As with the callbacks, third-party implementations of smart subtransports cannot
reach into the opaque struct and thus cannot know what options the user set.

Add a getter for these options to copy the proxy options into something external
implementors can use.

fileops: fix leaking fd in `mmap_ro_file`

When the `git_futils_mmap_ro_file` function encounters an error after
the file has been opened, it will do a simple returns. Instead, we
should close the opened file descriptor to avoid a leak. This commit
fixes the issue.

filter: only close filter if it's been initialized correctly

Fix building against OpenSSL v1.1

README: document our relation to changes in upstream

libgit2 is a mere consumer of changes which are trickling down from the
upstream git.git project. This commit documents the ramifications caused
by this relation.

Previous to OpenSSL version 1.1, the user had to initialize at least the error
strings as well as the SSL algorithms by himself. OpenSSL version 1.1 instead
provides a new function `OPENSSL_init_ssl`, which handles initialization of all
subsystems. As the new API call will by default load error strings and
initialize the SSL algorithms, we can safely replace these calls when compiling
against version 1.1 or later.

This fixes a compiler error when compiling against OpenSSL version 1.1 which has
been built without stubs for deprecated syntax.

Up to version 1.0, OpenSSL required us to provide a callback which implements
a locking mechanism. Due to problems in the API design though this mechanism was
inherently broken, especially regarding that the locking callback cannot report
errors in an obvious way. Due to this shortcoming, the locking initialization
has been completely removed in OpenSSL version 1.1. As the library has also been
refactored to not make any use of these callback functions, we can safely remove
all initialization of the locking subsystem if compiling against OpenSSL version
1.1 or higher.

This fixes a compilation error when compiling against OpenSSL version 1.1 which
has been built without stubs for deprecated syntax.

In the function `git_filter_list_stream_data`, we initialize, write and
subesquently close the stream which should receive content processed by
the filter. While we skip writing to the stream if its initialization
failed, we still try to close it unconditionally -- even if the
initialization failed, where the stream might not be set at all, leading
us to segfault.

Semantics in this code is not really clear. The function handling the
same logic for files instead of data seems to do the right thing here in
only closing the stream when initialization succeeded. When stepping
back a bit, this is only reasonable: if a stream cannot be initialized,
the caller would not expect it to be closed again. So actually, both
callers of `stream_list_init` fail to do so. The data streaming function
will always close the stream and the file streaming function will not
close the stream if writing to it has failed.

The fix is thus two-fold:

- callers of `stream_list_init` now close the stream iff it has been
  initialized
- `stream_list_init` now closes the lastly initialized stream if
  the current stream in the chain failed to initialize

Add a test which segfaulted previous to these changes.

Coverity

pkgconfig: fix handling of prefixes containing whitespaces

Our libgit2.pc.in file is quoting the `libdir` variable in our declared
"Libs:" line. The intention is to handle whitespaces here, but pkgconfig
already does so by automatically escaping whitespace with backslashes.
The correct thing to do is to instead quote the prefix, as this is the
one which is being substituted by CMake upon installation. As both
libdir and includedir will be expanded to "${prefix}/lib" and
"${prefix}/include", respectively, pkgconfig will also correctly escape
whitespaces.

Note that this will actually break when a user manually wants to
override libdir and includedir with a path containing whitespace. But
actually, this cannot be helped, as always quoting these variables will
actuall break the common case of being prefixed with "${prefix}". So we
just bail out here and declare this as unsupported out of the box.

When executing `git_futils_mmap_ro_file`, we first try to guess whether
the file is mmapable at all. Part of this check is whether the file is
too large to be mmaped, which can be true on systems with 32 bit
`size_t` types.

The check is performed by first getting the file size wtih
`git_futils_filesize` and then checking whether the returned size can be
represented as `size_t`, returning an error if so. While this test also
catches the case where the function returned an error (as `-1` is not
representable by `size_t`), we will set the misleading error message
"file too large to mmap". But in fact, a negative return value from
`git_futils_filesize` will be caused by the inability to fstat the file.

Fix the error message by handling negative return values separately and
not overwriting the error message in that case.

We do not check the return value of `git__calloc`, which may return
`NULL` in out-of-memory situations. Fix the error by using
`GITERR_CHECK_ALLOC`.

Short-circuit the call to `git_path_resolve_relative` in case
`git_buf_joinpath` returns an error. While this does not fix any
immediate errors, the resulting code is easier to read and handles
potential new error conditions raised by `git_buf_joinpath`.

In the `_check_dir_contents` function, we first allocate memory for
joining the directory and subdirectory together and afterwards use
`git_buf_joinpath`. While this function in fact should not fail as
memory is already allocated, err on the safe side and check for returned
errors.

The current code in `parse_section_header_ext` is only prepared to
properly handle out-of-memory conditions for the `git_buf` structure.
While very unlikely and probably caused by a programming error, it is
also possible to run into error conditions other than out-of-memory
previous to reaching the actual parsing loop. In these cases, we will
run into undefined behavior as the `rpos` variable is only initialized
after these triggerable errors, but we use it in the cleanup-routine.

Fix the issue by unifying the function's cleanup code with an
`end_error` section, which will not use the `rpos` variable.

Correct non-existent file references in `odb.h`

There are references to odb_backends.h when the file is actually named
odb_backend.h and in the sys folder.

git_treebuilder_write_with_buffer refactorings

While writing the tree inside of a buffer, we check whether the buffer
runs out of memory after each tree entry. While we set the error code as
soon as we detect the OOM situation, we happily proceed iterating over
the entries. This is not useful at all, as we will try to write into the
buffer repeatedly, which cannot work.

Fix this by exiting as soon as we are OOM.

The `git_tree_entry *entry` variable is defined twice inside of this
function. While this is not a problem currently, remove the shadowing
variable to avoid future confusion.

While we detect errors in `git_treebuilder_write_with_buffer`, we just
exit directly instead of freeing allocated memory. Fix this by
remembering error codes and skipping forward to the function's cleanup
code.

Fix memory leaks

The recent addition of an error code to `pass_whole_blame` in ff8d2eb1
(blame_git: check return value of object lookup, 2017-03-20) introduced
a spurious goto. Remove it.

git_futils: don't O_EXCL and O_TRUNC

sha1dc: perf improvements from upstream

inet_pton: don't assume addr families don't exist

Update SHA-1 collision detection code (cr-marcstevens/sha1collisiondetection)
to master to include performance improvements.

Worktree fixes

fsync all the things

Coverity fixes

Fix the documentation for git_cred_acquire_cb

Address family 5 might exist on some crazy system like Haiku.
Use `INT_MAX-1` as an unsupported address family.

`O_EXCL` and `O_TRUNC` are mutually exclusive flags to open(2); you can't
truncate a file if you're asserting that it can't exist in the first place.
Drop `O_TRUNC`.