thodg/libgit2

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index db64c7d..85eb1bc 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -6,53 +6,53 @@ trigger:
 - maint/*
 
 jobs:
-- job: linux_trusty_gcc_openssl
-  displayName: 'Linux (Trusty; GCC; OpenSSL)'
+- job: linux_amd64_trusty_gcc_openssl
+  displayName: 'Linux (amd64; Trusty; GCC; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - template: ci/docker.yml
+  - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-openssl:latest'
+      imageName: 'libgit2/trusty-amd64:latest'
       environmentVariables: |
        CC=gcc
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
        LEAK_CHECK=valgrind
 
-- job: linux_trusty_gcc_mbedtls
-  displayName: 'Linux (Trusty; GCC; mbedTLS)'
+- job: linux_amd64_trusty_gcc_mbedtls
+  displayName: 'Linux (amd64; Trusty; GCC; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - template: ci/docker.yml
+  - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-mbedtls:latest'
+      imageName: 'libgit2/trusty-amd64:latest'
       environmentVariables: |
        CC=gcc
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS
        LEAK_CHECK=valgrind
 
-- job: linux_trusty_clang_openssl
-  displayName: 'Linux (Trusty; Clang; OpenSSL)'
+- job: linux_amd64_trusty_clang_openssl
+  displayName: 'Linux (amd64; Trusty; Clang; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - template: ci/docker.yml
+  - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-openssl:latest'
+      imageName: 'libgit2/trusty-amd64:latest'
       environmentVariables: |
        CC=clang
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
        LEAK_CHECK=valgrind
 
-- job: linux_trusty_clang_mbedtls
-  displayName: 'Linux (Trusty; Clang; mbedTLS)'
+- job: linux_amd64_trusty_clang_mbedtls
+  displayName: 'Linux (amd64; Trusty; Clang; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
-  - template: ci/docker.yml
+  - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-mbedtls:latest'
+      imageName: 'libgit2/trusty-amd64:latest'
       environmentVariables: |
        CC=clang
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DSHA1_BACKEND=mbedTLS
@@ -65,7 +65,7 @@ jobs:
   steps:
   - bash: . '$(Build.SourcesDirectory)/ci/setup-osx.sh'
     displayName: Setup
-  - template: ci/bash.yml
+  - template: azure-pipelines/bash.yml
     parameters:
       environmentVariables:
         TMPDIR: $(Agent.TempDirectory)
@@ -74,25 +74,25 @@ jobs:
         CMAKE_OPTIONS: -G Ninja
 
 - job: windows_vs_amd64
-  displayName: 'Windows (Visual Studio; amd64)'
+  displayName: 'Windows (amd64; Visual Studio)'
   pool: Hosted
   steps:
-  - template: ci/powershell.yml
+  - template: azure-pipelines/powershell.yml
     parameters:
       environmentVariables:
         CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013 Win64"
 
 - job: windows_vs_x86
-  displayName: 'Windows (Visual Studio; x86)'
+  displayName: 'Windows (x86; Visual Studio)'
   pool: Hosted
   steps:
-  - template: ci/powershell.yml
+  - template: azure-pipelines/powershell.yml
     parameters:
       environmentVariables:
         CMAKE_OPTIONS: -DMSVC_CRTDBG=ON -G"Visual Studio 12 2013"
 
 - job: windows_mingw_amd64
-  displayName: 'Windows (MinGW; amd64)'
+  displayName: 'Windows (amd64; MinGW)'
   pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
@@ -100,14 +100,14 @@ jobs:
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: amd64
-  - template: ci/powershell.yml
+  - template: azure-pipelines/powershell.yml
     parameters:
       environmentVariables:
         CMAKE_OPTIONS: -G"MinGW Makefiles"
         PATH: $(Agent.TempDirectory)\mingw64\bin;C:\ProgramData\Oracle\Java\javapath;C:\Windows\system32;C:\Windows;C:\Windows\System32\Wbem;C:\Windows\System32\WindowsPowerShell\v1.0\;C:\Program Files (x86)\CMake\bin
 
 - job: windows_mingw_x86
-  displayName: 'Windows (MinGW; x86)'
+  displayName: 'Windows (x86; MinGW)'
   pool: Hosted
   steps:
   - powershell: . '$(Build.SourcesDirectory)\ci\setup-mingw.ps1'
@@ -116,7 +116,7 @@ jobs:
     env:
       TEMP: $(Agent.TempDirectory)
       ARCH: x86
-  - template: ci/powershell.yml
+  - template: azure-pipelines/powershell.yml
     parameters:
       environmentVariables:
         CMAKE_OPTIONS: -G"MinGW Makefiles"
diff --git a/azure-pipelines/bash.yml b/azure-pipelines/bash.yml
new file mode 100644
index 0000000..d776a36
--- /dev/null
+++ b/azure-pipelines/bash.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with bash.
+steps:
+- bash: . '$(Build.SourcesDirectory)/ci/build.sh'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- bash: . '$(Build.SourcesDirectory)/ci/test.sh'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/azure-pipelines/docker.yml b/azure-pipelines/docker.yml
new file mode 100644
index 0000000..2744a63
--- /dev/null
+++ b/azure-pipelines/docker.yml
@@ -0,0 +1,37 @@
+# These are the steps used in a container-based build in VSTS.
+steps:
+- ${{ if eq(parameters.qemu, 'true') }}:
+  - script: docker run --rm --privileged multiarch/qemu-user-static:register --reset
+    displayName: 'Register Docker QEMU'
+
+- task: docker@0
+  displayName: Build
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/build.sh'
+    detached: false
+- task: docker@0
+  displayName: Test
+  inputs:
+    action: 'Run an image'
+    imageName: ${{ parameters.imageName }}
+    volumes: |
+     $(Build.SourcesDirectory):/src
+     $(Build.BinariesDirectory):/build
+    envVars: ${{ parameters.environmentVariables }}
+    workDir: '/build'
+    containerCommand: '/src/ci/test.sh'
+    detached: false
+- task: publishtestresults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/azure-pipelines/nightly.yml b/azure-pipelines/nightly.yml
new file mode 100644
index 0000000..2175458
--- /dev/null
+++ b/azure-pipelines/nightly.yml
@@ -0,0 +1,78 @@
+resources:
+- repo: self
+
+jobs:
+- job: linux_x86_bionic_gcc_openssl
+  displayName: 'Linux (x86; Bionic; GCC; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: docker.yml
+    parameters:
+      qemu: 'true'
+      imageName: 'libgit2/bionic-x86:test'
+      environmentVariables: |
+       CC=gcc
+       CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
+       LEAK_CHECK=valgrind
+
+- job: linux_x86_bionic_clang_openssl
+  displayName: 'Linux (x86; Bionic; Clang; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: docker.yml
+    parameters:
+      qemu: 'true'
+      imageName: 'libgit2/bionic-x86:test'
+      environmentVariables: |
+       CC=clang
+       CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
+       LEAK_CHECK=valgrind
+
+- job: linux_arm32_bionic_gcc_openssl
+  displayName: 'Linux (arm32; Bionic; GCC; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: docker.yml
+    parameters:
+      qemu: 'true'
+      imageName: 'libgit2/bionic-arm32:test'
+      environmentVariables: |
+       CC=gcc
+       CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
+       SKIP_PROXY_TESTS=true
+
+- job: linux_arm64_bionic_gcc_openssl
+  displayName: 'Linux (arm64; Bionic; GCC; OpenSSL)'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - template: docker.yml
+    parameters:
+      qemu: 'true'
+      imageName: 'libgit2/bionic-arm64:test'
+      environmentVariables: |
+       CC=gcc
+       CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL
+       SKIP_PROXY_TESTS=true
+
+- job: coverity
+  displayName: 'Coverity'
+  pool:
+    vmImage: 'Ubuntu 16.04'
+  steps:
+  - task: Docker@0
+    displayName: Build
+    inputs:
+      action: 'Run an image'
+      imageName: 'libgit2/trusty-openssl:latest'
+      volumes: |
+       $(Build.SourcesDirectory):/src
+       $(Build.BinariesDirectory):/build
+      envVars: |
+       COVERITY_TOKEN=$(COVERITY_TOKEN)
+      workDir: '/build'
+      containerCommand: '/src/ci/coverity.sh'
+      detached: false
diff --git a/azure-pipelines/powershell.yml b/azure-pipelines/powershell.yml
new file mode 100644
index 0000000..a2eb175
--- /dev/null
+++ b/azure-pipelines/powershell.yml
@@ -0,0 +1,17 @@
+# These are the steps used for building on machines with PowerShell.
+steps:
+- powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
+  displayName: Build
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
+  displayName: Test
+  workingDirectory: '$(Build.BinariesDirectory)'
+  env: ${{ parameters.environmentVariables }}
+- task: PublishTestResults@2
+  displayName: Publish Test Results
+  condition: succeededOrFailed()
+  inputs:
+    testResultsFiles: 'results_*.xml'
+    searchFolder: '$(Build.BinariesDirectory)'
+    mergeTestResults: true
diff --git a/ci/bash.yml b/ci/bash.yml
deleted file mode 100644
index d776a36..0000000
--- a/ci/bash.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-# These are the steps used for building on machines with bash.
-steps:
-- bash: . '$(Build.SourcesDirectory)/ci/build.sh'
-  displayName: Build
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- bash: . '$(Build.SourcesDirectory)/ci/test.sh'
-  displayName: Test
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- task: PublishTestResults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
diff --git a/ci/docker.yml b/ci/docker.yml
deleted file mode 100644
index e925104..0000000
--- a/ci/docker.yml
+++ /dev/null
@@ -1,33 +0,0 @@
-# These are the steps used in a container-based build in VSTS.
-steps:
-- task: docker@0
-  displayName: Build
-  inputs:
-    action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
-    volumes: |
-     $(Build.SourcesDirectory):/src
-     $(Build.BinariesDirectory):/build
-    envVars: ${{ parameters.environmentVariables }}
-    workDir: '/build'
-    containerCommand: '/src/ci/build.sh'
-    detached: false
-- task: docker@0
-  displayName: Test
-  inputs:
-    action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
-    volumes: |
-     $(Build.SourcesDirectory):/src
-     $(Build.BinariesDirectory):/build
-    envVars: ${{ parameters.environmentVariables }}
-    workDir: '/build'
-    containerCommand: '/src/ci/test.sh'
-    detached: false
-- task: publishtestresults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
diff --git a/ci/nightly.yml b/ci/nightly.yml
deleted file mode 100644
index 4d6d8a3..0000000
--- a/ci/nightly.yml
+++ /dev/null
@@ -1,22 +0,0 @@
-resources:
-- repo: self
-
-jobs:
-- job: coverity
-  displayName: 'Coverity'
-  pool:
-    vmImage: 'Ubuntu 16.04'
-  steps:
-  - task: Docker@0
-    displayName: Build
-    inputs:
-      action: 'Run an image'
-      imageName: 'libgit2/trusty-openssl:latest'
-      volumes: |
-       $(Build.SourcesDirectory):/src
-       $(Build.BinariesDirectory):/build
-      envVars: |
-       COVERITY_TOKEN=$(COVERITY_TOKEN)
-      workDir: '/build'
-      containerCommand: '/src/ci/coverity.sh'
-      detached: false
diff --git a/ci/powershell.yml b/ci/powershell.yml
deleted file mode 100644
index a2eb175..0000000
--- a/ci/powershell.yml
+++ /dev/null
@@ -1,17 +0,0 @@
-# These are the steps used for building on machines with PowerShell.
-steps:
-- powershell: . '$(Build.SourcesDirectory)\ci\build.ps1'
-  displayName: Build
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- powershell: . '$(Build.SourcesDirectory)\ci\test.ps1'
-  displayName: Test
-  workingDirectory: '$(Build.BinariesDirectory)'
-  env: ${{ parameters.environmentVariables }}
-- task: PublishTestResults@2
-  displayName: Publish Test Results
-  condition: succeededOrFailed()
-  inputs:
-    testResultsFiles: 'results_*.xml'
-    searchFolder: '$(Build.BinariesDirectory)'
-    mergeTestResults: true
diff --git a/ci/test.sh b/ci/test.sh
index e50e6fa..5d7c913 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -73,8 +73,8 @@ fi
 
 if [ -z "$SKIP_PROXY_TESTS" ]; then
 	echo "Starting HTTP proxy..."
-	curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.1.0/poxyproxy-0.1.0.jar >poxyproxy.jar
-	java -jar poxyproxy.jar -d --port 8080 --credentials foo:bar >/dev/null 2>&1 &
+	curl -L https://github.com/ethomson/poxyproxy/releases/download/v0.2.0/poxyproxy-0.2.0.jar >poxyproxy.jar
+	java -jar poxyproxy.jar -d --address 127.0.0.1 --port 8080 --credentials foo:bar >/dev/null 2>&1 &
 fi
 
 if [ -z "$SKIP_SSH_TESTS" ]; then
diff --git a/libgit2_clar.supp b/libgit2_clar.supp
index 0cc89b5..abd1117 100644
--- a/libgit2_clar.supp
+++ b/libgit2_clar.supp
@@ -56,7 +56,7 @@
 }
 
 {
-	ignore-libssh2-gcrypt-leak
+	ignore-libssh2-gcrypt-control-leak
 	Memcheck:Leak
 	...
 	fun:gcry_control
@@ -64,6 +64,46 @@
 }
 
 {
+	ignore-libssh2-gcrypt-mpinew-leak
+	Memcheck:Leak
+	...
+	fun:gcry_mpi_new
+	obj:*libssh2.so*
+}
+
+{
+	ignore-libssh2-gcrypt-mpiscan-leak
+	Memcheck:Leak
+	...
+	fun:gcry_mpi_scan
+	obj:*libssh2.so*
+}
+
+{
+	ignore-libssh2-gcrypt-randomize-leak
+	Memcheck:Leak
+	...
+	fun:gcry_randomize
+	obj:*libssh2.so*
+}
+
+{
+	ignore-libssh2-gcrypt-sexpfindtoken-leak
+	Memcheck:Leak
+	...
+	fun:gcry_sexp_find_token
+	obj:*libssh2.so*
+}
+
+{
+	ignore-libssh2-gcrypt-pksign-leak
+	Memcheck:Leak
+	...
+	fun:gcry_pk_sign
+	obj:*libssh2.so*
+}
+
+{
 	ignore-noai6ai_cached-double-free
 	Memcheck:Free
 	fun:free
diff --git a/tests/buf/oom.c b/tests/buf/oom.c
index 2741a8d..ec3bad9 100644
--- a/tests/buf/oom.c
+++ b/tests/buf/oom.c
@@ -11,12 +11,8 @@
  */
 #if defined(GIT_ARCH_64) && defined(__linux__)
 # define TOOBIG 0x0fffffffffffffff
-#elif defined(__linux__)
-# define TOOBIG 0x0fffffff
 #elif defined(GIT_ARCH_64)
 # define TOOBIG 0xffffffffffffff00
-#else
-# define TOOBIG 0xffffff00
 #endif
 
 /**
@@ -25,13 +21,18 @@
  * will fail.  And because the git_buf_grow() wrapper always
  * sets mark_oom, the code in git_buf_try_grow() will free
  * the internal buffer and set it to git_buf__oom.
- * 
+ *
  * We initialized the internal buffer to (the static variable)
  * git_buf__initbuf.  The purpose of this test is to make sure
  * that we don't try to free the static buffer.
+ *
+ * Skip this test entirely on 32-bit platforms; a buffer large enough
+ * to guarantee malloc failures is so large that valgrind considers
+ * it likely to be an error.
  */
 void test_buf_oom__grow(void)
 {
+#ifdef GIT_ARCH_64
 	git_buf buf = GIT_BUF_INIT;
 
 	git_buf_clear(&buf);
@@ -40,6 +41,9 @@ void test_buf_oom__grow(void)
 	cl_assert(git_buf_oom(&buf));
 
 	git_buf_dispose(&buf);
+#else
+    cl_skip();
+#endif
 }
 
 void test_buf_oom__grow_by(void)