thodg/libgit2

diff --git a/.travis.yml b/.travis.yml
index 569a6a7..a4c8e91 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -17,7 +17,7 @@ env:
   - secure: "YnhS+8n6B+uoyaYfaJ3Lei7cSJqHDPiKJCKFIF2c87YDfmCvAJke8QtE7IzjYDs7UFkTCM4ox+ph2bERUrxZbSCyEkHdjIZpKuMJfYWja/jgMqTMxdyOH9y8JLFbZsSXDIXDwqBlC6vVyl1fP90M35wuWcNTs6tctfVWVofEFbs="
   - GITTEST_INVASIVE_FS_SIZE=1
  matrix:
-  - OPTIONS="-DTHREADSAFE=ON -DCMAKE_BUILD_TYPE=Release -DENABLE_WERROR=ON"
+  - OPTIONS="-DTHREADSAFE=ON -DENABLE_TRACE=ON -DCMAKE_BUILD_TYPE=Release -DENABLE_WERROR=ON"
   - OPTIONS="-DTHREADSAFE=OFF -DBUILD_EXAMPLES=ON -DENABLE_WERROR=ON"
 
 dist: trusty
@@ -26,8 +26,8 @@ sudo: false
 addons:
  apt:
   sources:
-   - sourceline: 'deb http://libgit2deps.edwardthomson.com trusty libgit2deps'
-     key_url: 'https://www.edwardthomson.com/keys/ethomson@libgit2.org'
+   - sourceline: 'deb https://dl.bintray.com/libgit2/ci-dependencies trusty libgit2deps'
+     key_url: 'https://bintray.com/user/downloadSubjectPublicKey?username=bintray'
   packages:
    cmake
    curl
diff --git a/CMakeLists.txt b/CMakeLists.txt
index bedf858..4d5ad9d 100644
--- a/CMakeLists.txt
+++ b/CMakeLists.txt
@@ -42,7 +42,7 @@ OPTION( PROFILE				"Generate profiling information"		OFF )
 OPTION( ENABLE_TRACE		"Enables tracing support"				OFF )
 OPTION( LIBGIT2_FILENAME	"Name of the produced binary"			OFF )
 
-OPTION( USE_SHA1DC			"Use SHA-1 with collision detection"	OFF )
+SET(SHA1_BACKEND "CollisionDetection" CACHE STRING "Backend to use for SHA1. One of Generic, OpenSSL, Win32, CommonCrypto, CollisionDetection. ")
 OPTION( USE_SSH				"Link with libssh to enable SSH support" ON )
 OPTION( USE_HTTPS			"Enable HTTPS support. Can be set to a specific backend"	ON )
 OPTION( USE_GSSAPI			"Link with libgssapi for SPNEGO auth"   OFF )
@@ -222,10 +222,6 @@ IF (MSVC)
 	SET(CMAKE_SHARED_LINKER_FLAGS_RELWITHDEBINFO "${CMAKE_EXE_LINKER_FLAGS_RELWITHDEBINFO}")
 	SET(CMAKE_SHARED_LINKER_FLAGS_MINSIZEREL "${CMAKE_EXE_LINKER_FLAGS_MINSIZEREL}")
 ELSE ()
-	IF (NOT BUILD_SHARED_LIBS)
-		SET(CMAKE_FIND_LIBRARY_SUFFIXES ".a")
-	ENDIF()
-
 	IF (ENABLE_REPRODUCIBLE_BUILDS)
 		SET(CMAKE_C_ARCHIVE_CREATE "<CMAKE_AR> Dqc <TARGET> <LINK_FLAGS> <OBJECTS>")
 		SET(CMAKE_C_ARCHIVE_APPEND "<CMAKE_AR> Dq  <TARGET> <LINK_FLAGS> <OBJECTS>")
@@ -304,6 +300,12 @@ ENDIF()
 ADD_SUBDIRECTORY(src)
 
 # Tests
+IF (NOT MSVC)
+   IF (NOT BUILD_SHARED_LIBS)
+       SET(CMAKE_FIND_LIBRARY_SUFFIXES ".a")
+   ENDIF()
+ENDIF ()
+
 IF (BUILD_CLAR)
 	ENABLE_TESTING()
 	ADD_SUBDIRECTORY(tests)
@@ -333,7 +335,8 @@ IF (BUILD_EXAMPLES)
 ENDIF ()
 
 IF(CMAKE_VERSION VERSION_GREATER 3)
-	FEATURE_SUMMARY(WHAT ENABLED_FEATURES DISABLED_FEATURES)
+	FEATURE_SUMMARY(WHAT ENABLED_FEATURES DESCRIPTION "Enabled features:")
+	FEATURE_SUMMARY(WHAT DISABLED_FEATURES DESCRIPTION "Disabled features:")
 ELSE()
 	PRINT_ENABLED_FEATURES()
 	PRINT_DISABLED_FEATURES()
diff --git a/appveyor.yml b/appveyor.yml
index e0c7b9b..9b14a9c 100644
--- a/appveyor.yml
+++ b/appveyor.yml
@@ -48,13 +48,8 @@ test_script:
     # Run this early so we know it's ready by the time we need it
     $proxyJob = Start-Job { java -jar $Env:APPVEYOR_BUILD_FOLDER\build\poxyproxy.jar -d --port 8080 --credentials foo:bar }
     ctest -V -R libgit2_clar
-    $env:GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
-    $env:GITTEST_REMOTE_USER="libgit2test"
-    ctest -V -R libgit2_clar-cred_callback
     Receive-Job -Job $proxyJob
-    $env:GITTEST_REMOTE_PROXY_URL = "http://foo:bar@localhost:8080"
-    ctest -V -R libgit2_clar-proxy_credentials_in_url
-    $env:GITTEST_REMOTE_PROXY_URL = "http://localhost:8080"
+    $env:GITTEST_REMOTE_PROXY_URL = "localhost:8080"
     $env:GITTEST_REMOTE_PROXY_USER = "foo"
     $env:GITTEST_REMOTE_PROXY_PASS = "bar"
-    ctest -V -R libgit2_clar-proxy_credentials_request
+    ctest -V -R libgit2_clar-proxy_credentials
diff --git a/include/git2/tree.h b/include/git2/tree.h
index 4740b1f..1a363c1 100644
--- a/include/git2/tree.h
+++ b/include/git2/tree.h
@@ -307,9 +307,10 @@ GIT_EXTERN(const git_tree_entry *) git_treebuilder_get(
  * pointer may not be valid past the next operation in this
  * builder. Duplicate the entry if you want to keep it.
  *
- * No attempt is being made to ensure that the provided oid points
- * to an existing git object in the object database, nor that the
- * attributes make sense regarding the type of the pointed at object.
+ * By default the entry that you are inserting will be checked for
+ * validity; that it exists in the object database and is of the
+ * correct type.  If you do not want this behavior, set the
+ * `GIT_OPT_ENABLE_STRICT_OBJECT_CREATION` library option to false.
  *
  * @param out Pointer to store the entry (optional)
  * @param bld Tree builder
diff --git a/script/cibuild.sh b/script/cibuild.sh
index 1c28baa..5d70e75 100755
--- a/script/cibuild.sh
+++ b/script/cibuild.sh
@@ -85,32 +85,18 @@ else
     export GITTEST_REMOTE_SSH_FINGERPRINT=$(ssh-keygen -F '[localhost]:2222' -l | tail -n 1 | cut -d ' ' -f 2 | tr -d ':')
 fi
 
+# Use the SSH server
 export GITTEST_REMOTE_URL="ssh://localhost:2222/$HOME/_temp/test.git"
 export GITTEST_REMOTE_USER=$USER
 export GITTEST_REMOTE_SSH_KEY="$HOME/.ssh/id_rsa"
 export GITTEST_REMOTE_SSH_PUBKEY="$HOME/.ssh/id_rsa.pub"
 export GITTEST_REMOTE_SSH_PASSPHRASE=""
+ctest -V -R libgit2_clar-ssh || exit $?
 
-
-if [ -e ./libgit2_clar ]; then
-    ./libgit2_clar -sonline::push -sonline::clone::ssh_cert &&
-    ./libgit2_clar -sonline::clone::ssh_with_paths || exit $?
-    if [ "$TRAVIS_OS_NAME" = "linux" ]; then
-        ./libgit2_clar -sonline::clone::cred_callback || exit $?
-    fi
-
-    # Use the proxy we started at the beginning
-    export GITTEST_REMOTE_PROXY_URL="http://foo:bar@localhost:8080/"
-    ./libgit2_clar -sonline::clone::proxy_credentials_in_url || exit $?
-    export GITTEST_REMOTE_PROXY_URL="http://localhost:8080/"
-    export GITTEST_REMOTE_PROXY_USER="foo"
-    export GITTEST_REMOTE_PROXY_PASS="bar"
-    ./libgit2_clar -sonline::clone::proxy_credentials_request || exit $?
-
-fi
+# Use the proxy we started at the beginning
+export GITTEST_REMOTE_PROXY_URL="localhost:8080"
+export GITTEST_REMOTE_PROXY_USER="foo"
+export GITTEST_REMOTE_PROXY_PASS="bar"
+ctest -V -R libgit2_clar-proxy_credentials || exit $?
 
 kill $(cat "$HOME/sshd/pid")
-
-export GITTEST_REMOTE_URL="https://github.com/libgit2/non-existent"
-export GITTEST_REMOTE_USER="libgit2test"
-ctest -V -R libgit2_clar-cred_callback
diff --git a/src/CMakeLists.txt b/src/CMakeLists.txt
index 2c82d1f..b03b96a 100644
--- a/src/CMakeLists.txt
+++ b/src/CMakeLists.txt
@@ -3,11 +3,6 @@ IF(DEBUG_POOL)
 ENDIF()
 ADD_FEATURE_INFO(debugpool GIT_DEBUG_POOL "debug pool allocator")
 
-# Add the features.h file as a dummy. This is required for Xcode
-# to successfully build the libgit2 library when using only
-# object libraries.
-SET(LIBGIT2_OBJECTS "${CMAKE_CURRENT_BINARY_DIR}/git2/sys/features.h")
-
 # This variable will contain the libraries we need to put into
 # libgit2.pc's Requires.private. That is, what we're linking to or
 # what someone who's statically linking us needs to link to.
@@ -127,10 +122,6 @@ ELSE ()
 		PKG_CHECK_MODULES(CURL libcurl)
 	ENDIF ()
 
-	IF (NOT AMIGA AND (USE_HTTPS STREQUAL "OpenSSL" OR USE_HTTPS STREQUAL "ON"))
-		FIND_PACKAGE(OpenSSL QUIET)
-	ENDIF ()
-
 	IF (CURL_FOUND)
 		SET(GIT_CURL 1)
 		LIST(APPEND LIBGIT2_INCLUDES ${CURL_INCLUDE_DIRS})
@@ -183,6 +174,8 @@ IF (USE_HTTPS)
 		LIST(APPEND LIBGIT2_LIBS ${COREFOUNDATION_LIBRARIES} ${SECURITY_LIBRARIES})
 		LIST(APPEND LIBGIT2_PC_LIBS ${COREFOUNDATION_LDFLAGS} ${SECURITY_LDFLAGS})
 	ELSEIF (HTTPS_BACKEND STREQUAL "OpenSSL")
+		FIND_PACKAGE(OpenSSL)
+
 		IF (NOT OPENSSL_FOUND)
 			MESSAGE(FATAL_ERROR "Asked for OpenSSL TLS backend, but it wasn't found")
 		ENDIF()
@@ -191,6 +184,7 @@ IF (USE_HTTPS)
 		LIST(APPEND LIBGIT2_INCLUDES ${OPENSSL_INCLUDE_DIR})
 		LIST(APPEND LIBGIT2_LIBS ${OPENSSL_LIBRARIES})
 		LIST(APPEND LIBGIT2_PC_LIBS ${OPENSSL_LDFLAGS})
+		LIST(APPEND LIBGIT2_PC_REQUIRES "openssl")
 	ELSEIF (HTTPS_BACKEND STREQUAL "WinHTTP")
 		# WinHTTP setup was handled in the WinHTTP-specific block above
 	ELSE()
@@ -204,34 +198,42 @@ ELSE()
 ENDIF()
 
 # Specify sha1 implementation
-IF (USE_SHA1DC)
-	ADD_FEATURE_INFO(SHA ON "using SHA1DC")
+IF(SHA1_BACKEND STREQUAL "OpenSSL")
+	IF(NOT OPENSSL_FOUND)
+		FIND_PACKAGE(OpenSSL)
+		IF(NOT OPENSSL_FOUND)
+		    MESSAGE(FATAL_ERROR "Requested OpenSSL SHA1 backend, but OpenSSL could not be found")
+		ENDIF()
+	ENDIF()
+
+	ADD_FEATURE_INFO(SHA ON "using OpenSSL")
+	SET(GIT_SHA1_OPENSSL 1)
+	IF(CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
+		LIST(APPEND LIBGIT2_PC_LIBS "-lssl")
+	ELSE()
+		LIST(APPEND LIBGIT2_PC_REQUIRES "openssl")
+	ENDIF()
+ELSEIF(SHA1_BACKEND STREQUAL "CollisionDetection")
+	ADD_FEATURE_INFO(SHA ON "using CollisionDetection")
 	SET(GIT_SHA1_COLLISIONDETECT 1)
 	ADD_DEFINITIONS(-DSHA1DC_NO_STANDARD_INCLUDES=1)
 	ADD_DEFINITIONS(-DSHA1DC_CUSTOM_INCLUDE_SHA1_C=\"common.h\")
 	ADD_DEFINITIONS(-DSHA1DC_CUSTOM_INCLUDE_UBC_CHECK_C=\"common.h\")
 	FILE(GLOB SRC_SHA1 hash/hash_collisiondetect.c hash/sha1dc/*)
-ELSEIF (WIN32 AND NOT MINGW)
-	ADD_FEATURE_INFO(SHA ON "using SHA1_WIN32")
+ELSEIF(SHA1_BACKEND STREQUAL "Generic")
+	ADD_FEATURE_INFO(SHA ON "using Generic")
+	FILE(GLOB SRC_SHA1 hash/hash_generic.c)
+ELSEIF(SHA1_BACKEND STREQUAL "Win32")
+	ADD_FEATURE_INFO(SHA ON "using Win32")
 	SET(GIT_SHA1_WIN32 1)
 	FILE(GLOB SRC_SHA1 hash/hash_win32.c)
-ELSEIF (${CMAKE_SYSTEM_NAME} MATCHES "Darwin")
+ELSEIF(SHA1_BACKEND STREQUAL "CommonCrypto")
 	ADD_FEATURE_INFO(SHA ON "using CommonCrypto")
 	SET(GIT_SHA1_COMMON_CRYPTO 1)
-ELSEIF (OPENSSL_FOUND)
-	ADD_FEATURE_INFO(SHA ON "using OpenSSL")
-	SET(GIT_SHA1_OPENSSL 1)
-	IF (CMAKE_SYSTEM_NAME MATCHES "FreeBSD")
-		LIST(APPEND LIBGIT2_PC_LIBS "-lssl")
-	ELSE()
-		SET(LIBGIT2_PC_REQUIRES "${LIBGIT2_PC_REQUIRES} openssl")
-	ENDIF ()
 ELSE()
-	ADD_FEATURE_INFO(SHA ON "using generic")
-	FILE(GLOB SRC_SHA1 hash/hash_generic.c)
+	MESSAGE(FATAL_ERROR "Asked for unknown SHA1 backend ${SHA1_BACKEND}")
 ENDIF()
 
-
 # Include POSIX regex when it is required
 IF(WIN32 OR AMIGA OR CMAKE_SYSTEM_NAME MATCHES "(Solaris|SunOS)")
 	ADD_SUBDIRECTORY("${libgit2_SOURCE_DIR}/deps/regex" "${libgit2_BINARY_DIR}/deps/regex")
@@ -264,7 +266,7 @@ IF(NOT USE_BUNDLED_ZLIB)
 			LIST(APPEND LIBGIT2_LIBS "z")
 			LIST(APPEND LIBGIT2_PC_LIBS "-lz")
 		ELSE()
-			SET(LIBGIT2_PC_REQUIRES "${LIBGIT2_PC_REQUIRES} zlib")
+			LIST(APPEND LIBGIT2_PC_REQUIRES "zlib")
 		ENDIF()
 		ADD_FEATURE_INFO(zlib ON "using system zlib")
 	ELSE()
@@ -404,6 +406,13 @@ SET(LIBGIT2_INCLUDES ${LIBGIT2_INCLUDES} PARENT_SCOPE)
 SET(LIBGIT2_LIBS ${LIBGIT2_LIBS} PARENT_SCOPE)
 SET(LIBGIT2_LIBDIRS ${LIBGIT2_LIBDIRS} PARENT_SCOPE)
 
+IF(XCODE_VERSION)
+	# This is required for Xcode to actually link the libgit2 library
+	# when using only object libraries.
+	FILE(WRITE ${CMAKE_CURRENT_BINARY_DIR}/dummy.c "")
+	LIST(APPEND LIBGIT2_OBJECTS ${CMAKE_CURRENT_BINARY_DIR}/dummy.c)
+ENDIF()
+
 # Compile and link libgit2
 LINK_DIRECTORIES(${LIBGIT2_LIBDIRS})
 ADD_LIBRARY(git2 ${WIN_RC} ${LIBGIT2_OBJECTS})
@@ -431,6 +440,9 @@ IF (SONAME)
 		SET_TARGET_PROPERTIES(git2 PROPERTIES PREFIX "${LIBGIT2_PREFIX}")
 	ENDIF()
 ENDIF()
+
+LIST(REMOVE_DUPLICATES LIBGIT2_PC_REQUIRES)
+STRING(REPLACE ";" " " LIBGIT2_PC_REQUIRES "${LIBGIT2_PC_REQUIRES}")
 STRING(REPLACE ";" " " LIBGIT2_PC_LIBS "${LIBGIT2_PC_LIBS}")
 CONFIGURE_FILE(${libgit2_SOURCE_DIR}/libgit2.pc.in ${libgit2_BINARY_DIR}/libgit2.pc @ONLY)
 
diff --git a/src/diff.h b/src/diff.h
index 4e5dd93..8c04438 100644
--- a/src/diff.h
+++ b/src/diff.h
@@ -34,6 +34,7 @@ typedef enum {
 struct git_diff {
 	git_refcount     rc;
 	git_repository   *repo;
+	git_attr_session attrsession;
 	git_diff_origin_t type;
 	git_diff_options opts;
 	git_vector       deltas;    /* vector of git_diff_delta */
diff --git a/src/diff_driver.c b/src/diff_driver.c
index 8cd57cd..7114b06 100644
--- a/src/diff_driver.c
+++ b/src/diff_driver.c
@@ -354,27 +354,30 @@ done:
 }
 
 int git_diff_driver_lookup(
-	git_diff_driver **out, git_repository *repo, const char *path)
+	git_diff_driver **out, git_repository *repo,
+	git_attr_session *attrsession, const char *path)
 {
 	int error = 0;
-	const char *value;
+	const char *values[1], *attrs[] = { "diff" };
 
 	assert(out);
 	*out = NULL;
 
 	if (!repo || !path || !strlen(path))
 		/* just use the auto value */;
-	else if ((error = git_attr_get(&value, repo, 0, path, "diff")) < 0)
+	else if ((error = git_attr_get_many_with_session(values, repo,
+			attrsession, 0, path, 1, attrs)) < 0)
 		/* return error below */;
-	else if (GIT_ATTR_UNSPECIFIED(value))
+
+	else if (GIT_ATTR_UNSPECIFIED(values[0]))
 		/* just use the auto value */;
-	else if (GIT_ATTR_FALSE(value))
+	else if (GIT_ATTR_FALSE(values[0]))
 		*out = &global_drivers[DIFF_DRIVER_BINARY];
-	else if (GIT_ATTR_TRUE(value))
+	else if (GIT_ATTR_TRUE(values[0]))
 		*out = &global_drivers[DIFF_DRIVER_TEXT];
 
 	/* otherwise look for driver information in config and build driver */
-	else if ((error = git_diff_driver_load(out, repo, value)) < 0) {
+	else if ((error = git_diff_driver_load(out, repo, values[0])) < 0) {
 		if (error == GIT_ENOTFOUND) {
 			error = 0;
 			giterr_clear();
diff --git a/src/diff_driver.h b/src/diff_driver.h
index 5691cac..a03a67e 100644
--- a/src/diff_driver.h
+++ b/src/diff_driver.h
@@ -9,6 +9,7 @@
 
 #include "common.h"
 
+#include "attr_file.h"
 #include "buffer.h"
 
 typedef struct git_diff_driver_registry git_diff_driver_registry;
@@ -18,7 +19,8 @@ void git_diff_driver_registry_free(git_diff_driver_registry *);
 
 typedef struct git_diff_driver git_diff_driver;
 
-int git_diff_driver_lookup(git_diff_driver **, git_repository *, const char *);
+int git_diff_driver_lookup(git_diff_driver **, git_repository *,
+	git_attr_session *attrsession, const char *);
 void git_diff_driver_free(git_diff_driver *);
 
 /* diff option flags to force off and on for this driver */
diff --git a/src/diff_file.c b/src/diff_file.c
index 0813315..5bb9c37 100644
--- a/src/diff_file.c
+++ b/src/diff_file.c
@@ -54,7 +54,8 @@ static int diff_file_content_init_common(
 		fc->src = GIT_ITERATOR_TYPE_TREE;
 
 	if (!fc->driver &&
-		git_diff_driver_lookup(&fc->driver, fc->repo, fc->file->path) < 0)
+		git_diff_driver_lookup(&fc->driver, fc->repo,
+		    NULL, fc->file->path) < 0)
 		return -1;
 
 	/* give driver a chance to modify options */
@@ -101,7 +102,8 @@ int git_diff_file_content__init_from_diff(
 	fc->file = use_old ? &delta->old_file : &delta->new_file;
 	fc->src  = use_old ? diff->old_src : diff->new_src;
 
-	if (git_diff_driver_lookup(&fc->driver, fc->repo, fc->file->path) < 0)
+	if (git_diff_driver_lookup(&fc->driver, fc->repo,
+		    &diff->attrsession, fc->file->path) < 0)
 		return -1;
 
 	switch (delta->status) {
diff --git a/src/diff_generate.c b/src/diff_generate.c
index bce2a68..e11cbe4 100644
--- a/src/diff_generate.c
+++ b/src/diff_generate.c
@@ -389,6 +389,7 @@ static void diff_generated_free(git_diff *d)
 {
 	git_diff_generated *diff = (git_diff_generated *)d;
 
+	git_attr_session__free(&diff->base.attrsession);
 	git_vector_free_deep(&diff->base.deltas);
 
 	git_pathspec__vfree(&diff->pathspec);
@@ -418,6 +419,7 @@ static git_diff_generated *diff_generated_alloc(
 	diff->base.new_src = new_iter->type;
 	diff->base.patch_fn = git_patch_generated_from_diff;
 	diff->base.free_fn = diff_generated_free;
+	git_attr_session__init(&diff->base.attrsession, repo);
 	memcpy(&diff->base.opts, &dflt, sizeof(git_diff_options));
 
 	git_pool_init(&diff->base.pool, 1);
diff --git a/src/hash/hash_openssl.h b/src/hash/hash_openssl.h
index 9a55d47..048c2bd 100644
--- a/src/hash/hash_openssl.h
+++ b/src/hash/hash_openssl.h
@@ -23,21 +23,36 @@ struct git_hash_ctx {
 GIT_INLINE(int) git_hash_init(git_hash_ctx *ctx)
 {
 	assert(ctx);
-	SHA1_Init(&ctx->c);
+
+	if (SHA1_Init(&ctx->c) != 1) {
+		giterr_set(GITERR_SHA1, "hash_openssl: failed to initialize hash context");
+		return -1;
+	}
+
 	return 0;
 }
 
 GIT_INLINE(int) git_hash_update(git_hash_ctx *ctx, const void *data, size_t len)
 {
 	assert(ctx);
-	SHA1_Update(&ctx->c, data, len);
+
+	if (SHA1_Update(&ctx->c, data, len) != 1) {
+		giterr_set(GITERR_SHA1, "hash_openssl: failed to update hash");
+		return -1;
+	}
+
 	return 0;
 }
 
 GIT_INLINE(int) git_hash_final(git_oid *out, git_hash_ctx *ctx)
 {
 	assert(ctx);
-	SHA1_Final(out->id, &ctx->c);
+
+	if (SHA1_Final(out->id, &ctx->c) != 1) {
+		giterr_set(GITERR_SHA1, "hash_openssl: failed to finalize hash");
+		return -1;
+	}
+
 	return 0;
 }
 
diff --git a/src/streams/openssl.c b/src/streams/openssl.c
index 9d56607..d00e98e 100644
--- a/src/streams/openssl.c
+++ b/src/streams/openssl.c
@@ -282,8 +282,9 @@ static int ssl_set_error(SSL *ssl, int error)
 	case SSL_ERROR_SYSCALL:
 		e = ERR_get_error();
 		if (e > 0) {
-			giterr_set(GITERR_NET, "SSL error: %s",
-					ERR_error_string(e, NULL));
+			char errmsg[256];
+			ERR_error_string_n(e, errmsg, sizeof(errmsg));
+			giterr_set(GITERR_NET, "SSL error: %s", errmsg);
 			break;
 		} else if (error < 0) {
 			giterr_set(GITERR_OS, "SSL error: syscall failure");
@@ -293,10 +294,13 @@ static int ssl_set_error(SSL *ssl, int error)
 		return GIT_EEOF;
 		break;
 	case SSL_ERROR_SSL:
+	{
+		char errmsg[256];
 		e = ERR_get_error();
-		giterr_set(GITERR_NET, "SSL error: %s",
-				ERR_error_string(e, NULL));
+		ERR_error_string_n(e, errmsg, sizeof(errmsg));
+		giterr_set(GITERR_NET, "SSL error: %s", errmsg);
 		break;
+	}
 	case SSL_ERROR_NONE:
 	case SSL_ERROR_ZERO_RETURN:
 	default:
@@ -645,8 +649,12 @@ out_err:
 int git_openssl__set_cert_location(const char *file, const char *path)
 {
 	if (SSL_CTX_load_verify_locations(git__ssl_ctx, file, path) == 0) {
+		char errmsg[256];
+
+		ERR_error_string_n(ERR_get_error(), errmsg, sizeof(errmsg));
 		giterr_set(GITERR_SSL, "OpenSSL error: failed to load certificates: %s",
-				   ERR_error_string(ERR_get_error(), NULL));
+			errmsg);
+
 		return -1;
 	}
 	return 0;
diff --git a/src/tree.c b/src/tree.c
index fcee7f3..75fde2c 100644
--- a/src/tree.c
+++ b/src/tree.c
@@ -440,16 +440,16 @@ int git_tree__parse(void *_tree, git_odb_object *odb_obj)
 		unsigned int attr;
 
 		if (parse_mode(&attr, buffer, &buffer) < 0 || !buffer)
-			return tree_error("Failed to parse tree. Can't parse filemode", NULL);
+			return tree_error("failed to parse tree: can't parse filemode", NULL);
 
 		if ((nul = memchr(buffer, 0, buffer_end - buffer)) == NULL)
-			return tree_error("Failed to parse tree. Object is corrupted", NULL);
+			return tree_error("failed to parse tree: object is corrupted", NULL);
 
 		if ((filename_len = nul - buffer) == 0)
-			return tree_error("Failed to parse tree. Can't parse filename", NULL);
+			return tree_error("failed to parse tree: can't parse filename", NULL);
 
 		if ((buffer_end - (nul + 1)) < GIT_OID_RAWSZ)
-			return tree_error("Failed to parse tree. Can't parse OID", NULL);
+			return tree_error("failed to parse tree: can't parse OID", NULL);
 
 		/* Allocate the entry */
 		{
@@ -496,7 +496,7 @@ static int append_entry(
 	int error = 0;
 
 	if (!valid_entry_name(bld->repo, filename))
-		return tree_error("Failed to insert entry. Invalid name for a tree entry", filename);
+		return tree_error("failed to insert entry: invalid name for a tree entry", filename);
 
 	entry = alloc_entry(filename, strlen(filename), id);
 	GITERR_CHECK_ALLOC(entry);
@@ -735,14 +735,14 @@ int git_treebuilder_insert(
 	assert(bld && id && filename);
 
 	if (!valid_filemode(filemode))
-		return tree_error("Failed to insert entry. Invalid filemode for file", filename);
+		return tree_error("failed to insert entry: invalid filemode for file", filename);
 
 	if (!valid_entry_name(bld->repo, filename))
-		return tree_error("Failed to insert entry. Invalid name for a tree entry", filename);
+		return tree_error("failed to insert entry: invalid name for a tree entry", filename);
 
 	if (filemode != GIT_FILEMODE_COMMIT &&
 	    !git_object__is_valid(bld->repo, id, otype_from_mode(filemode)))
-		return tree_error("Failed to insert entry; invalid object specified", filename);
+		return tree_error("failed to insert entry: invalid object specified", filename);
 
 	pos = git_strmap_lookup_index(bld->map, filename);
 	if (git_strmap_valid_index(bld->map, pos)) {
@@ -793,7 +793,7 @@ int git_treebuilder_remove(git_treebuilder *bld, const char *filename)
 	git_tree_entry *entry = treebuilder_get(bld, filename);
 
 	if (entry == NULL)
-		return tree_error("Failed to remove entry. File isn't in the tree", filename);
+		return tree_error("failed to remove entry: file isn't in the tree", filename);
 
 	git_strmap_delete(bld->map, filename);
 	git_tree_entry_free(entry);
@@ -946,7 +946,7 @@ int git_tree_entry_bypath(
 			return GIT_ENOTFOUND;
 		}
 
-		/* If there's only a slash left in the path, we 
+		/* If there's only a slash left in the path, we
 		 * return the current entry; otherwise, we keep
 		 * walking down the path */
 		if (path[filename_len + 1] != '\0')
diff --git a/tests/CMakeLists.txt b/tests/CMakeLists.txt
index 08ecb39..775f33f 100644
--- a/tests/CMakeLists.txt
+++ b/tests/CMakeLists.txt
@@ -20,7 +20,7 @@ ENDIF()
 
 ADD_CUSTOM_COMMAND(
 	OUTPUT ${CMAKE_CURRENT_BINARY_DIR}/clar.suite
-	COMMAND ${PYTHON_EXECUTABLE} generate.py -o "${CMAKE_CURRENT_BINARY_DIR}" -f -xonline -xstress .
+	COMMAND ${PYTHON_EXECUTABLE} generate.py -o "${CMAKE_CURRENT_BINARY_DIR}" -f -xonline -xstress -xperf .
 	DEPENDS ${SRC_TEST}
 	WORKING_DIRECTORY ${CLAR_PATH}
 )
@@ -58,8 +58,6 @@ ELSE ()
 	ADD_TEST(libgit2_clar "${libgit2_BINARY_DIR}/libgit2_clar" -v -xclone::local::git_style_unc_paths -xclone::local::standard_unc_paths_are_written_git_style)
 ENDIF ()
 
-# Add a test target which runs the cred callback tests, to be
-# called after setting the url and user
-ADD_TEST(libgit2_clar-cred_callback "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::clone::cred_callback)
-ADD_TEST(libgit2_clar-proxy_credentials_in_url "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::clone::proxy_credentials_in_url)
-ADD_TEST(libgit2_clar-proxy_credentials_request "${libgit2_BINARY_DIR}/libgit2_clar" -v	-sonline::clone::proxy_credentials_request)
+# Add additional test targets that require special setup
+ADD_TEST(libgit2_clar-proxy_credentials "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::clone::proxy_credentials_in_url -sonline::clone::proxy_credentials_request)
+ADD_TEST(libgit2_clar-ssh "${libgit2_BINARY_DIR}/libgit2_clar" -v -sonline::push -sonline::clone::ssh_cert -sonline::clone::ssh_with_paths)
diff --git a/tests/checkout/tree.c b/tests/checkout/tree.c
index 56513ea..a7e29b3 100644
--- a/tests/checkout/tree.c
+++ b/tests/checkout/tree.c
@@ -1096,6 +1096,8 @@ void test_checkout_tree__filemode_preserved_in_workdir(void)
 	cl_assert(!GIT_PERMS_IS_EXEC(read_filemode("a/b.txt")));
 
 	git_commit_free(commit);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/iterator/iterator_helpers.c b/tests/iterator/iterator_helpers.c
index ae48fcd..68d5741 100644
--- a/tests/iterator/iterator_helpers.c
+++ b/tests/iterator/iterator_helpers.c
@@ -51,8 +51,7 @@ void expect_iterator_items(
 				cl_assert(entry->mode != GIT_FILEMODE_TREE);
 		}
 
-		if (++count >= expected_flat)
-			break;
+		cl_assert(++count <= expected_flat);
 	}
 
 	assert_at_end(i, v);
diff --git a/tests/iterator/workdir.c b/tests/iterator/workdir.c
index f33fd98..198edc7 100644
--- a/tests/iterator/workdir.c
+++ b/tests/iterator/workdir.c
@@ -662,7 +662,7 @@ void test_iterator_workdir__filesystem_gunk(void)
 	/* should only have 13 items, since we're not asking for trees to be
 	 * returned.  the goal of this test is simply to not crash.
 	 */
-	expect_iterator_items(i, 13, NULL, 13, NULL);
+	expect_iterator_items(i, 15, NULL, 15, NULL);
 	git_iterator_free(i);
 	git_buf_free(&parent);
 }
@@ -741,6 +741,8 @@ void test_iterator_workdir__skips_fifos_and_special_files(void)
 	cl_assert_equal_i(GIT_ITEROVER, git_iterator_advance(&e, i));
 
 	git_iterator_free(i);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/online/clone.c b/tests/online/clone.c
index 5eda73f..b9230ec 100644
--- a/tests/online/clone.c
+++ b/tests/online/clone.c
@@ -263,8 +263,8 @@ static int cred_failure_cb(
 
 void test_online_clone__cred_callback_failure_return_code_is_tunnelled(void)
 {
-	if (!_remote_url || !_remote_user)
-		clar__skip();
+	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
+	_remote_user = git__strdup("libgit2test");
 
 	g_options.fetch_opts.callbacks.credentials = cred_failure_cb;
 
@@ -293,8 +293,8 @@ void test_online_clone__cred_callback_called_again_on_auth_failure(void)
 {
 	size_t counter = 0;
 
-	if (!_remote_url || !_remote_user)
-		clar__skip();
+	_remote_url = git__strdup("https://github.com/libgit2/non-existent");
+	_remote_user = git__strdup("libgit2test");
 
 	g_options.fetch_opts.callbacks.credentials = cred_count_calls_cb;
 	g_options.fetch_opts.callbacks.payload = &counter;
@@ -677,24 +677,34 @@ static int proxy_creds(git_cred **out, const char *url, const char *username, un
 
 void test_online_clone__proxy_credentials_request(void)
 {
+	git_buf url = GIT_BUF_INIT;
+
 	if (!_remote_proxy_url || !_remote_proxy_user || !_remote_proxy_pass)
 		cl_skip();
 
+	cl_git_pass(git_buf_printf(&url, "http://%s/", _remote_proxy_url));
+
 	g_options.fetch_opts.proxy_opts.type = GIT_PROXY_SPECIFIED;
-	g_options.fetch_opts.proxy_opts.url = _remote_proxy_url;
+	g_options.fetch_opts.proxy_opts.url = url.ptr;
 	g_options.fetch_opts.proxy_opts.credentials = proxy_creds;
 	called_proxy_creds = 0;
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 	cl_assert(called_proxy_creds);
+
+	git_buf_free(&url);
 }
 
 void test_online_clone__proxy_credentials_in_url(void)
 {
-	if (!_remote_proxy_url)
+	git_buf url = GIT_BUF_INIT;
+
+	if (!_remote_proxy_url || !_remote_proxy_user || !_remote_proxy_pass)
 		cl_skip();
 
+	cl_git_pass(git_buf_printf(&url, "http://%s:%s@%s/", _remote_proxy_user, _remote_proxy_pass, _remote_proxy_url));
+
 	g_options.fetch_opts.proxy_opts.type = GIT_PROXY_SPECIFIED;
-	g_options.fetch_opts.proxy_opts.url = _remote_proxy_url;
+	g_options.fetch_opts.proxy_opts.url = url.ptr;
 	called_proxy_creds = 0;
 	cl_git_pass(git_clone(&g_repo, "http://github.com/libgit2/TestGitRepository", "./foo", &g_options));
 	cl_assert(called_proxy_creds == 0);
diff --git a/tests/perf/merge.c b/tests/perf/merge.c
index b2ef082..721902d 100644
--- a/tests/perf/merge.c
+++ b/tests/perf/merge.c
@@ -25,20 +25,7 @@
 #define ID_BRANCH_A "d853fb9f24e0fe63b3dce9fbc04fd9cfe17a030b"
 #define ID_BRANCH_B "1ce9ea3ba9b4fa666602d52a5281d41a482cc58b"
 
-
-void test_perf_merge__initialize(void)
-{
-}
-
-void test_perf_merge__cleanup(void)
-{
-}
-
 void test_perf_merge__m1(void)
 {
-#if 1
-	cl_skip();
-#else
 	perf__do_merge(SRC_REPO, "m1", ID_BRANCH_A, ID_BRANCH_B);
-#endif
 }
diff --git a/tests/repo/open.c b/tests/repo/open.c
index 3239b6f..ab36dd5 100644
--- a/tests/repo/open.c
+++ b/tests/repo/open.c
@@ -180,6 +180,8 @@ void test_repo_open__from_git_new_workdir(void)
 	cl_assert_(git__suffixcmp(git_repository_workdir(repo2), "alternate/") == 0, git_repository_workdir(repo2));
 
 	git_repository_free(repo2);
+#else
+	cl_skip();
 #endif
 }
 
diff --git a/tests/status/worktree.c b/tests/status/worktree.c
index 44ed324..c6b18c1 100644
--- a/tests/status/worktree.c
+++ b/tests/status/worktree.c
@@ -1072,6 +1072,8 @@ void test_status_worktree__unreadable(void)
 	cl_assert_equal_i(counts.expected_entry_count, counts.entry_count);
 	cl_assert_equal_i(0, counts.wrong_status_flags_count);
 	cl_assert_equal_i(0, counts.wrong_sorted_path);
+#else
+	cl_skip();
 #endif
 }
 
@@ -1106,6 +1108,8 @@ void test_status_worktree__unreadable_not_included(void)
 	cl_assert_equal_i(counts.expected_entry_count, counts.entry_count);
 	cl_assert_equal_i(0, counts.wrong_status_flags_count);
 	cl_assert_equal_i(0, counts.wrong_sorted_path);
+#else
+	cl_skip();
 #endif
 }