---
 src/curl_stream.c          | 2 +-
 src/rebase.c               | 2 +-
 src/revparse.c             | 5 +++--
 src/transports/smart_pkt.c | 2 +-
 src/transports/winhttp.c   | 3 ++-
 5 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/src/curl_stream.c b/src/curl_stream.c
index f07370f21..4e34ae2b9 100644
--- a/src/curl_stream.c
+++ b/src/curl_stream.c
@@ -328,7 +328,7 @@ int git_curl_stream_new(git_stream **out, const char *host, const char *port)
 		return -1;
 	}
 
-	if ((error = git__strtol32(&iport, port, NULL, 10)) < 0) {
+	if ((error = git__strntol32(&iport, port, strlen(port), NULL, 10)) < 0) {
 		git__free(st);
 		return error;
 	}
diff --git a/src/rebase.c b/src/rebase.c
index f528031b3..6d31bf3ba 100644
--- a/src/rebase.c
+++ b/src/rebase.c
@@ -151,7 +151,7 @@ GIT_INLINE(int) rebase_readint(
 	if ((error = rebase_readfile(asc_out, state_path, filename)) < 0)
 		return error;
 
-	if (git__strtol32(&num, asc_out->ptr, &eol, 10) < 0 || num < 0 || *eol) {
+	if (git__strntol32(&num, asc_out->ptr, asc_out->size, &eol, 10) < 0 || num < 0 || *eol) {
 		giterr_set(GITERR_REBASE, "the file '%s' contains an invalid numeric value", filename);
 		return -1;
 	}
diff --git a/src/revparse.c b/src/revparse.c
index fd6bd1ea6..927e83073 100644
--- a/src/revparse.c
+++ b/src/revparse.c
@@ -127,7 +127,8 @@ static int try_parse_numeric(int *n, const char *curly_braces_content)
 	int32_t content;
 	const char *end_ptr;
 
-	if (git__strtol32(&content, curly_braces_content, &end_ptr, 10) < 0)
+	if (git__strntol32(&content, curly_braces_content, strlen(curly_braces_content),
+			   &end_ptr, 10) < 0)
 		return -1;
 
 	if (*end_ptr != '\0')
@@ -577,7 +578,7 @@ static int extract_how_many(int *n, const char *spec, size_t *pos)
 		} while (spec[(*pos)] == kind && kind == '~');
 
 		if (git__isdigit(spec[*pos])) {
-			if (git__strtol32(&parsed, spec + *pos, &end_ptr, 10) < 0)
+			if (git__strntol32(&parsed, spec + *pos, strlen(spec + *pos), &end_ptr, 10) < 0)
 				return GIT_EINVALIDSPEC;
 
 			accumulated += (parsed - 1);
diff --git a/src/transports/smart_pkt.c b/src/transports/smart_pkt.c
index e726d0777..0e05ff861 100644
--- a/src/transports/smart_pkt.c
+++ b/src/transports/smart_pkt.c
@@ -391,7 +391,7 @@ static int parse_len(size_t *out, const char *line, size_t linelen)
 		}
 	}
 
-	if ((error = git__strtol32(&len, num, &num_end, 16)) < 0)
+	if ((error = git__strntol32(&len, num, PKT_LEN_SIZE, &num_end, 16)) < 0)
 		return error;
 
 	if (len < 0)
diff --git a/src/transports/winhttp.c b/src/transports/winhttp.c
index cf6445f53..c54e16d0f 100644
--- a/src/transports/winhttp.c
+++ b/src/transports/winhttp.c
@@ -764,7 +764,8 @@ static int winhttp_connect(
 	t->connection = NULL;
 
 	/* Prepare port */
-	if (git__strtol32(&port, t->connection_data.port, NULL, 10) < 0)
+	if (git__strntol32(&port, t->connection_data.port,
+			   strlen(t->connection_data.port), NULL, 10) < 0)
 		return -1;
 
 	/* Prepare host */
-- 
cgit v1.2.1


From d4a4e6be4089fbc1dcb5fd3b9a9913a61b9cacbb Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 12:04:07 +0200
Subject: util: remove `git__strtol32`

The function `git__strtol32` can easily be misused when untrusted data
is passed to it that may not have been sanitized with trailing `NUL`
bytes. As all usages of this function have now been removed, we can
remove this function altogether to avoid future misuse of it.

(cherry picked from commit 8d7fa88a9d5011b653035497b0f523e0f177b6a6)
---
 src/util.c          |  6 ------
 src/util.h          |  1 -
 tests/core/strtol.c | 31 +++++++++++++++++++------------
 3 files changed, 19 insertions(+), 19 deletions(-)

diff --git a/src/util.c b/src/util.c
index 9fd6e6cb1..d47b18ae5 100644
--- a/src/util.c
+++ b/src/util.c
@@ -146,12 +146,6 @@ Return:
 	return 0;
 }
 
-int git__strtol32(int32_t *result, const char *nptr, const char **endptr, int base)
-{
-
-	return git__strntol32(result, nptr, (size_t)-1, endptr, base);
-}
-
 int git__strntol32(int32_t *result, const char *nptr, size_t nptr_len, const char **endptr, int base)
 {
 	int error;
diff --git a/src/util.h b/src/util.h
index e82cbf531..9c76f0ec0 100644
--- a/src/util.h
+++ b/src/util.h
@@ -263,7 +263,6 @@ GIT_INLINE(int) git__signum(int val)
 	return ((val > 0) - (val < 0));
 }
 
-extern int git__strtol32(int32_t *n, const char *buff, const char **end_buf, int base);
 extern int git__strntol32(int32_t *n, const char *buff, size_t buff_len, const char **end_buf, int base);
 extern int git__strntol64(int64_t *n, const char *buff, size_t buff_len, const char **end_buf, int base);
 
diff --git a/tests/core/strtol.c b/tests/core/strtol.c
index 30109b438..c35f18212 100644
--- a/tests/core/strtol.c
+++ b/tests/core/strtol.c
@@ -1,20 +1,16 @@
 #include "clar_libgit2.h"
 
-void test_core_strtol__int32(void)
+static void assert_l32_parses(const char *string, int32_t expected, int base)
 {
 	int32_t i;
+	cl_git_pass(git__strntol32(&i, string, strlen(string), NULL, base));
+	cl_assert_equal_i(i, expected);
+}
 
-	cl_git_pass(git__strtol32(&i, "123", NULL, 10));
-	cl_assert(i == 123);
-	cl_git_pass(git__strtol32(&i, "  +123 ", NULL, 10));
-	cl_assert(i == 123);
-	cl_git_pass(git__strtol32(&i, "  +2147483647 ", NULL, 10));
-	cl_assert(i == 2147483647);
-	cl_git_pass(git__strtol32(&i, "  -2147483648 ", NULL, 10));
-	cl_assert(i == -2147483648LL);
-	
-	cl_git_fail(git__strtol32(&i, "  2147483657 ", NULL, 10));
-	cl_git_fail(git__strtol32(&i, "  -2147483657 ", NULL, 10));
+static void assert_l32_fails(const char *string, int base)
+{
+	int32_t i;
+	cl_git_fail(git__strntol32(&i, string, strlen(string), NULL, base));
 }
 
 static void assert_l64_parses(const char *string, int64_t expected, int base)
@@ -24,6 +20,17 @@ static void assert_l64_parses(const char *string, int64_t expected, int base)
 	cl_assert_equal_i(i, expected);
 }
 
+void test_core_strtol__int32(void)
+{
+	assert_l32_parses("123", 123, 10);
+	assert_l32_parses("  +123 ", 123, 10);
+	assert_l32_parses("  +2147483647 ", 2147483647, 10);
+	assert_l32_parses("  -2147483648 ", -2147483648LL, 10);
+
+	assert_l32_fails("  2147483657 ", 10);
+	assert_l32_fails("  -2147483657 ", 10);
+}
+
 void test_core_strtol__int64(void)
 {
 	assert_l64_parses("123", 123, 10);
-- 
cgit v1.2.1


From 1da9fe3de3212d15b63d48a696320da88a915f0b Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 12:11:33 +0200
Subject: tests: core::strtol: test for some more edge-cases

Some edge cases were currently completely untested, e.g. parsing numbers
greater than INT64_{MIN,MAX}, truncating buffers by length and invalid
characters. Add tests to verify that the system under test performs as
expected.

(cherry picked from commit 39087ab8ef77004c9f3b8984c38a834a6cb238bc)
---
 tests/core/strtol.c | 31 +++++++++++++++++++++++++++++++
 1 file changed, 31 insertions(+)

diff --git a/tests/core/strtol.c b/tests/core/strtol.c
index c35f18212..3d284b350 100644
--- a/tests/core/strtol.c
+++ b/tests/core/strtol.c
@@ -20,13 +20,24 @@ static void assert_l64_parses(const char *string, int64_t expected, int base)
 	cl_assert_equal_i(i, expected);
 }
 
+static void assert_l64_fails(const char *string, int base)
+{
+	int64_t i;
+	cl_git_fail(git__strntol64(&i, string, strlen(string), NULL, base));
+}
+
 void test_core_strtol__int32(void)
 {
 	assert_l32_parses("123", 123, 10);
 	assert_l32_parses("  +123 ", 123, 10);
 	assert_l32_parses("  +2147483647 ", 2147483647, 10);
 	assert_l32_parses("  -2147483648 ", -2147483648LL, 10);
+	assert_l32_parses("A", 10, 16);
+	assert_l32_parses("1x1", 1, 10);
 
+	assert_l32_fails("", 10);
+	assert_l32_fails("a", 10);
+	assert_l32_fails("x10x", 10);
 	assert_l32_fails("  2147483657 ", 10);
 	assert_l32_fails("  -2147483657 ", 10);
 }
@@ -43,4 +54,24 @@ void test_core_strtol__int64(void)
 	assert_l64_parses("   -9223372036854775808  ", INT64_MIN, 10);
 	assert_l64_parses("   0x7fffffffffffffff  ", INT64_MAX, 16);
 	assert_l64_parses("   -0x8000000000000000   ", INT64_MIN, 16);
+	assert_l64_parses("1a", 26, 16);
+	assert_l64_parses("1A", 26, 16);
+
+	assert_l64_fails("", 10);
+	assert_l64_fails("a", 10);
+	assert_l64_fails("x10x", 10);
+	assert_l64_fails("0x8000000000000000", 16);
+	assert_l64_fails("-0x8000000000000001", 16);
+}
+
+void test_core_strtol__buffer_length_truncates(void)
+{
+	int32_t i32;
+	int64_t i64;
+
+	cl_git_pass(git__strntol32(&i32, "11", 1, NULL, 10));
+	cl_assert_equal_i(i32, 1);
+
+	cl_git_pass(git__strntol64(&i64, "11", 1, NULL, 10));
+	cl_assert_equal_i(i64, 1);
 }
-- 
cgit v1.2.1


From 737df8b55e25f234685be03a7530bdd66f8489ee Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 14:37:55 +0200
Subject: util: avoid signed integer overflows in `git__strntol64`

While `git__strntol64` tries to detect integer overflows when doing the
necessary arithmetics to come up with the final result, it does the
detection only after the fact. This check thus relies on undefined
behavior of signed integer overflows. Fix this by instead checking
up-front whether the multiplications or additions will overflow.

Note that a detected overflow will not cause us to abort parsing the
current sequence of digits. In the case of an overflow, previous
behavior was to still set up the end pointer correctly to point to the
first character immediately after the currently parsed number. We do not
want to change this now as code may rely on the end pointer being set up
correctly even if the parsed number is too big to be represented as
64 bit integer.

(cherry picked from commit b09c1c7b636c4112e247adc24245c65f3f9478d0)
---
 src/util.c | 16 +++++++++++++---
 1 file changed, 13 insertions(+), 3 deletions(-)

diff --git a/src/util.c b/src/util.c
index d47b18ae5..62290f311 100644
--- a/src/util.c
+++ b/src/util.c
@@ -122,10 +122,20 @@ int git__strntol64(int64_t *result, const char *nptr, size_t nptr_len, const cha
 			v = c - 'A' + 10;
 		if (v >= base)
 			break;
-		nn = n * base + (neg ? -v : v);
-		if ((!neg && nn < n) || (neg && nn > n))
+		v = neg ? -v : v;
+		if (n > INT64_MAX / base || n < INT64_MIN / base) {
 			ovfl = 1;
-		n = nn;
+			/* Keep on iterating until the end of this number */
+			continue;
+		}
+		nn = n * base;
+		if ((v > 0 && nn > INT64_MAX - v) ||
+		    (v < 0 && nn < INT64_MIN - v)) {
+			ovfl = 1;
+			/* Keep on iterating until the end of this number */
+			continue;
+		}
+		n = nn + v;
 	}
 
 Return:
-- 
cgit v1.2.1


From 63e9c7fea07a438db01890208ec5c2be606a6329 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 15:08:56 +0200
Subject: util: fix out of bounds read in error message

When an integer that is parsed with `git__strntol32` is too big to fit
into an int32, we will generate an error message that includes the
actual string that failed to parse. This does not acknowledge the fact
that the string may either not be NUL terminated or alternative include
additional characters after the number that is to be parsed. We may thus
end up printing characters into the buffer that aren't the number or,
worse, read out of bounds.

Fix the issue by utilizing the `endptr` that was set by
`git__strntol64`. This pointer is guaranteed to be set to the first
character following the number, and we can thus use it to compute the
width of the number that shall be printed. Create a test to verify that
we correctly truncate the number.

(cherry picked from commit ea19efc19fa683d632af3e172868bc4350724813)
---
 src/util.c          | 10 +++++++---
 tests/core/strtol.c |  7 +++++++
 2 files changed, 14 insertions(+), 3 deletions(-)

diff --git a/src/util.c b/src/util.c
index 62290f311..370ea5837 100644
--- a/src/util.c
+++ b/src/util.c
@@ -158,20 +158,24 @@ Return:
 
 int git__strntol32(int32_t *result, const char *nptr, size_t nptr_len, const char **endptr, int base)
 {
-	int error;
+	const char *tmp_endptr;
 	int32_t tmp_int;
 	int64_t tmp_long;
+	int error;
 
-	if ((error = git__strntol64(&tmp_long, nptr, nptr_len, endptr, base)) < 0)
+	if ((error = git__strntol64(&tmp_long, nptr, nptr_len, &tmp_endptr, base)) < 0)
 		return error;
 
 	tmp_int = tmp_long & 0xFFFFFFFF;
 	if (tmp_int != tmp_long) {
-		giterr_set(GITERR_INVALID, "failed to convert: '%s' is too large", nptr);
+		int len = tmp_endptr - nptr;
+		giterr_set(GITERR_INVALID, "failed to convert: '%.*s' is too large", len, nptr);
 		return -1;
 	}
 
 	*result = tmp_int;
+	if (endptr)
+		*endptr = tmp_endptr;
 
 	return error;
 }
diff --git a/tests/core/strtol.c b/tests/core/strtol.c
index 3d284b350..ba79fba51 100644
--- a/tests/core/strtol.c
+++ b/tests/core/strtol.c
@@ -75,3 +75,10 @@ void test_core_strtol__buffer_length_truncates(void)
 	cl_git_pass(git__strntol64(&i64, "11", 1, NULL, 10));
 	cl_assert_equal_i(i64, 1);
 }
+
+void test_core_strtol__error_message_cuts_off(void)
+{
+	assert_l32_fails("2147483657foobar", 10);
+	cl_assert(strstr(giterr_last()->message, "2147483657") != NULL);
+	cl_assert(strstr(giterr_last()->message, "foobar") == NULL);
+}
-- 
cgit v1.2.1


From 09e609fb082755d5620b1fc55f4671e7b882ef75 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Thu, 18 Oct 2018 16:08:46 +0200
Subject: util: provide `git__memmem` function

Unfortunately, neither the `memmem` nor the `strnstr` functions are part
of any C standard but are merely extensions of C that are implemented by
e.g. glibc. Thus, there is no standardized way to search for a string in
a block of memory with a limited size, and using `strstr` is to be
considered unsafe in case where the buffer has not been sanitized. In
fact, there are some uses of `strstr` in exactly that unsafe way in our
codebase.

Provide a new function `git__memmem` that implements the `memmem`
semantics. That is in a given haystack of `n` bytes, search for the
occurrence of a byte sequence of `m` bytes and return a pointer to the
first occurrence. The implementation chosen is the "Not So Naive"
algorithm from [1]. It was chosen as the implementation is comparably
simple while still being reasonably efficient in most cases.
Preprocessing happens in constant time and space, searching has a time
complexity of O(n*m) with a slightly sub-linear average case.

[1]: http://www-igm.univ-mlv.fr/~lecroq/string/

(cherry picked from commit 83e8a6b36acc67f2702cbbc7d4e334c7f7737719)
---
 src/util.c          | 41 +++++++++++++++++++++++++++++++++++++++++
 src/util.h          |  3 +++
 tests/core/memmem.c | 46 ++++++++++++++++++++++++++++++++++++++++++++++
 3 files changed, 90 insertions(+)
 create mode 100644 tests/core/memmem.c

diff --git a/src/util.c b/src/util.c
index 370ea5837..1e7de93c3 100644
--- a/src/util.c
+++ b/src/util.c
@@ -353,6 +353,47 @@ size_t git__linenlen(const char *buffer, size_t buffer_len)
 	return nl ? (size_t)(nl - buffer) + 1 : buffer_len;
 }
 
+/*
+ * Adapted Not So Naive algorithm from http://www-igm.univ-mlv.fr/~lecroq/string/
+ */
+const void * git__memmem(const void *haystack, size_t haystacklen,
+			 const void *needle, size_t needlelen)
+{
+	const char *h, *n;
+	size_t j, k, l;
+
+	if (needlelen > haystacklen || !haystacklen || !needlelen)
+		return NULL;
+
+	h = (const char *) haystack,
+	n = (const char *) needle;
+
+	if (needlelen == 1)
+		return memchr(haystack, *n, haystacklen);
+
+	if (n[0] == n[1]) {
+		k = 2;
+		l = 1;
+	} else {
+		k = 1;
+		l = 2;
+	}
+
+	j = 0;
+	while (j <= haystacklen - needlelen) {
+		if (n[1] != h[j + 1]) {
+			j += k;
+		} else {
+			if (memcmp(n + 2, h + j + 2, needlelen - 2) == 0 &&
+			    n[0] == h[j])
+				return h + j;
+			j += l;
+		}
+	}
+
+	return NULL;
+}
+
 void git__hexdump(const char *buffer, size_t len)
 {
 	static const size_t LINE_WIDTH = 16;
diff --git a/src/util.h b/src/util.h
index 9c76f0ec0..2ac118d8f 100644
--- a/src/util.h
+++ b/src/util.h
@@ -316,6 +316,9 @@ GIT_INLINE(const void *) git__memrchr(const void *s, int c, size_t n)
 	return NULL;
 }
 
+extern const void * git__memmem(const void *haystack, size_t haystacklen,
+				const void *needle, size_t needlelen);
+
 typedef int (*git__tsort_cmp)(const void *a, const void *b);
 
 extern void git__tsort(void **dst, size_t size, git__tsort_cmp cmp);
diff --git a/tests/core/memmem.c b/tests/core/memmem.c
new file mode 100644
index 000000000..fd9986d01
--- /dev/null
+++ b/tests/core/memmem.c
@@ -0,0 +1,46 @@
+#include "clar_libgit2.h"
+
+static void assert_found(const char *haystack, const char *needle, size_t expected_pos)
+{
+	cl_assert_equal_p(git__memmem(haystack, haystack ? strlen(haystack) : 0,
+				      needle, needle ? strlen(needle) : 0),
+			  haystack + expected_pos);
+}
+
+static void assert_absent(const char *haystack, const char *needle)
+{
+	cl_assert_equal_p(git__memmem(haystack, haystack ? strlen(haystack) : 0,
+				      needle, needle ? strlen(needle) : 0),
+			  NULL);
+}
+
+void test_core_memmem__found(void)
+{
+	assert_found("a", "a", 0);
+	assert_found("ab", "a", 0);
+	assert_found("ba", "a", 1);
+	assert_found("aa", "a", 0);
+	assert_found("aab", "aa", 0);
+	assert_found("baa", "aa", 1);
+	assert_found("dabc", "abc", 1);
+	assert_found("abababc", "abc", 4);
+}
+
+void test_core_memmem__absent(void)
+{
+	assert_absent("a", "b");
+	assert_absent("a", "aa");
+	assert_absent("ba", "ab");
+	assert_absent("ba", "ab");
+	assert_absent("abc", "abcd");
+	assert_absent("abcabcabc", "bcac");
+}
+
+void test_core_memmem__edgecases(void)
+{
+	assert_absent(NULL, NULL);
+	assert_absent("a", NULL);
+	assert_absent(NULL, "a");
+	assert_absent("", "a");
+	assert_absent("a", "");
+}
-- 
cgit v1.2.1


From f122281fd6a8d0975ebd51da39a5c82ea8cd1b1d Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 09:47:50 +0200
Subject: tag: fix out of bounds read when searching for tag message

When parsing tags, we skip all unknown fields that appear before the tag
message. This skipping is done by using a plain `strstr(buffer, "\n\n")`
to search for the two newlines that separate tag fields from tag
message. As it is not possible to supply a buffer length to `strstr`,
this call may skip over the buffer's end and thus result in an out of
bounds read. As `strstr` may return a pointer that is out of bounds, the
following computation of `buffer_end - buffer` will overflow and result
in an allocation of an invalid length.

Fix the issue by using `git__memmem` instead. Add a test that verifies
parsing the tag fails not due to the allocation failure but due to the
tag having no message.

(cherry picked from commit ee11d47e3d907b66eeff99e0ba1e1c71e05164b7)
---
 src/tag.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/src/tag.c b/src/tag.c
index 2bf23fc3c..a0e968f38 100644
--- a/src/tag.c
+++ b/src/tag.c
@@ -70,10 +70,9 @@ static int tag_parse(git_tag *tag, const char *buffer, const char *buffer_end)
 	static const char *tag_types[] = {
 		NULL, "commit\n", "tree\n", "blob\n", "tag\n"
 	};
-
-	unsigned int i;
 	size_t text_len, alloc_len;
-	char *search;
+	const char *search;
+	unsigned int i;
 
 	if (git_oid__parse(&tag->target, &buffer, buffer_end, "object ") < 0)
 		return tag_error("object field invalid");
@@ -138,8 +137,9 @@ static int tag_parse(git_tag *tag, const char *buffer, const char *buffer_end)
 	tag->message = NULL;
 	if (buffer < buffer_end) {
 		/* If we're not at the end of the header, search for it */
-		if( *buffer != '\n' ) {
-			search = strstr(buffer, "\n\n");
+		if(*buffer != '\n') {
+			search = git__memmem(buffer, buffer_end - buffer,
+					     "\n\n", 2);
 			if (search)
 				buffer = search + 1;
 			else
-- 
cgit v1.2.1


From 052ab49abb179fa8334767c4025cba509fc28727 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 10:29:19 +0200
Subject: commit: fix reading out of bounds when parsing encoding

The commit message encoding is currently being parsed by the
`git__prefixcmp` function. As this function does not accept a buffer
length, it will happily skip over a buffer's end if it is not `NUL`
terminated.

Fix the issue by using `git__prefixncmp` instead. Add a test that
verifies that we are unable to parse the encoding field if it's cut off
by the supplied buffer length.

(cherry picked from commit 7655b2d89e8275853d9921dd903dcdad9b3d4a7b)
---
 src/commit.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/src/commit.c b/src/commit.c
index 4a340058a..0ec989421 100644
--- a/src/commit.c
+++ b/src/commit.c
@@ -442,7 +442,7 @@ int git_commit__parse(void *_commit, git_odb_object *odb_obj)
 		while (eoln < buffer_end && *eoln != '\n')
 			++eoln;
 
-		if (git__prefixcmp(buffer, "encoding ") == 0) {
+		if (git__prefixncmp(buffer, buffer_end - buffer, "encoding ") == 0) {
 			buffer += strlen("encoding ");
 
 			commit->message_encoding = git__strndup(buffer, eoln - buffer);
-- 
cgit v1.2.1


From 012e55e599a0e278ce4bbc00c1d6775f1215f20e Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 14:10:11 +0200
Subject: CHANGELOG: update changelog for v0.26.8

---
 CHANGELOG.md | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index a4903d392..68489feca 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -1,3 +1,51 @@
+v0.26.8
+-------
+
+This as a security release fixing the following list of issues:
+
+- The function family `git__strtol` is used to parse integers
+  from a buffer. As the functions do not take a buffer length as
+  argument, they will scan either until the end of the current
+  number or until a NUL byte is encountered. Many callers have
+  been misusing the function and called it on potentially
+  non-NUL-terminated buffers, resulting in possible out-of-bounds
+  reads. Callers have been fixed to use `git__strntol` functions
+  instead and `git__strtol` functions were removed.
+
+- The function `git__strntol64` relied on the undefined behavior
+  of signed integer overflows. While the code tried to detect
+  such overflows after they have happened, this is unspecified
+  behavior and may lead to weird behavior on uncommon platforms.
+
+- In the case where `git__strntol32` was unable to parse an
+  integer because it doesn't fit into an `int32_t`, it printed an
+  error message containing the string that is currently being
+  parsed. The code didn't truncate the string though, which
+  caused it to print the complete string until a NUL byte is
+  encountered and not only the currently parsed number. In case
+  where the string was not NUL terminated, this could have lead
+  to an out-of-bounds read.
+
+- When parsing tags, all unknown fields that appear before the
+  tag message are skipped. This skipping is done by using a plain
+  `strstr(buffer, "\n\n")` to search for the two newlines that
+  separate tag fields from tag message. As it is not possible to
+  supply a buffer length to `strstr`, this call may skip over the
+  buffer's end and thus result in an out of bounds read. As
+  `strstr` may return a pointer that is out of bounds, the
+  following computation of `buffer_end - buffer` will overflow
+  and result in an allocation of an invalid length. Note that
+  when reading objects from the object database, we make sure to
+  always NUL terminate them, making the use of `strstr` safe.
+
+- When parsing the "encoding" field of a commit, we may perform
+  an out of bounds read due to using `git__prefixcmp` instead of
+  `git__prefixncmp`. This can result in the parsed commit object
+  containing uninitialized data in both its message encoding and
+  message fields. Note that when reading objects from the object
+  database, we make sure to always NUL terminate them, making the
+  use of `strstr` safe.
+
 v0.26.7
 -------
 
-- 
cgit v1.2.1


From 3b6e006e38ab0c41968f4135104162861fa3f984 Mon Sep 17 00:00:00 2001
From: Patrick Steinhardt <ps@pks.im>
Date: Fri, 19 Oct 2018 14:10:27 +0200
Subject: version: bump to v0.26.8

---
 include/git2/version.h | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/include/git2/version.h b/include/git2/version.h
index 520726ec5..df2351b42 100644
--- a/include/git2/version.h
+++ b/include/git2/version.h
@@ -7,10 +7,10 @@
 #ifndef INCLUDE_git_version_h__
 #define INCLUDE_git_version_h__
 
-#define LIBGIT2_VERSION "0.26.7"
+#define LIBGIT2_VERSION "0.26.8"
 #define LIBGIT2_VER_MAJOR 0
 #define LIBGIT2_VER_MINOR 26
-#define LIBGIT2_VER_REVISION 7
+#define LIBGIT2_VER_REVISION 8
 #define LIBGIT2_VER_PATCH 0
 
 #define LIBGIT2_SOVERSION 26
-- 
cgit v1.2.1