When adding a new entry to our cache where an entry with the same OID
exists already, then we only update the existing entry in case it is
unparsed and the new entry is parsed. Currently, we do not check the
return value of `git_oidmap_set` though when updating the existing
entry. As a result, we will _not_ have updated the existing entry if
`git_oidmap_set` fails, but have decremented its refcount and
incremented the new entry's refcount. Later on, this may likely lead to
dereferencing invalid memory.

Fix the issue by checking the return value of `git_oidmap_set`. In case
it fails, we will simply keep the existing stored instead, even though
it's unparsed.

Git worktree's have the ability to be locked in order to spare them from
deletion, e.g. if a worktree is absent due to being located on a
removable disk it is a good idea to lock it. When locking such
worktrees, it is possible to give a locking reason in order to help the
user later on when inspecting status of any such locked trees.

The function `git_worktree_is_locked` serves to read out the locking
status. It currently does not properly report any errors when reading
the reason file, and callers are unexpecting of any negative return
values, too. Fix this by converting callers to expect error codes and
checking the return code of `git_futils_readbuffer`.

When checking whether a path is a valid repository path, we try to read
the "commondir" link file. In the process, we neither confirm that
constructing the file's path succeeded nor do we verify that reading the
file succeeded, which might cause us to verify repositories on an empty
or bogus path later on.

Fix this by checking return values. As the function to verify repos
doesn't currently support returning errors, this commit also refactors
the function to return an error code, passing validity of the repo via
an out parameter instead, and adjusts all existing callers.

While `git_zstream_set_input` cannot fail right now, it might change in
the future if we ever decide to have it check its parameters more
vigorously. Let's thus check whether its return code signals an error.

Initialization of the hashing context may fail on some systems, most
notably on Win32 via the legacy hashing context. As such, we need to
always check the error code of `git_hash_ctx_init`, which is not done
when creating a new indexer.

Fix the issue by adding checks.

When queueing objects we want to push, we call `git_revwalk_hide` to
hide all objects already known to the remote from our revwalk. We do not
check its return value though, where the orginial intent was to ignore
the case where the pushed OID is not a known committish. As
`git_revwalk_hide` can fail due to other reasons like out-of-memory
exceptions, we should still check its return value.

Fix the issue by checking the function's return value, ignoring
errors hinting that it's not a committish. As `git_revwalk__push_commit`
currently clobbers these error codes, we need to adjust it as well in
order to make it available downstream.

When calling `git_note_next`, we end up calling `git_iterator_advance`
but ignore its error code. The intent is that we do not want to return
an error if it returns `GIT_ITEROVER`, as we want to return that value
on the next invocation of `git_note_next`. We should still check for any
other error codes returned by `git_iterator_advance` to catch unexpected
internal errors.

Fix this by checking the function's return value, ignoring
`GIT_ITEROVER`.

We should always verify error codes returned by function calls in our
test suite to not accidentally miss any weird results. Coverity reported
missing checks in several locations, which this commit fixes.

While the blame helper function `hunk_message` accepts a printf-style
format string, we didn't add a compiler attribute to let the compiler
check for correct conversion specifiers. As a result, some users of the
function used wrong specifiers.

Add the GIT_FORMAT_PRINTF attribute to the function and fix resulting
warnings by using the correct specifiers.

azure: tests: re-run flaky proxy tests

While we already do have logic to re-run flaky tests, the FAILED
variable currently does not get reset to "0". As a result, successful
reruns will still cause the test to be registered as failed.

Fix this by resetting the variable accordingly.

The proxy tests regularly fail in our CI environment. Unfortunately,
this is expected due to the network layer. Thus, let's re-try the proxy
tests up to five times in case they fail.

fetchhead: strip credentials from remote URL

If fetching from an anonymous remote via its URL, then the URL gets
written into the FETCH_HEAD reference. This is mainly done to give
valuable context to some commands, like for example git-merge(1), which
will put the URL into the generated MERGE_MSG. As a result, what gets
written into FETCH_HEAD may become public in some cases. This is
especially important considering that URLs may contain credentials, e.g.
when cloning 'https://foo:bar@example.com/repo' we persist the complete
URL into FETCH_HEAD and put it without any kind of sanitization into the
MERGE_MSG. This is obviously bad, as your login data has now just leaked
as soon as you do git-push(1).

When writing the URL into FETCH_HEAD, upstream git does strip
credentials first. Let's do the same by trying to parse the remote URL
as a "real" URL, removing any credentials and then re-formatting the
URL. In case this fails, e.g. when it's a file path or not a valid URL,
we just fall back to using the URL as-is without any sanitization. Add
tests to verify our behaviour.

azure-pipelines: properly expand negotiate passwords

To allow testing against a Kerberos instance, we have added variables
for the Kerberos password to allow authentication against LIBGIT2.ORG in
commit e5fb5fe5 (ci: perform SPNEGO tests, 2019-10-20). To set up the
password, we assign

    "GITTEST_NEGOTIATE_PASSWORD=$(GITTEST_NEGOTIATE_PASSWORD)"

in the environmentVariables section which is then passed through to a
template. As the template does build-time expansion of the environment
variables, it will expand the above line verbosely, and due to the
envVar section not doing any further expansion the password variable
will end up with the value "$(GITTEST_NEGOTIATE_PASSWORD)" in the
container's environment.

Fix this fixed by doing expansion of GITTEST_NEGOTIATE_PASSWORD at
build-time, as well.

cred: change enum to git_credential_t and GIT_CREDENTIAL_*

Update link to libgit2 Julia language binding

We avoid abbreviations where possible; rename git_cred to
git_credential.

In addition, we have standardized on a trailing `_t` for enum types,
instead of using "type" in the name.  So `git_credtype_t` has become
`git_credential_t` and its members have become `GIT_CREDENTIAL` instead
of `GIT_CREDTYPE`.

Finally, the source and header files have been renamed to `credential`
instead of `cred`.

Keep previous name and values as deprecated, and include the new header
files from the previous ones.

Return int from non-free functions

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

Stop returning a void for functions, future-proofing them to allow them
to fail.

HTTP: Support Apache-based servers with Negotiate

Disambiguate between general network problems and HTTP problems in error
codes.

Download poxygit, a debugging git server, and clone from it using NTLM,
both IIS-style (with connection affinity) and Apache-style ("broken",
requiring constant reauthentication).

When tracing is disabled, don't let `git_trace__level` return a void,
since that can't be compared against.

When we're authenticating with a connection-based authentication scheme
(NTLM, Negotiate), we need to make sure that we're still connected
between the initial GET where we did the authentication and the POST
that we're about to send.  Our keep-alive session may have not kept
alive, but more likely, some servers do not authenticate the entire
keep-alive connection and may have "forgotten" that we were
authenticated, namely Apache and nginx.

Send a "probe" packet, that is an HTTP POST request to the upload-pack
or receive-pack endpoint, that consists of an empty git pkt ("0000").
If we're authenticated, we'll get a 200 back.  If we're not, we'll get a
401 back, and then we'll resend that probe packet with the first step of
our authentication (asking to start authentication with the given
scheme).  We expect _yet another_ 401 back, with the authentication
challenge.

Finally, we will send our authentication response with the actual POST
data.  This will allow us to authenticate without draining the POST data
in the initial request that gets us a 401.

Untangle the notion of the http transport from the actual http
implementation.  The http transport now uses the httpclient.

Allow users to opt-in to expect/continue handling when sending a POST
and we're authenticated with a "connection-based" authentication
mechanism like NTLM or Negotiate.

If the response is a 100, return to the caller (to allow them to post
their body).  If the response is *not* a 100, buffer the response for
the caller.

HTTP expect/continue is generally safe, but some legacy servers
have not implemented it correctly.  Require it to be opt-in.