thodg/libgit2

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index 2575f47..20335b3 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -9,7 +9,7 @@ jobs:
 - job: linux_amd64_xenial_gcc_openssl
   displayName: 'Linux (amd64; Xenial; GCC; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
@@ -25,7 +25,7 @@ jobs:
 - job: linux_amd64_xenial_gcc_mbedtls
   displayName: 'Linux (amd64; Xenial; GCC; mbedTLS)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
@@ -41,7 +41,7 @@ jobs:
 - job: linux_amd64_xenial_clang_openssl
   displayName: 'Linux (amd64; Xenial; Clang; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
@@ -57,7 +57,7 @@ jobs:
 - job: linux_amd64_xenial_clang_mbedtls
   displayName: 'Linux (amd64; Xenial; Clang; mbedTLS)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
@@ -71,9 +71,9 @@ jobs:
        GITTEST_NEGOTIATE_PASSWORD=${{ variables.GITTEST_NEGOTIATE_PASSWORD }}
 
 - job: macos
-  displayName: 'macOS'
+  displayName: 'macOS (amd64; 10.15)'
   pool:
-    vmImage: 'macOS 10.13'
+    vmImage: 'macOS-10.15'
   steps:
   - bash: . '$(Build.SourcesDirectory)/azure-pipelines/setup-osx.sh'
     displayName: Setup
@@ -89,31 +89,34 @@ jobs:
 
 - job: windows_vs_amd64
   displayName: 'Windows (amd64; Visual Studio)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - template: azure-pipelines/bash.yml
     parameters:
       environmentVariables:
-        CMAKE_GENERATOR: Visual Studio 12 2013 Win64
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON
+        CMAKE_GENERATOR: Visual Studio 15 2017
+        CMAKE_OPTIONS: -A x64 -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON
         SKIP_SSH_TESTS: true
         SKIP_NEGOTIATE_TESTS: true
 
 - job: windows_vs_x86
   displayName: 'Windows (x86; Visual Studio)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - template: azure-pipelines/bash.yml
     parameters:
       environmentVariables:
-        CMAKE_GENERATOR: Visual Studio 12 2013
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS
+        CMAKE_GENERATOR: Visual Studio 15 2017
+        CMAKE_OPTIONS: -A Win32 -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS
         SKIP_SSH_TESTS: true
         SKIP_NEGOTIATE_TESTS: true
 
 - job: windows_mingw_amd64
   displayName: 'Windows (amd64; MinGW)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - bash: . '$(Build.SourcesDirectory)\azure-pipelines\setup-mingw.sh'
     displayName: Setup
@@ -131,7 +134,8 @@ jobs:
 
 - job: windows_mingw_x86
   displayName: 'Windows (x86; MinGW)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - bash: . '$(Build.SourcesDirectory)\azure-pipelines\setup-mingw.sh'
     displayName: Setup
@@ -151,7 +155,7 @@ jobs:
 - job: documentation
   displayName: 'Generate Documentation'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - script: |
       cd $(Build.SourcesDirectory)/azure-pipelines/docker
diff --git a/azure-pipelines/coverity.sh b/azure-pipelines/coverity.sh
index 14faadc..c68b6f8 100755
--- a/azure-pipelines/coverity.sh
+++ b/azure-pipelines/coverity.sh
@@ -25,7 +25,7 @@ TOOL_DIR=${BUILD_DIR}/coverity-tools
 if ! test -d "$TOOL_DIR"
 then
     mkdir -p "$TOOL_DIR"
-    curl --silent --location --data "project=libgit2&token=$COVERITY_TOKEN" "$SCAN_TOOL" |
+    curl --silent --show-error --location --data "project=libgit2&token=$COVERITY_TOKEN" "$SCAN_TOOL" |
         tar -xzC "$TOOL_DIR"
     ln -s "$(find "$TOOL_DIR" -type d -name 'cov-analysis*')" "$TOOL_DIR"/cov-analysis
 fi
@@ -44,7 +44,7 @@ COVERITY_UNSUPPORTED=1 \
 tar -czf libgit2.tgz cov-int
 REVISION=$(cd ${SOURCE_DIR} && git rev-parse --short HEAD)
 HTML="$(curl \
-    --silent \
+    --silent --show-error \
     --write-out "\n%{http_code}" \
     --form token="$COVERITY_TOKEN" \
     --form email=libgit2@gmail.com \
diff --git a/azure-pipelines/coverity.yml b/azure-pipelines/coverity.yml
index 10450af..a8747db 100644
--- a/azure-pipelines/coverity.yml
+++ b/azure-pipelines/coverity.yml
@@ -5,7 +5,7 @@ jobs:
 - job: coverity
   displayName: 'Coverity'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - script: |
      cd $(Build.SourcesDirectory)/azure-pipelines/docker
diff --git a/azure-pipelines/docker/bionic b/azure-pipelines/docker/bionic
index 33175a0..65a1406 100644
--- a/azure-pipelines/docker/bionic
+++ b/azure-pipelines/docker/bionic
@@ -25,9 +25,7 @@ RUN apt-get update && \
 
 FROM apt AS mbedtls
 RUN cd /tmp && \
-    curl --location http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt | openssl x509 -inform der -out /tmp/cacert.pem && \
-    curl --location https://curl.haxx.se/ca/cacert.pem >> /tmp/cacert.pem && \
-    curl --location --silent https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz --cacert /tmp/cacert.pem | \
+    curl --location --silent --show-error https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz | \
     tar -xz && \
     cd mbedtls-2.16.2 && \
     scripts/config.pl set MBEDTLS_MD4_C 1 && \
diff --git a/azure-pipelines/docker/docurium b/azure-pipelines/docker/docurium
index 15d10a7..54a4202 100644
--- a/azure-pipelines/docker/docurium
+++ b/azure-pipelines/docker/docurium
@@ -1,6 +1,3 @@
-FROM debian:jessie-slim
-ARG CACHEBUST=1
-RUN apt-get update
-RUN apt install -y cmake pkg-config ruby ruby-dev llvm libclang-3.5-dev libssl-dev python-pygments
-ARG CACHEBUST=1
+FROM ubuntu:bionic
+RUN apt update && apt install -y cmake pkg-config ruby ruby-dev llvm libclang-dev libssl-dev python-pygments
 RUN gem install docurium
diff --git a/azure-pipelines/docker/xenial b/azure-pipelines/docker/xenial
index 475956f..bfb96d9 100644
--- a/azure-pipelines/docker/xenial
+++ b/azure-pipelines/docker/xenial
@@ -29,9 +29,7 @@ RUN apt-get update && \
 
 FROM apt AS mbedtls
 RUN cd /tmp && \
-    curl --location http://secure.globalsign.com/cacert/gsrsaovsslca2018.crt | openssl x509 -inform der -out /tmp/cacert.pem && \
-    curl --location https://curl.haxx.se/ca/cacert.pem >> /tmp/cacert.pem && \
-    curl --location --silent https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz --cacert /tmp/cacert.pem | \
+    curl --location --silent --show-error https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz | \
     tar -xz && \
     cd mbedtls-2.16.2 && \
     scripts/config.pl set MBEDTLS_MD4_C 1 && \
@@ -42,7 +40,7 @@ RUN cd /tmp && \
 
 FROM mbedtls AS libssh2
 RUN cd /tmp && \
-    curl --location --silent https://www.libssh2.org/download/libssh2-1.8.2.tar.gz | \
+    curl --insecure --location --silent --show-error https://www.libssh2.org/download/libssh2-1.8.2.tar.gz | \
     tar -xz && \
     cd libssh2-1.8.2 && \
     CFLAGS=-fPIC cmake -G Ninja -DBUILD_SHARED_LIBS=ON -DCRYPTO_BACKEND=Libgcrypt . && \
@@ -52,7 +50,7 @@ RUN cd /tmp && \
 
 FROM libssh2 AS valgrind
 RUN cd /tmp && \
-    curl --location --silent https://sourceware.org/pub/valgrind/valgrind-3.15.0.tar.bz2 | \
+    curl --insecure --location --silent --show-error https://sourceware.org/pub/valgrind/valgrind-3.15.0.tar.bz2 | \
     tar -xj && \
     cd valgrind-3.15.0 && \
     ./configure && \
diff --git a/azure-pipelines/nightly.yml b/azure-pipelines/nightly.yml
index a193747..a75a9cc 100644
--- a/azure-pipelines/nightly.yml
+++ b/azure-pipelines/nightly.yml
@@ -5,7 +5,7 @@ jobs:
 - job: linux_amd64_xenial_gcc_openssl
   displayName: 'Linux (amd64; Xenial; GCC; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -21,7 +21,7 @@ jobs:
 - job: linux_amd64_xenial_gcc_mbedtls
   displayName: 'Linux (amd64; Xenial; GCC; mbedTLS)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -37,7 +37,7 @@ jobs:
 - job: linux_amd64_xenial_clang_openssl
   displayName: 'Linux (amd64; Xenial; Clang; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -53,7 +53,7 @@ jobs:
 - job: linux_amd64_xenial_clang_mbedtls
   displayName: 'Linux (amd64; Xenial; Clang; mbedTLS)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -67,9 +67,9 @@ jobs:
        RUN_INVASIVE_TESTS=true
 
 - job: macos
-  displayName: 'macOS'
+  displayName: 'macOS (amd64; 10.15)'
   pool:
-    vmImage: 'macOS 10.13'
+    vmImage: 'macOS-10.15'
   steps:
   - bash: . '$(Build.SourcesDirectory)/azure-pipelines/setup-osx.sh'
     displayName: Setup
@@ -85,31 +85,34 @@ jobs:
 
 - job: windows_vs_amd64
   displayName: 'Windows (amd64; Visual Studio)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - template: bash.yml
     parameters:
       environmentVariables:
-        CMAKE_GENERATOR: Visual Studio 12 2013 Win64
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON
+        CMAKE_GENERATOR: Visual Studio 15 2017
+        CMAKE_OPTIONS: -A x64 -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON
         RUN_INVASIVE_TESTS: true
         SKIP_SSH_TESTS: true
 
 - job: windows_vs_x86
   displayName: 'Windows (x86; Visual Studio)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - template: bash.yml
     parameters:
       environmentVariables:
-        CMAKE_GENERATOR: Visual Studio 12 2013
-        CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS
+        CMAKE_GENERATOR: Visual Studio 15 2017
+        CMAKE_OPTIONS: -A Win32 -DMSVC_CRTDBG=ON -DDEPRECATE_HARD=ON -DUSE_SHA1=HTTPS
         RUN_INVASIVE_TESTS: true
         SKIP_SSH_TESTS: true
 
 - job: windows_mingw_amd64
   displayName: 'Windows (amd64; MinGW)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - bash: . '$(Build.SourcesDirectory)\azure-pipelines\setup-mingw.sh'
     displayName: Setup
@@ -127,7 +130,8 @@ jobs:
 
 - job: windows_mingw_x86
   displayName: 'Windows (x86; MinGW)'
-  pool: Hosted
+  pool:
+    vmImage: 'vs2017-win2016'
   steps:
   - bash: . '$(Build.SourcesDirectory)\azure-pipelines\setup-mingw.sh'
     displayName: Setup
@@ -147,7 +151,7 @@ jobs:
 - job: linux_x86_bionic_gcc_openssl
   displayName: 'Linux (x86; Bionic; GCC; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -164,7 +168,7 @@ jobs:
 - job: linux_x86_bionic_clang_openssl
   displayName: 'Linux (x86; Bionic; Clang; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -181,7 +185,7 @@ jobs:
 - job: linux_arm32_bionic_gcc_openssl
   displayName: 'Linux (arm32; Bionic; GCC; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
@@ -199,7 +203,7 @@ jobs:
 - job: linux_arm64_bionic_gcc_openssl
   displayName: 'Linux (arm64; Bionic; GCC; OpenSSL)'
   pool:
-    vmImage: 'Ubuntu 16.04'
+    vmImage: 'ubuntu-18.04'
   steps:
   - template: docker.yml
     parameters:
diff --git a/azure-pipelines/test.sh b/azure-pipelines/test.sh
index 96832d6..2b43ba1 100755
--- a/azure-pipelines/test.sh
+++ b/azure-pipelines/test.sh
@@ -85,7 +85,7 @@ if [ -z "$SKIP_GITDAEMON_TESTS" ]; then
 fi
 
 if [ -z "$SKIP_PROXY_TESTS" ]; then
-	curl --location --silent https://github.com/ethomson/poxyproxy/releases/download/v0.7.0/poxyproxy-0.7.0.jar >poxyproxy.jar
+	curl --location --silent --show-error https://github.com/ethomson/poxyproxy/releases/download/v0.7.0/poxyproxy-0.7.0.jar >poxyproxy.jar
 
 	echo ""
 	echo "Starting HTTP proxy (Basic)..."
@@ -97,7 +97,7 @@ if [ -z "$SKIP_PROXY_TESTS" ]; then
 fi
 
 if [ -z "$SKIP_NTLM_TESTS" ]; then
-	curl --location --silent https://github.com/ethomson/poxygit/releases/download/v0.4.0/poxygit-0.4.0.jar >poxygit.jar
+	curl --location --silent --show-error https://github.com/ethomson/poxygit/releases/download/v0.4.0/poxygit-0.4.0.jar >poxygit.jar
 
 	echo ""
 	echo "Starting HTTP server..."
diff --git a/deps/ntlmclient/CMakeLists.txt b/deps/ntlmclient/CMakeLists.txt
index 66e96d6..0a13397 100644
--- a/deps/ntlmclient/CMakeLists.txt
+++ b/deps/ntlmclient/CMakeLists.txt
@@ -7,6 +7,8 @@ DISABLE_WARNINGS(implicit-fallthrough)
 IF (HTTPS_BACKEND STREQUAL "SecureTransport")
 	ADD_DEFINITIONS(-DCRYPT_COMMONCRYPTO)
 	SET(SRC_NTLMCLIENT_CRYPTO "crypt_commoncrypto.c")
+	# CC_MD4 has been deprecated in macOS 10.15.
+	SET_SOURCE_FILES_PROPERTIES("crypt_commoncrypto.c" COMPILE_FLAGS "-Wno-deprecated")
 ELSEIF (HTTPS_BACKEND STREQUAL "OpenSSL")
 	ADD_DEFINITIONS(-DCRYPT_OPENSSL)
 	INCLUDE_DIRECTORIES(${OPENSSL_INCLUDE_DIR})
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 1915e8a..3dfb69c 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -300,6 +300,10 @@ FILE(GLOB SRC_GIT2 *.c *.h
 	streams/*.c streams/*.h
 	transports/*.c transports/*.h
 	xdiff/*.c xdiff/*.h)
+IF(APPLE)
+	# The old Secure Transport API has been deprecated in macOS 10.15.
+	SET_SOURCE_FILES_PROPERTIES(streams/stransport.c PROPERTIES COMPILE_FLAGS -Wno-deprecated)
+ENDIF()
 
 # the xdiff dependency is not (yet) warning-free, disable warnings as
 # errors for the xdiff sources until we've sorted them out