thodg/libgit2

diff --git a/azure-pipelines.yml b/azure-pipelines.yml
index dda7ad5..5e28d2b 100644
--- a/azure-pipelines.yml
+++ b/azure-pipelines.yml
@@ -6,56 +6,64 @@ trigger:
 - maint/*
 
 jobs:
-- job: linux_amd64_trusty_gcc_openssl
-  displayName: 'Linux (amd64; Trusty; GCC; OpenSSL)'
+- job: linux_amd64_xenial_gcc_openssl
+  displayName: 'Linux (amd64; Xenial; GCC; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DREGEX_BACKEND=builtin -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
 
-- job: linux_amd64_trusty_gcc_mbedtls
-  displayName: 'Linux (amd64; Trusty; GCC; mbedTLS)'
+- job: linux_amd64_xenial_gcc_mbedtls
+  displayName: 'Linux (amd64; Xenial; GCC; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
 
-- job: linux_amd64_trusty_clang_openssl
-  displayName: 'Linux (amd64; Trusty; Clang; OpenSSL)'
+- job: linux_amd64_xenial_clang_openssl
+  displayName: 'Linux (amd64; Xenial; Clang; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=clang
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
 
-- job: linux_amd64_trusty_clang_mbedtls
-  displayName: 'Linux (amd64; Trusty; Clang; mbedTLS)'
+- job: linux_amd64_xenial_clang_mbedtls
+  displayName: 'Linux (amd64; Xenial; Clang; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: azure-pipelines/docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=clang
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
 
 - job: macos
@@ -137,6 +145,10 @@ jobs:
     vmImage: 'Ubuntu 16.04'
   steps:
   - script: |
+      cd $(Build.SourcesDirectory)/azure-pipelines/docker
+      docker build -t libgit2/docurium --build-arg BASE=ubuntu:trusty -f docurium .
+    displayName: 'Build Docker image'
+  - script: |
       git config user.name 'Documentation Generation'
       git config user.email 'libgit2@users.noreply.github.com'
       git branch gh-pages origin/gh-pages
diff --git a/azure-pipelines/coverity.yml b/azure-pipelines/coverity.yml
index d8c6b3f..28ab5ab 100644
--- a/azure-pipelines/coverity.yml
+++ b/azure-pipelines/coverity.yml
@@ -11,7 +11,9 @@ jobs:
     displayName: Build
     inputs:
       action: 'Run an image'
-      imageName: 'libgit2/trusty-openssl:latest'
+      docker:
+        image: xenial
+        base: xenial
       volumes: |
        $(Build.SourcesDirectory):/src
        $(Build.BinariesDirectory):/build
diff --git a/azure-pipelines/docker.yml b/azure-pipelines/docker.yml
index 2bbe686..ce1e73d 100644
--- a/azure-pipelines/docker.yml
+++ b/azure-pipelines/docker.yml
@@ -4,11 +4,15 @@ steps:
   - script: docker run --rm --privileged multiarch/qemu-user-static:register --reset
     displayName: 'Register Docker QEMU'
 
+- script: |
+    cd $(Build.SourcesDirectory)/azure-pipelines/docker
+    docker build -t libgit2/${{parameters.docker.image}} --build-arg BASE=${{parameters.docker.base}} -f ${{parameters.docker.image}} .
+  displayName: 'Build Docker image'
 - task: docker@0
   displayName: Build
   inputs:
     action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
+    imageName: libgit2/${{ parameters.docker.image }}
     volumes: |
      $(Build.SourcesDirectory):/src
      $(Build.BinariesDirectory):/build
@@ -20,7 +24,7 @@ steps:
   displayName: Test
   inputs:
     action: 'Run an image'
-    imageName: ${{ parameters.imageName }}
+    imageName: libgit2/${{ parameters.docker.image }}
     volumes: |
      $(Build.SourcesDirectory):/src
      $(Build.BinariesDirectory):/build
diff --git a/azure-pipelines/docker/bionic b/azure-pipelines/docker/bionic
new file mode 100644
index 0000000..f59cf34
--- /dev/null
+++ b/azure-pipelines/docker/bionic
@@ -0,0 +1,35 @@
+ARG BASE
+FROM $BASE
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        clang \
+        cmake \
+        curl \
+        gcc \
+        git \
+        libcurl4-openssl-dev \
+        libpcre3-dev \
+        libssh2-1-dev \
+        libssl-dev \
+        libz-dev \
+        ninja-build \
+        openjdk-8-jre-headless \
+        openssh-server \
+        openssl \
+        pkgconf \
+        python \
+        valgrind \
+        && \
+    rm -rf /var/lib/apt/lists/*
+RUN mkdir /var/run/sshd
+
+RUN cd /tmp && \
+    curl -LO https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz && \
+    tar -xf mbedtls-2.16.2-apache.tgz && \
+    rm -f mbedtls-2.16.2-apache.tgz && \
+    cd mbedtls-2.16.2 && \
+    scripts/config.pl set MBEDTLS_MD4_C 1 && \
+    CFLAGS=-fPIC cmake -G Ninja -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON . && \
+    ninja install && \
+    cd .. && \
+    rm -rf mbedtls-2.16.2
diff --git a/azure-pipelines/docker/docurium b/azure-pipelines/docker/docurium
new file mode 100644
index 0000000..15d10a7
--- /dev/null
+++ b/azure-pipelines/docker/docurium
@@ -0,0 +1,6 @@
+FROM debian:jessie-slim
+ARG CACHEBUST=1
+RUN apt-get update
+RUN apt install -y cmake pkg-config ruby ruby-dev llvm libclang-3.5-dev libssl-dev python-pygments
+ARG CACHEBUST=1
+RUN gem install docurium
diff --git a/azure-pipelines/docker/xenial b/azure-pipelines/docker/xenial
new file mode 100644
index 0000000..db52a75
--- /dev/null
+++ b/azure-pipelines/docker/xenial
@@ -0,0 +1,47 @@
+ARG BASE
+FROM $BASE
+RUN echo 'deb http://ppa.launchpad.net/hola-launchpad/valgrind/ubuntu xenial main' >/etc/apt/sources.list.d/valgrind.list && \
+    apt-key adv --keyserver keyserver.ubuntu.com --recv-keys 8A0303A7544D59A08EBD1D621BCFD9273D292CF6 && \
+    apt-get update && \
+    apt-get install -y --no-install-recommends \
+        clang \
+        cmake \
+        curl \
+        gcc \
+        git \
+        libcurl4-gnutls-dev \
+        libpcre3-dev \
+        libssh2-1-dev \
+        libssl-dev \
+        libz-dev \
+        ninja-build \
+        openjdk-8-jre-headless \
+        openssh-server \
+        openssl \
+        pkgconf \
+        python \
+        valgrind \
+        && \
+    rm -rf /var/lib/apt/lists/*
+RUN mkdir /var/run/sshd
+
+RUN cd /tmp && \
+    curl -LO https://tls.mbed.org/download/mbedtls-2.16.2-apache.tgz && \
+    tar -xf mbedtls-2.16.2-apache.tgz && \
+    rm -f mbedtls-2.16.2-apache.tgz && \
+    cd mbedtls-2.16.2 && \
+    scripts/config.pl set MBEDTLS_MD4_C 1 && \
+    CFLAGS=-fPIC cmake -G Ninja -DENABLE_PROGRAMS=OFF -DENABLE_TESTING=OFF -DUSE_SHARED_MBEDTLS_LIBRARY=OFF -DUSE_STATIC_MBEDTLS_LIBRARY=ON . && \
+    ninja install && \
+    cd .. && \
+    rm -rf mbedtls-2.16.2
+
+RUN cd /tmp && \
+    curl -LO https://www.libssh2.org/download/libssh2-1.8.2.tar.gz && \
+    tar -xf libssh2-1.8.2.tar.gz && \
+    rm -f libssh2-1.8.2.tar.gz && \
+    cd libssh2-1.8.2 && \
+    CFLAGS=-fPIC cmake -G Ninja -DCRYPTO_BACKEND=Libgcrypt . && \
+    ninja install && \
+    cd .. && \
+    rm -rf libssh2-1.8.2
diff --git a/azure-pipelines/nightly.yml b/azure-pipelines/nightly.yml
index 96cc3e5..b8d550f 100644
--- a/azure-pipelines/nightly.yml
+++ b/azure-pipelines/nightly.yml
@@ -2,59 +2,67 @@ resources:
 - repo: self
 
 jobs:
-- job: linux_amd64_trusty_gcc_openssl
-  displayName: 'Linux (amd64; Trusty; GCC; OpenSSL)'
+- job: linux_amd64_xenial_gcc_openssl
+  displayName: 'Linux (amd64; Xenial; GCC; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DREGEX_BACKEND=builtin -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
-- job: linux_amd64_trusty_gcc_mbedtls
-  displayName: 'Linux (amd64; Trusty; GCC; mbedTLS)'
+- job: linux_amd64_xenial_gcc_mbedtls
+  displayName: 'Linux (amd64; Xenial; GCC; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
-- job: linux_amd64_trusty_clang_openssl
-  displayName: 'Linux (amd64; Trusty; Clang; OpenSSL)'
+- job: linux_amd64_xenial_clang_openssl
+  displayName: 'Linux (amd64; Xenial; Clang; OpenSSL)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=clang
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
-- job: linux_amd64_trusty_clang_mbedtls
-  displayName: 'Linux (amd64; Trusty; Clang; mbedTLS)'
+- job: linux_amd64_xenial_clang_mbedtls
+  displayName: 'Linux (amd64; Xenial; Clang; mbedTLS)'
   pool:
     vmImage: 'Ubuntu 16.04'
   steps:
   - template: docker.yml
     parameters:
-      imageName: 'libgit2/trusty-amd64:latest'
+      docker:
+        image: xenial
+        base: ubuntu:xenial
       environmentVariables: |
        CC=clang
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=mbedTLS -DUSE_SHA1=HTTPS -DREGEX_BACKEND=pcre -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
@@ -144,10 +152,12 @@ jobs:
   - template: docker.yml
     parameters:
       qemu: 'true'
-      imageName: 'libgit2/bionic-x86:latest'
+      docker:
+        image: bionic
+        base: multiarch/ubuntu-core:x86-bionic
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
@@ -159,10 +169,12 @@ jobs:
   - template: docker.yml
     parameters:
       qemu: 'true'
-      imageName: 'libgit2/bionic-x86:latest'
+      docker:
+        image: bionic
+        base: multiarch/ubuntu-core:x86-bionic
       environmentVariables: |
        CC=clang
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON -DUSE_LEAK_CHECKER=valgrind
        RUN_INVASIVE_TESTS=true
 
@@ -174,10 +186,12 @@ jobs:
   - template: docker.yml
     parameters:
       qemu: 'true'
-      imageName: 'libgit2/bionic-arm32:latest'
+      docker:
+        image: bionic
+        base: multiarch/ubuntu-core:armhf-bionic
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON
        RUN_INVASIVE_TESTS=true
        SKIP_PROXY_TESTS=true
@@ -190,10 +204,12 @@ jobs:
   - template: docker.yml
     parameters:
       qemu: 'true'
-      imageName: 'libgit2/bionic-arm64:latest'
+      docker:
+        image: bionic
+        base: multiarch/ubuntu-core:arm64-bionic
       environmentVariables: |
        CC=gcc
-       CMAKE_GENERATOR=Unix Makefiles
+       CMAKE_GENERATOR=Ninja
        CMAKE_OPTIONS=-DUSE_HTTPS=OpenSSL -DDEPRECATE_HARD=ON
        RUN_INVASIVE_TESTS=true
        SKIP_PROXY_TESTS=true
diff --git a/cmake/Modules/FindCoreFoundation.cmake b/cmake/Modules/FindCoreFoundation.cmake
index e86ccbf..191aa59 100644
--- a/cmake/Modules/FindCoreFoundation.cmake
+++ b/cmake/Modules/FindCoreFoundation.cmake
@@ -10,14 +10,14 @@ FIND_PATH(COREFOUNDATION_INCLUDE_DIR NAMES CoreFoundation.h)
 FIND_LIBRARY(COREFOUNDATION_LIBRARIES NAMES CoreFoundation)
 IF (COREFOUNDATION_INCLUDE_DIR AND COREFOUNDATION_LIBRARIES)
 	IF (NOT CoreFoundation_FIND_QUIETLY)
-		MESSAGE("-- Found CoreFoundation ${COREFOUNDATION_LIBRARIES}")
+		MESSAGE(STATUS "Found CoreFoundation ${COREFOUNDATION_LIBRARIES}")
 	ENDIF()
 	SET(COREFOUNDATION_FOUND TRUE)
 	SET(COREFOUNDATION_LDFLAGS "-framework CoreFoundation")
 ENDIF ()
 
 IF (CoreFoundation_FIND_REQUIRED AND NOT COREFOUNDATION_FOUND)
-	MESSAGE(FATAL "-- CoreFoundation not found")
+	MESSAGE(FATAL_ERROR "CoreFoundation not found")
 ENDIF()
 
 MARK_AS_ADVANCED(
diff --git a/cmake/Modules/FindSecurity.cmake b/cmake/Modules/FindSecurity.cmake
index 487f7e5..a538c02 100644
--- a/cmake/Modules/FindSecurity.cmake
+++ b/cmake/Modules/FindSecurity.cmake
@@ -11,7 +11,7 @@ FIND_PATH(SECURITY_INCLUDE_DIR NAMES Security/Security.h)
 FIND_LIBRARY(SECURITY_LIBRARIES NAMES Security)
 IF (SECURITY_INCLUDE_DIR AND SECURITY_LIBRARIES)
 	IF (NOT Security_FIND_QUIETLY)
-		MESSAGE("-- Found Security ${SECURITY_LIBRARIES}")
+		MESSAGE(STATUS "Found Security ${SECURITY_LIBRARIES}")
 	ENDIF()
 	SET(SECURITY_FOUND TRUE)
 	SET(SECURITY_LDFLAGS "-framework Security")
@@ -19,7 +19,7 @@ IF (SECURITY_INCLUDE_DIR AND SECURITY_LIBRARIES)
 ENDIF ()
 
 IF (Security_FIND_REQUIRED AND NOT SECURITY_FOUND)
-	MESSAGE(FATAL "-- Security not found")
+	MESSAGE(FATAL_ERROR "Security not found")
 ENDIF()
 
 MARK_AS_ADVANCED(
diff --git a/cmake/Modules/SelectHTTPSBackend.cmake b/cmake/Modules/SelectHTTPSBackend.cmake
index 14147e3..81f3f8b 100644
--- a/cmake/Modules/SelectHTTPSBackend.cmake
+++ b/cmake/Modules/SelectHTTPSBackend.cmake
@@ -14,7 +14,7 @@ IF (USE_HTTPS STREQUAL ON)
 		IF (SECURITY_HAS_SSLCREATECONTEXT)
 			SET(HTTPS_BACKEND "SecureTransport")
 		ELSE()
-			MESSAGE("-- Security framework is too old, falling back to OpenSSL")
+			MESSAGE(STATUS "Security framework is too old, falling back to OpenSSL")
 			SET(HTTPS_BACKEND "OpenSSL")
 		ENDIF()
 	ELSEIF (WINHTTP)
@@ -67,7 +67,7 @@ IF(HTTPS_BACKEND)
 		ENDIF()
 
 		IF(NOT CERT_LOCATION)
-			MESSAGE("Auto-detecting default certificates location")
+			MESSAGE(STATUS "Auto-detecting default certificates location")
 			IF(CMAKE_SYSTEM_NAME MATCHES Darwin)
 				# Check for an Homebrew installation
 				SET(OPENSSL_CMD "/usr/local/opt/openssl/bin/openssl")
@@ -91,7 +91,7 @@ IF(HTTPS_BACKEND)
 					ENDIF()
 				ENDFOREACH()
 			ELSE()
-				MESSAGE("Unable to find OpenSSL executable. Please provide default certificate location via CERT_LOCATION")
+				MESSAGE(FATAL_ERROR "Unable to find OpenSSL executable. Please provide default certificate location via CERT_LOCATION")
 			ENDIF()
 		ENDIF()
 
diff --git a/cmake/Modules/SelectHashes.cmake b/cmake/Modules/SelectHashes.cmake
index 5667a9e..ce28ac2 100644
--- a/cmake/Modules/SelectHashes.cmake
+++ b/cmake/Modules/SelectHashes.cmake
@@ -5,7 +5,7 @@
 IF(USE_SHA1 STREQUAL ON OR USE_SHA1 STREQUAL "CollisionDetection")
 	SET(SHA1_BACKEND "CollisionDetection")
 ELSEIF(USE_SHA1 STREQUAL "HTTPS")
-	message("Checking HTTPS backend… ${HTTPS_BACKEND}")
+	message(STATUS "Checking HTTPS backend… ${HTTPS_BACKEND}")
 	IF(HTTPS_BACKEND STREQUAL "SecureTransport")
 		SET(SHA1_BACKEND "CommonCrypto")
 	ELSEIF(HTTPS_BACKEND STREQUAL "WinHTTP")