thodg/libgit2

diff --git a/.travis.yml b/.travis.yml
index 61edba1..03df456 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -16,9 +16,12 @@ env:
  global:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
+  - MBEDTLS_DIR=/tmp/mbedtls
+  - SKIP_APT=1
+  - SKIP_MBEDTLS_INSTALL=1
  matrix:
-  - OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
-  - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
+  - CMAKE_OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release"
+  - CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON"
 
 dist: trusty
 sudo: false
@@ -51,31 +54,32 @@ matrix:
      dist: trusty
    - compiler: gcc
      env:
-       - VALGRIND=1
-         OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
+       - LEAK_CHECK=valgrind
+         CMAKE_OPTIONS="-DBUILD_CLAR=ON -DBUILD_EXAMPLES=OFF -DDEBUG_POOL=ON -DCMAKE_BUILD_TYPE=Debug"
      os: linux
      dist: trusty
    - compiler: gcc
      env:
-         MBEDTLS=1
-         OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=../deps/mbedtls"
+       - MBEDTLS=1
+         CMAKE_OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=/tmp/mbedtls"
      os: linux
    - compiler: gcc
      env:
-         MBEDTLS=1
-         OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=../deps/mbedtls"
+       - MBEDTLS=1
+         CMAKE_OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON -DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS -DMBEDTLS_ROOT_DIR=/tmp/mbedtls"
      os: linux
  allow_failures:
    - env: COVERITY=1
 
 install:
-  - if [ -f ./script/install-deps-${TRAVIS_OS_NAME}.sh ]; then ./script/install-deps-${TRAVIS_OS_NAME}.sh; fi
+  - if [ -f ./ci/setup-${TRAVIS_OS_NAME}.sh ]; then ./ci/setup-${TRAVIS_OS_NAME}.sh; fi
 
 # Run the Build script and tests
 script:
- - script/cibuild.sh
- - script/citest.sh
- - script/cileaks.sh
+ - mkdir build
+ - cd build
+ - if [ "$COVERITY" ]; then ../ci/coverity.sh; fi
+ - if [ -z "$COVERITY" ]; then ../ci/build.sh && ../ci/test.sh; fi
 
 # Only watch the development and master branches
 branches:
diff --git a/.vsts-ci.yml b/.vsts-ci.yml
index 2731e0a..ce215d8 100644
--- a/.vsts-ci.yml
+++ b/.vsts-ci.yml
@@ -135,7 +135,7 @@ phases:
   queue:
     name: 'Hosted macOS Preview'
   steps:
-  - bash: . '$(Build.SourcesDirectory)/ci/setup-macos.sh'
+  - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
   - bash: . '$(Build.SourcesDirectory)/ci/build.sh'
     displayName: Build
diff --git a/ci/coverity.sh b/ci/coverity.sh
new file mode 100755
index 0000000..57f4111
--- /dev/null
+++ b/ci/coverity.sh
@@ -0,0 +1,68 @@
+#!/bin/bash
+set -e
+
+# Only run this on our branches
+echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
+if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
+then
+	echo "Only analyzing the 'master' brach of the main repository."
+	exit 0
+fi
+
+# Environment check
+[ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
+
+case $(uname -m) in
+	i?86)				BITS=32 ;;
+	amd64|x86_64)	BITS=64 ;;
+esac
+SCAN_TOOL=https://scan.coverity.com/download/cxx/linux${BITS}
+TOOL_BASE=$(pwd)/_coverity-scan
+
+# Install coverity tools
+if [ ! -d "$TOOL_BASE" ]; then
+	echo "Downloading coverity..."
+	mkdir -p "$TOOL_BASE"
+	pushd "$TOOL_BASE"
+	wget -O coverity_tool.tgz $SCAN_TOOL \
+		--post-data "project=libgit2&token=$COVERITY_TOKEN"
+	tar xzf coverity_tool.tgz
+	popd
+	TOOL_DIR=$(find "$TOOL_BASE" -type d -name 'cov-analysis*')
+	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
+fi
+
+cp ../script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
+
+COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
+
+# Configure and build
+cmake .. -DTHREADSAFE=ON
+COVERITY_UNSUPPORTED=1 \
+	$COV_BUILD --dir cov-int \
+	cmake --build .
+
+# Upload results
+tar czf libgit2.tgz cov-int
+SHA=$(git rev-parse --short HEAD)
+
+HTML="$(curl \
+	--silent \
+	--write-out "\n%{http_code}" \
+	--form token="$COVERITY_TOKEN" \
+	--form email=bs@github.com \
+	--form file=@libgit2.tgz \
+	--form version="$SHA" \
+	--form description="Travis build" \
+	https://scan.coverity.com/builds?project=libgit2)"
+# Body is everything up to the last line
+BODY="$(echo "$HTML" | head -n-1)"
+# Status code is the last line
+STATUS_CODE="$(echo "$HTML" | tail -n1)"
+
+echo "${BODY}"
+
+if [ "${STATUS_CODE}" != "201" ]; then
+	echo "Received error code ${STATUS_CODE} from Coverity"
+	exit 1
+fi
diff --git a/ci/setup-linux.sh b/ci/setup-linux.sh
index 03e4a1d..c5ecb55 100755
--- a/ci/setup-linux.sh
+++ b/ci/setup-linux.sh
@@ -1,8 +1,27 @@
 #!/bin/sh
 
+set -e
 set -x
 
-apt-get update
-apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+TMPDIR=${TMPDIR:-/tmp}
+
+if [ -z "$SKIP_APT" ]; then
+	apt-get update
+	apt-get -y install build-essential pkg-config clang cmake openssl libssl-dev libssh2-1-dev libcurl4-gnutls-dev openssh-server
+fi
 
 mkdir -p /var/run/sshd
+
+if [ "$MBEDTLS" ]; then
+	MBEDTLS_DIR=${MBEDTLS_DIR:-$(mktemp -d ${TMPDIR}/mbedtls.XXXXXXXX)}
+
+	git clone --depth 10 --single-branch --branch mbedtls-2.6.1 https://github.com/ARMmbed/mbedtls.git ${MBEDTLS_DIR}
+	cd ${MBEDTLS_DIR}
+
+	CFLAGS=-fPIC cmake -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON .
+	cmake --build .
+
+	if [ -z "$SKIP_MBEDTLS_INSTALL" ]; then
+		make install
+	fi
+fi
diff --git a/ci/setup-macos.sh b/ci/setup-macos.sh
deleted file mode 100755
index 564910e..0000000
--- a/ci/setup-macos.sh
+++ /dev/null
@@ -1,8 +0,0 @@
-#!/bin/sh
-
-set -x
-
-brew update
-brew install pkgconfig zlib curl openssl libssh2
-
-ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/ci/setup-osx.sh b/ci/setup-osx.sh
new file mode 100755
index 0000000..564910e
--- /dev/null
+++ b/ci/setup-osx.sh
@@ -0,0 +1,8 @@
+#!/bin/sh
+
+set -x
+
+brew update
+brew install pkgconfig zlib curl openssl libssh2
+
+ln -s /Applications/Xcode.app/Contents/Developer/usr/lib/libLeaksAtExit.dylib /usr/local/lib
diff --git a/script/coverity.sh b/script/coverity.sh
deleted file mode 100755
index 5fe16c0..0000000
--- a/script/coverity.sh
+++ /dev/null
@@ -1,71 +0,0 @@
-#!/bin/bash
-set -e
-
-# Only run this on our branches
-echo "Branch: $TRAVIS_BRANCH  |  Pull request: $TRAVIS_PULL_REQUEST  |  Slug: $TRAVIS_REPO_SLUG"
-if [ "$TRAVIS_BRANCH" != "master" -o "$TRAVIS_PULL_REQUEST" != "false" -o "$TRAVIS_REPO_SLUG" != "libgit2/libgit2" ];
-then
-	echo "Only analyzing the 'master' brach of the main repository."
-	exit 0
-fi
-
-# Environment check
-[ -z "$COVERITY_TOKEN" ] && echo "Need to set a coverity token" && exit 1
-
-case $(uname -m) in
-	i?86)				BITS=32 ;;
-	amd64|x86_64)	BITS=64 ;;
-esac
-SCAN_TOOL=https://scan.coverity.com/download/cxx/linux${BITS}
-TOOL_BASE=$(pwd)/_coverity-scan
-
-# Install coverity tools
-if [ ! -d "$TOOL_BASE" ]; then
-	echo "Downloading coverity..."
-	mkdir -p "$TOOL_BASE"
-	pushd "$TOOL_BASE"
-	wget -O coverity_tool.tgz $SCAN_TOOL \
-		--post-data "project=libgit2&token=$COVERITY_TOKEN"
-	tar xzf coverity_tool.tgz
-	popd
-	TOOL_DIR=$(find "$TOOL_BASE" -type d -name 'cov-analysis*')
-	ln -s "$TOOL_DIR" "$TOOL_BASE"/cov-analysis
-fi
-
-cp script/user_nodefs.h "$TOOL_BASE"/cov-analysis/config/user_nodefs.h
-
-COV_BUILD="$TOOL_BASE/cov-analysis/bin/cov-build"
-
-# Configure and build
-rm -rf _build
-mkdir _build
-cd _build
-cmake .. -DTHREADSAFE=ON
-COVERITY_UNSUPPORTED=1 \
-	$COV_BUILD --dir cov-int \
-	cmake --build .
-
-# Upload results
-tar czf libgit2.tgz cov-int
-SHA=$(git rev-parse --short HEAD)
-
-HTML="$(curl \
-	--silent \
-	--write-out "\n%{http_code}" \
-	--form token="$COVERITY_TOKEN" \
-	--form email=bs@github.com \
-	--form file=@libgit2.tgz \
-	--form version="$SHA" \
-	--form description="Travis build" \
-	https://scan.coverity.com/builds?project=libgit2)"
-# Body is everything up to the last line
-BODY="$(echo "$HTML" | head -n-1)"
-# Status code is the last line
-STATUS_CODE="$(echo "$HTML" | tail -n1)"
-
-echo "${BODY}"
-
-if [ "${STATUS_CODE}" != "201" ]; then
-	echo "Received error code ${STATUS_CODE} from Coverity"
-	exit 1
-fi