Merge branch 'master' into jc/commit-ammend

107 files changed, 2313 insertions, 457 deletions

diff --git a/plumbing/format/commitgraph/encoder.go b/plumbing/format/commitgraph/encoder.go
index d34076f..f61025b 100644
--- a/plumbing/format/commitgraph/encoder.go
+++ b/plumbing/format/commitgraph/encoder.go
@@ -1,11 +1,10 @@
 package commitgraph

 

 import (

-	"crypto/sha1"

-	"hash"

 	"io"

 

 	"github.com/go-git/go-git/v5/plumbing"

+	"github.com/go-git/go-git/v5/plumbing/hash"

 	"github.com/go-git/go-git/v5/utils/binary"

 )

 

@@ -17,7 +16,7 @@ type Encoder struct {
 

 // NewEncoder returns a new stream encoder that writes to w.

 func NewEncoder(w io.Writer) *Encoder {

-	h := sha1.New()

+	h := hash.New(hash.CryptoType)

 	mw := io.MultiWriter(w, h)

 	return &Encoder{mw, h}

 }

@@ -31,7 +30,7 @@ func (e *Encoder) Encode(idx Index) error {
 	hashToIndex, fanout, extraEdgesCount := e.prepare(idx, hashes)

 

 	chunkSignatures := [][]byte{oidFanoutSignature, oidLookupSignature, commitDataSignature}

-	chunkSizes := []uint64{4 * 256, uint64(len(hashes)) * 20, uint64(len(hashes)) * 36}

+	chunkSizes := []uint64{4 * 256, uint64(len(hashes)) * hash.Size, uint64(len(hashes)) * 36}

 	if extraEdgesCount > 0 {

 		chunkSignatures = append(chunkSignatures, extraEdgeListSignature)

 		chunkSizes = append(chunkSizes, uint64(extraEdgesCount)*4)

@@ -183,6 +182,6 @@ func (e *Encoder) encodeExtraEdges(extraEdges []uint32) (err error) {
 }

 

 func (e *Encoder) encodeChecksum() error {

-	_, err := e.Write(e.hash.Sum(nil)[:20])

+	_, err := e.Write(e.hash.Sum(nil)[:hash.Size])

 	return err

 }

diff --git a/plumbing/format/config/encoder.go b/plumbing/format/config/encoder.go
index 4eac896..de069ae 100644
--- a/plumbing/format/config/encoder.go
+++ b/plumbing/format/config/encoder.go
@@ -11,6 +11,10 @@ type Encoder struct {
 	w io.Writer
 }
 
+var (
+	subsectionReplacer = strings.NewReplacer(`"`, `\"`, `\`, `\\`)
+	valueReplacer = strings.NewReplacer(`"`, `\"`, `\`, `\\`, "\n", `\n`, "\t", `\t`, "\b", `\b`)
+)
 // NewEncoder returns a new encoder that writes to w.
 func NewEncoder(w io.Writer) *Encoder {
 	return &Encoder{w}
@@ -48,8 +52,7 @@ func (e *Encoder) encodeSection(s *Section) error {
 }
 
 func (e *Encoder) encodeSubsection(sectionName string, s *Subsection) error {
-	//TODO: escape
-	if err := e.printf("[%s \"%s\"]\n", sectionName, s.Name); err != nil {
+	if err := e.printf("[%s \"%s\"]\n", sectionName, subsectionReplacer.Replace(s.Name)); err != nil {
 		return err
 	}
 
@@ -58,12 +61,14 @@ func (e *Encoder) encodeSubsection(sectionName string, s *Subsection) error {
 
 func (e *Encoder) encodeOptions(opts Options) error {
 	for _, o := range opts {
-		pattern := "\t%s = %s\n"
-		if strings.Contains(o.Value, "\\") {
-			pattern = "\t%s = %q\n"
+		var value string
+		if strings.ContainsAny(o.Value, "#;\"\t\n\\") || strings.HasPrefix(o.Value, " ") || strings.HasSuffix(o.Value, " ") {
+			value = `"`+valueReplacer.Replace(o.Value)+`"`
+		} else {
+			value = o.Value
 		}
 
-		if err := e.printf(pattern, o.Key, o.Value); err != nil {
+		if err := e.printf("\t%s = %s\n", o.Key, value); err != nil {
 			return err
 		}
 	}
diff --git a/plumbing/format/config/fixtures_test.go b/plumbing/format/config/fixtures_test.go
index f3533df..2fa7840 100644
--- a/plumbing/format/config/fixtures_test.go
+++ b/plumbing/format/config/fixtures_test.go
@@ -43,6 +43,41 @@ var fixtures = []*Fixture{
 		Config: New().AddOption("core", "", "repositoryformatversion", "0"),
 	},
 	{
+		Raw: `[section]
+	option1 = "has # hash"
+	option2 = "has \" quote"
+	option3 = "has \\ backslash"
+	option4 = "has ; semicolon"
+	option5 = "has \n line-feed"
+	option6 = "has \t tab"
+	option7 = "  has leading spaces"
+	option8 = "has trailing spaces  "
+	option9 = has no special characters
+	option10 = has unusual ` + "\x01\x7f\xc8\x80 characters\n",
+		Text: `[section]
+	option1 = "has # hash"
+	option2 = "has \" quote"
+	option3 = "has \\ backslash"
+	option4 = "has ; semicolon"
+	option5 = "has \n line-feed"
+	option6 = "has \t tab"
+	option7 = "  has leading spaces"
+	option8 = "has trailing spaces  "
+	option9 = has no special characters
+	option10 = has unusual ` + "\x01\x7f\xc8\x80 characters\n",
+		Config: New().
+			AddOption("section", "", "option1", `has # hash`).
+			AddOption("section", "", "option2", `has " quote`).
+			AddOption("section", "", "option3", `has \ backslash`).
+			AddOption("section", "", "option4", `has ; semicolon`).
+			AddOption("section", "", "option5", "has \n line-feed").
+			AddOption("section", "", "option6", "has \t tab").
+			AddOption("section", "", "option7", `  has leading spaces`).
+			AddOption("section", "", "option8", `has trailing spaces  `).
+			AddOption("section", "", "option9", `has no special characters`).
+			AddOption("section", "", "option10", "has unusual \x01\x7f\u0200 characters"),
+	},
+	{
 		Raw: `
 			[sect1]
 			opt1 = value1
diff --git a/plumbing/format/config/format.go b/plumbing/format/config/format.go
new file mode 100644
index 0000000..4873ea9
--- /dev/null
+++ b/plumbing/format/config/format.go
@@ -0,0 +1,53 @@
+package config
+
+// RepositoryFormatVersion represents the repository format version,
+// as per defined at:
+//
+//	https://git-scm.com/docs/repository-version
+type RepositoryFormatVersion string
+
+const (
+	// Version_0 is the format defined by the initial version of git,
+	// including but not limited to the format of the repository
+	// directory, the repository configuration file, and the object
+	// and ref storage.
+	//
+	// Specifying the complete behavior of git is beyond the scope
+	// of this document.
+	Version_0 = "0"
+
+	// Version_1 is identical to version 0, with the following exceptions:
+	//
+	//   1. When reading the core.repositoryformatversion variable, a git
+	//		implementation which supports version 1 MUST also read any
+	//		configuration keys found in the extensions section of the
+	//		configuration file.
+	//
+	//	 2. If a version-1 repository specifies any extensions.* keys that
+	//		the running git has not implemented, the operation MUST NOT proceed.
+	//		Similarly, if the value of any known key is not understood by the
+	//		implementation, the operation MUST NOT proceed.
+	//
+	// Note that if no extensions are specified in the config file, then
+	// core.repositoryformatversion SHOULD be set to 0 (setting it to 1 provides
+	// no benefit, and makes the repository incompatible with older
+	// implementations of git).
+	Version_1 = "1"
+
+	// DefaultRepositoryFormatVersion holds the default repository format version.
+	DefaultRepositoryFormatVersion = Version_0
+)
+
+// ObjectFormat defines the object format.
+type ObjectFormat string
+
+const (
+	// SHA1 represents the object format used for SHA1.
+	SHA1 ObjectFormat = "sha1"
+
+	// SHA256 represents the object format used for SHA256.
+	SHA256 ObjectFormat = "sha256"
+
+	// DefaultObjectFormat holds the default object format.
+	DefaultObjectFormat = SHA1
+)
diff --git a/plumbing/format/config/section.go b/plumbing/format/config/section.go
index 07f72f3..4625ac5 100644
--- a/plumbing/format/config/section.go
+++ b/plumbing/format/config/section.go
@@ -103,7 +103,7 @@ func (s *Section) RemoveSubsection(name string) *Section {
 	return s
 }
 
-// Option return the value for the specified key. Empty string is returned if
+// Option returns the value for the specified key. Empty string is returned if
 // key does not exists.
 func (s *Section) Option(key string) string {
 	return s.Options.Get(key)
diff --git a/plumbing/format/diff/patch.go b/plumbing/format/diff/patch.go
index 39a66a1..c7678b0 100644
--- a/plumbing/format/diff/patch.go
+++ b/plumbing/format/diff/patch.go
@@ -9,7 +9,7 @@ import (
 type Operation int
 
 const (
-	// Equal item represents a equals diff.
+	// Equal item represents an equals diff.
 	Equal Operation = iota
 	// Add item represents an insert diff.
 	Add
@@ -26,15 +26,15 @@ type Patch interface {
 	Message() string
 }
 
-// FilePatch represents the necessary steps to transform one file to another.
+// FilePatch represents the necessary steps to transform one file into another.
 type FilePatch interface {
 	// IsBinary returns true if this patch is representing a binary file.
 	IsBinary() bool
-	// Files returns the from and to Files, with all the necessary metadata to
+	// Files returns the from and to Files, with all the necessary metadata
 	// about them. If the patch creates a new file, "from" will be nil.
 	// If the patch deletes a file, "to" will be nil.
 	Files() (from, to File)
-	// Chunks returns a slice of ordered changes to transform "from" File to
+	// Chunks returns a slice of ordered changes to transform "from" File into
 	// "to" File. If the file is a binary one, Chunks will be empty.
 	Chunks() []Chunk
 }
@@ -49,7 +49,7 @@ type File interface {
 	Path() string
 }
 
-// Chunk represents a portion of a file transformation to another.
+// Chunk represents a portion of a file transformation into another.
 type Chunk interface {
 	// Content contains the portion of the file.
 	Content() string
diff --git a/plumbing/format/gitattributes/attributes.go b/plumbing/format/gitattributes/attributes.go
index 329e667..d36ec1b 100644
--- a/plumbing/format/gitattributes/attributes.go
+++ b/plumbing/format/gitattributes/attributes.go
@@ -3,7 +3,6 @@ package gitattributes
 import (
 	"errors"
 	"io"
-	"io/ioutil"
 	"strings"
 )
 
@@ -89,7 +88,7 @@ func (a attribute) String() string {
 
 // ReadAttributes reads patterns and attributes from the gitattributes format.
 func ReadAttributes(r io.Reader, domain []string, allowMacro bool) (attributes []MatchAttribute, err error) {
-	data, err := ioutil.ReadAll(r)
+	data, err := io.ReadAll(r)
 	if err != nil {
 		return nil, err
 	}
diff --git a/plumbing/format/gitattributes/pattern.go b/plumbing/format/gitattributes/pattern.go
index d961aba..f101f47 100644
--- a/plumbing/format/gitattributes/pattern.go
+++ b/plumbing/format/gitattributes/pattern.go
@@ -52,6 +52,11 @@ func (p *pattern) Match(path []string) bool {
 	var match, doublestar bool
 	var err error
 	for _, part := range path {
+		// path is deeper than pattern
+		if len(pattern) == 0 {
+			return false
+		}
+
 		// skip empty
 		if pattern[0] == "" {
 			pattern = pattern[1:]
diff --git a/plumbing/format/gitattributes/pattern_test.go b/plumbing/format/gitattributes/pattern_test.go
index f95be6e..981d56f 100644
--- a/plumbing/format/gitattributes/pattern_test.go
+++ b/plumbing/format/gitattributes/pattern_test.go
@@ -174,6 +174,12 @@ func (s *PatternSuite) TestGlobMatch_tailingAsterisks_single(c *C) {
 	c.Assert(r, Equals, true)
 }
 
+func (s *PatternSuite) TestGlobMatch_tailingAsterisk_single(c *C) {
+	p := ParsePattern("/*lue/*", nil)
+	r := p.Match([]string{"value", "volcano", "tail"})
+	c.Assert(r, Equals, false)
+}
+
 func (s *PatternSuite) TestGlobMatch_tailingAsterisks_exactMatch(c *C) {
 	p := ParsePattern("/*lue/vol?ano/**", nil)
 	r := p.Match([]string{"value", "volcano"})
diff --git a/plumbing/format/gitignore/dir.go b/plumbing/format/gitignore/dir.go
index 15bc9c7..d8fb30c 100644
--- a/plumbing/format/gitignore/dir.go
+++ b/plumbing/format/gitignore/dir.go
@@ -3,11 +3,12 @@ package gitignore
 import (
 	"bufio"
 	"bytes"
-	"io/ioutil"
+	"io"
 	"os"
 	"strings"
 
 	"github.com/go-git/go-billy/v5"
+	"github.com/go-git/go-git/v5/internal/path_util"
 	"github.com/go-git/go-git/v5/plumbing/format/config"
 	gioutil "github.com/go-git/go-git/v5/utils/ioutil"
 )
@@ -25,6 +26,9 @@ const (
 
 // readIgnoreFile reads a specific git ignore file.
 func readIgnoreFile(fs billy.Filesystem, path []string, ignoreFile string) (ps []Pattern, err error) {
+
+	ignoreFile, _ = path_util.ReplaceTildeWithHome(ignoreFile)
+
 	f, err := fs.Open(fs.Join(append(path, ignoreFile)...))
 	if err == nil {
 		defer f.Close()
@@ -86,7 +90,7 @@ func loadPatterns(fs billy.Filesystem, path string) (ps []Pattern, err error) {
 
 	defer gioutil.CheckClose(f, &err)
 
-	b, err := ioutil.ReadAll(f)
+	b, err := io.ReadAll(f)
 	if err != nil {
 		return
 	}
diff --git a/plumbing/format/gitignore/dir_test.go b/plumbing/format/gitignore/dir_test.go
index facc36d..465c571 100644
--- a/plumbing/format/gitignore/dir_test.go
+++ b/plumbing/format/gitignore/dir_test.go
@@ -2,7 +2,9 @@ package gitignore
 
 import (
 	"os"
+	"os/user"
 	"strconv"
+	"strings"
 
 	"github.com/go-git/go-billy/v5"
 	"github.com/go-git/go-billy/v5/memfs"
@@ -12,6 +14,8 @@ import (
 type MatcherSuite struct {
 	GFS  billy.Filesystem // git repository root
 	RFS  billy.Filesystem // root that contains user home
+	RFSR billy.Filesystem // root that contains user home, but with relative ~/.gitignore_global
+	RFSU billy.Filesystem // root that contains user home, but with relative ~user/.gitignore_global
 	MCFS billy.Filesystem // root that contains user home, but missing ~/.gitconfig
 	MEFS billy.Filesystem // root that contains user home, but missing excludesfile entry
 	MIFS billy.Filesystem // root that contains user home, but missing .gitignore
@@ -63,6 +67,27 @@ func (s *MatcherSuite) SetUpTest(c *C) {
 	err = fs.MkdirAll("vendor/gopkg.in", os.ModePerm)
 	c.Assert(err, IsNil)
 
+	err = fs.MkdirAll("multiple/sub/ignores/first", os.ModePerm)
+	c.Assert(err, IsNil)
+	err = fs.MkdirAll("multiple/sub/ignores/second", os.ModePerm)
+	c.Assert(err, IsNil)
+	f, err = fs.Create("multiple/sub/ignores/first/.gitignore")
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("ignore_dir\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+	f, err = fs.Create("multiple/sub/ignores/second/.gitignore")
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("ignore_dir\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+	err = fs.MkdirAll("multiple/sub/ignores/first/ignore_dir", os.ModePerm)
+	c.Assert(err, IsNil)
+	err = fs.MkdirAll("multiple/sub/ignores/second/ignore_dir", os.ModePerm)
+	c.Assert(err, IsNil)
+
 	s.GFS = fs
 
 	// setup root that contains user home
@@ -95,6 +120,64 @@ func (s *MatcherSuite) SetUpTest(c *C) {
 
 	s.RFS = fs
 
+	// root that contains user home, but with relative ~/.gitignore_global
+	fs = memfs.New()
+	err = fs.MkdirAll(home, os.ModePerm)
+	c.Assert(err, IsNil)
+
+	f, err = fs.Create(fs.Join(home, gitconfigFile))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("[core]\n"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("	excludesfile = ~/.gitignore_global" + "\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+
+	f, err = fs.Create(fs.Join(home, ".gitignore_global"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("# IntelliJ\n"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte(".idea/\n"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("*.iml\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+
+	s.RFSR = fs
+
+	// root that contains user home, but with relative ~user/.gitignore_global
+	fs = memfs.New()
+	err = fs.MkdirAll(home, os.ModePerm)
+	c.Assert(err, IsNil)
+
+	f, err = fs.Create(fs.Join(home, gitconfigFile))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("[core]\n"))
+	c.Assert(err, IsNil)
+	currentUser, err := user.Current()
+	c.Assert(err, IsNil)
+	// remove domain for windows
+	username := currentUser.Username[strings.Index(currentUser.Username, "\\")+1:]
+	_, err = f.Write([]byte("	excludesfile = ~" + username + "/.gitignore_global" + "\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+
+	f, err = fs.Create(fs.Join(home, ".gitignore_global"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("# IntelliJ\n"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte(".idea/\n"))
+	c.Assert(err, IsNil)
+	_, err = f.Write([]byte("*.iml\n"))
+	c.Assert(err, IsNil)
+	err = f.Close()
+	c.Assert(err, IsNil)
+
+	s.RFSU = fs
+
 	// root that contains user home, but missing ~/.gitconfig
 	fs = memfs.New()
 	err = fs.MkdirAll(home, os.ModePerm)
@@ -183,15 +266,39 @@ func (s *MatcherSuite) SetUpTest(c *C) {
 }
 
 func (s *MatcherSuite) TestDir_ReadPatterns(c *C) {
+	checkPatterns := func(ps []Pattern) {
+		c.Assert(ps, HasLen, 6)
+		m := NewMatcher(ps)
+
+		c.Assert(m.Match([]string{"exclude.crlf"}, true), Equals, true)
+		c.Assert(m.Match([]string{"ignore.crlf"}, true), Equals, true)
+		c.Assert(m.Match([]string{"vendor", "gopkg.in"}, true), Equals, true)
+		c.Assert(m.Match([]string{"vendor", "github.com"}, true), Equals, false)
+		c.Assert(m.Match([]string{"multiple", "sub", "ignores", "first", "ignore_dir"}, true), Equals, true)
+		c.Assert(m.Match([]string{"multiple", "sub", "ignores", "second", "ignore_dir"}, true), Equals, true)
+	}
+
 	ps, err := ReadPatterns(s.GFS, nil)
 	c.Assert(err, IsNil)
-	c.Assert(ps, HasLen, 4)
+	checkPatterns(ps)
 
-	m := NewMatcher(ps)
-	c.Assert(m.Match([]string{"exclude.crlf"}, true), Equals, true)
-	c.Assert(m.Match([]string{"ignore.crlf"}, true), Equals, true)
-	c.Assert(m.Match([]string{"vendor", "gopkg.in"}, true), Equals, true)
-	c.Assert(m.Match([]string{"vendor", "github.com"}, true), Equals, false)
+	// passing an empty slice with capacity to check we don't hit a bug where the extra capacity is reused incorrectly
+	ps, err = ReadPatterns(s.GFS, make([]string, 0, 6))
+	c.Assert(err, IsNil)
+	checkPatterns(ps)
+}
+
+func (s *MatcherSuite) TestDir_ReadRelativeGlobalGitIgnore(c *C) {
+	for _, fs := range []billy.Filesystem{s.RFSR, s.RFSU} {
+		ps, err := LoadGlobalPatterns(fs)
+		c.Assert(err, IsNil)
+		c.Assert(ps, HasLen, 2)
+
+		m := NewMatcher(ps)
+		c.Assert(m.Match([]string{".idea/"}, true), Equals, false)
+		c.Assert(m.Match([]string{"*.iml"}, true), Equals, true)
+		c.Assert(m.Match([]string{"IntelliJ"}, true), Equals, false)
+	}
 }
 
 func (s *MatcherSuite) TestDir_LoadGlobalPatterns(c *C) {
diff --git a/plumbing/format/gitignore/pattern.go b/plumbing/format/gitignore/pattern.go
index 098cb50..450b3cd 100644
--- a/plumbing/format/gitignore/pattern.go
+++ b/plumbing/format/gitignore/pattern.go
@@ -39,6 +39,8 @@ type pattern struct {
 
 // ParsePattern parses a gitignore pattern string into the Pattern structure.
 func ParsePattern(p string, domain []string) Pattern {
+	// storing domain, copy it to ensure it isn't changed externally
+	domain = append([]string(nil), domain...)
 	res := pattern{domain: domain}
 
 	if strings.HasPrefix(p, inclusionPrefix) {
diff --git a/plumbing/format/idxfile/decoder.go b/plumbing/format/idxfile/decoder.go
index 51a3904..9afdce3 100644
--- a/plumbing/format/idxfile/decoder.go
+++ b/plumbing/format/idxfile/decoder.go
@@ -6,6 +6,7 @@ import (
 	"errors"
 	"io"
 
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
 )
 
@@ -19,7 +20,7 @@ var (
 
 const (
 	fanout         = 256
-	objectIDLength = 20
+	objectIDLength = hash.Size
 )
 
 // Decoder reads and decodes idx files from an input stream.
diff --git a/plumbing/format/idxfile/decoder_test.go b/plumbing/format/idxfile/decoder_test.go
index 94059cc..2c4a801 100644
--- a/plumbing/format/idxfile/decoder_test.go
+++ b/plumbing/format/idxfile/decoder_test.go
@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 	"testing"
 
 	"github.com/go-git/go-git/v5/plumbing"
@@ -119,7 +118,7 @@ ch2xUA==
 
 func BenchmarkDecode(b *testing.B) {
 	f := fixtures.Basic().One()
-	fixture, err := ioutil.ReadAll(f.Idx())
+	fixture, err := io.ReadAll(f.Idx())
 	if err != nil {
 		b.Errorf("unexpected error reading idx file: %s", err)
 	}
diff --git a/plumbing/format/idxfile/encoder.go b/plumbing/format/idxfile/encoder.go
index 26b2e4d..7514737 100644
--- a/plumbing/format/idxfile/encoder.go
+++ b/plumbing/format/idxfile/encoder.go
@@ -1,10 +1,9 @@
 package idxfile
 
 import (
-	"crypto/sha1"
-	"hash"
 	"io"
 
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
 )
 
@@ -16,7 +15,7 @@ type Encoder struct {
 
 // NewEncoder returns a new stream encoder that writes to w.
 func NewEncoder(w io.Writer) *Encoder {
-	h := sha1.New()
+	h := hash.New(hash.CryptoType)
 	mw := io.MultiWriter(w, h)
 	return &Encoder{mw, h}
 }
@@ -133,10 +132,10 @@ func (e *Encoder) encodeChecksums(idx *MemoryIndex) (int, error) {
 		return 0, err
 	}
 
-	copy(idx.IdxChecksum[:], e.hash.Sum(nil)[:20])
+	copy(idx.IdxChecksum[:], e.hash.Sum(nil)[:hash.Size])
 	if _, err := e.Write(idx.IdxChecksum[:]); err != nil {
 		return 0, err
 	}
 
-	return 40, nil
+	return hash.HexSize, nil
 }
diff --git a/plumbing/format/idxfile/encoder_test.go b/plumbing/format/idxfile/encoder_test.go
index 32b60f9..b8ece83 100644
--- a/plumbing/format/idxfile/encoder_test.go
+++ b/plumbing/format/idxfile/encoder_test.go
@@ -2,7 +2,7 @@ package idxfile_test
 
 import (
 	"bytes"
-	"io/ioutil"
+	"io"
 
 	. "github.com/go-git/go-git/v5/plumbing/format/idxfile"
 
@@ -12,7 +12,7 @@ import (
 
 func (s *IdxfileSuite) TestDecodeEncode(c *C) {
 	fixtures.ByTag("packfile").Test(c, func(f *fixtures.Fixture) {
-		expected, err := ioutil.ReadAll(f.Idx())
+		expected, err := io.ReadAll(f.Idx())
 		c.Assert(err, IsNil)
 
 		idx := new(MemoryIndex)
diff --git a/plumbing/format/idxfile/idxfile.go b/plumbing/format/idxfile/idxfile.go
index 64dd8dc..9237a74 100644
--- a/plumbing/format/idxfile/idxfile.go
+++ b/plumbing/format/idxfile/idxfile.go
@@ -8,6 +8,7 @@ import (
 	encbin "encoding/binary"
 
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 )
 
 const (
@@ -53,8 +54,8 @@ type MemoryIndex struct {
 	Offset32         [][]byte
 	CRC32            [][]byte
 	Offset64         []byte
-	PackfileChecksum [20]byte
-	IdxChecksum      [20]byte
+	PackfileChecksum [hash.Size]byte
+	IdxChecksum      [hash.Size]byte
 
 	offsetHash       map[int64]plumbing.Hash
 	offsetHashIsFull bool
diff --git a/plumbing/format/idxfile/writer.go b/plumbing/format/idxfile/writer.go
index daa1605..c4c21e1 100644
--- a/plumbing/format/idxfile/writer.go
+++ b/plumbing/format/idxfile/writer.go
@@ -84,11 +84,8 @@ func (w *Writer) OnFooter(h plumbing.Hash) error {
 	w.checksum = h
 	w.finished = true
 	_, err := w.createIndex()
-	if err != nil {
-		return err
-	}
 
-	return nil
+	return err
 }
 
 // creatIndex returns a filled MemoryIndex with the information filled by
@@ -139,15 +136,23 @@ func (w *Writer) createIndex() (*MemoryIndex, error) {
 
 		offset := o.Offset
 		if offset > math.MaxInt32 {
-			offset = w.addOffset64(offset)
+			var err error
+			offset, err = w.addOffset64(offset)
+			if err != nil {
+				return nil, err
+			}
 		}
 
 		buf.Truncate(0)
-		binary.WriteUint32(buf, uint32(offset))
+		if err := binary.WriteUint32(buf, uint32(offset)); err != nil {
+			return nil, err
+		}
 		idx.Offset32[bucket] = append(idx.Offset32[bucket], buf.Bytes()...)
 
 		buf.Truncate(0)
-		binary.WriteUint32(buf, o.CRC32)
+		if err := binary.WriteUint32(buf, o.CRC32); err != nil {
+			return nil, err
+		}
 		idx.CRC32[bucket] = append(idx.CRC32[bucket], buf.Bytes()...)
 	}
 
@@ -161,15 +166,17 @@ func (w *Writer) createIndex() (*MemoryIndex, error) {
 	return idx, nil
 }
 
-func (w *Writer) addOffset64(pos uint64) uint64 {
+func (w *Writer) addOffset64(pos uint64) (uint64, error) {
 	buf := new(bytes.Buffer)
-	binary.WriteUint64(buf, pos)
-	w.index.Offset64 = append(w.index.Offset64, buf.Bytes()...)
+	if err := binary.WriteUint64(buf, pos); err != nil {
+		return 0, err
+	}
 
+	w.index.Offset64 = append(w.index.Offset64, buf.Bytes()...)
 	index := uint64(w.offset64 | (1 << 31))
 	w.offset64++
 
-	return index
+	return index, nil
 }
 
 func (o objects) Len() int {
diff --git a/plumbing/format/idxfile/writer_test.go b/plumbing/format/idxfile/writer_test.go
index fba3e42..eaa8605 100644
--- a/plumbing/format/idxfile/writer_test.go
+++ b/plumbing/format/idxfile/writer_test.go
@@ -3,7 +3,7 @@ package idxfile_test
 import (
 	"bytes"
 	"encoding/base64"
-	"io/ioutil"
+	"io"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/idxfile"
@@ -34,7 +34,7 @@ func (s *WriterSuite) TestWriter(c *C) {
 	c.Assert(err, IsNil)
 
 	idxFile := f.Idx()
-	expected, err := ioutil.ReadAll(idxFile)
+	expected, err := io.ReadAll(idxFile)
 	c.Assert(err, IsNil)
 	idxFile.Close()
 
@@ -65,7 +65,7 @@ func (s *WriterSuite) TestWriterLarge(c *C) {
 
 	// load fixture index
 	f := bytes.NewBufferString(fixtureLarge4GB)
-	expected, err := ioutil.ReadAll(base64.NewDecoder(base64.StdEncoding, f))
+	expected, err := io.ReadAll(base64.NewDecoder(base64.StdEncoding, f))
 	c.Assert(err, IsNil)
 
 	buf := new(bytes.Buffer)
diff --git a/plumbing/format/index/decoder.go b/plumbing/format/index/decoder.go
index 036b636..6778cf7 100644
--- a/plumbing/format/index/decoder.go
+++ b/plumbing/format/index/decoder.go
@@ -3,15 +3,14 @@ package index
 import (
 	"bufio"
 	"bytes"
-	"crypto/sha1"
 	"errors"
-	"hash"
 	"io"
-	"io/ioutil"
+
 	"strconv"
 	"time"
 
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
 )
 
@@ -49,7 +48,7 @@ type Decoder struct {
 
 // NewDecoder returns a new decoder that reads from r.
 func NewDecoder(r io.Reader) *Decoder {
-	h := sha1.New()
+	h := hash.New(hash.CryptoType)
 	return &Decoder{
 		r:         io.TeeReader(r, h),
 		hash:      h,
@@ -202,7 +201,7 @@ func (d *Decoder) padEntry(idx *Index, e *Entry, read int) error {
 
 	entrySize := read + len(e.Name)
 	padLen := 8 - entrySize%8
-	_, err := io.CopyN(ioutil.Discard, d.r, int64(padLen))
+	_, err := io.CopyN(io.Discard, d.r, int64(padLen))
 	return err
 }
 
diff --git a/plumbing/format/index/encoder.go b/plumbing/format/index/encoder.go
index 2c94d93..fa2d814 100644
--- a/plumbing/format/index/encoder.go
+++ b/plumbing/format/index/encoder.go
@@ -2,13 +2,12 @@ package index
 
 import (
 	"bytes"
-	"crypto/sha1"
 	"errors"
-	"hash"
 	"io"
 	"sort"
 	"time"
 
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/utils/binary"
 )
 
@@ -29,7 +28,7 @@ type Encoder struct {
 
 // NewEncoder returns a new encoder that writes to w.
 func NewEncoder(w io.Writer) *Encoder {
-	h := sha1.New()
+	h := hash.New(hash.CryptoType)
 	mw := io.MultiWriter(w, h)
 	return &Encoder{mw, h}
 }
diff --git a/plumbing/format/objfile/reader.go b/plumbing/format/objfile/reader.go
index b6b2ca0..d7932f4 100644
--- a/plumbing/format/objfile/reader.go
+++ b/plumbing/format/objfile/reader.go
@@ -1,13 +1,13 @@
 package objfile
 
 import (
-	"compress/zlib"
 	"errors"
 	"io"
 	"strconv"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/packfile"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 var (
@@ -20,20 +20,22 @@ var (
 // Reader implements io.ReadCloser. Close should be called when finished with
 // the Reader. Close will not close the underlying io.Reader.
 type Reader struct {
-	multi  io.Reader
-	zlib   io.ReadCloser
-	hasher plumbing.Hasher
+	multi   io.Reader
+	zlib    io.Reader
+	zlibref sync.ZLibReader
+	hasher  plumbing.Hasher
 }
 
 // NewReader returns a new Reader reading from r.
 func NewReader(r io.Reader) (*Reader, error) {
-	zlib, err := zlib.NewReader(r)
+	zlib, err := sync.GetZlibReader(r)
 	if err != nil {
 		return nil, packfile.ErrZLib.AddDetails(err.Error())
 	}
 
 	return &Reader{
-		zlib: zlib,
+		zlib:    zlib.Reader,
+		zlibref: zlib,
 	}, nil
 }
 
@@ -110,5 +112,6 @@ func (r *Reader) Hash() plumbing.Hash {
 // Close releases any resources consumed by the Reader. Calling Close does not
 // close the wrapped io.Reader originally passed to NewReader.
 func (r *Reader) Close() error {
-	return r.zlib.Close()
+	sync.PutZlibReader(r.zlibref)
+	return nil
 }
diff --git a/plumbing/format/objfile/reader_test.go b/plumbing/format/objfile/reader_test.go
index d697d54..5526f7f 100644
--- a/plumbing/format/objfile/reader_test.go
+++ b/plumbing/format/objfile/reader_test.go
@@ -5,7 +5,6 @@ import (
 	"encoding/base64"
 	"fmt"
 	"io"
-	"io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 
@@ -36,7 +35,7 @@ func testReader(c *C, source io.Reader, hash plumbing.Hash, t plumbing.ObjectTyp
 	c.Assert(typ, Equals, t)
 	c.Assert(content, HasLen, int(size))
 
-	rc, err := ioutil.ReadAll(r)
+	rc, err := io.ReadAll(r)
 	c.Assert(err, IsNil)
 	c.Assert(rc, DeepEquals, content, Commentf("%scontent=%s, expected=%s", base64.StdEncoding.EncodeToString(rc), base64.StdEncoding.EncodeToString(content)))
 
diff --git a/plumbing/format/objfile/writer.go b/plumbing/format/objfile/writer.go
index 2a96a43..0d0f154 100644
--- a/plumbing/format/objfile/writer.go
+++ b/plumbing/format/objfile/writer.go
@@ -7,6 +7,7 @@ import (
 	"strconv"
 
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 var (
@@ -18,9 +19,9 @@ var (
 // not close the underlying io.Writer.
 type Writer struct {
 	raw    io.Writer
-	zlib   io.WriteCloser
 	hasher plumbing.Hasher
 	multi  io.Writer
+	zlib   *zlib.Writer
 
 	closed  bool
 	pending int64 // number of unwritten bytes
@@ -31,9 +32,10 @@ type Writer struct {
 // The returned Writer implements io.WriteCloser. Close should be called when
 // finished with the Writer. Close will not close the underlying io.Writer.
 func NewWriter(w io.Writer) *Writer {
+	zlib := sync.GetZlibWriter(w)
 	return &Writer{
 		raw:  w,
-		zlib: zlib.NewWriter(w),
+		zlib: zlib,
 	}
 }
 
@@ -100,6 +102,7 @@ func (w *Writer) Hash() plumbing.Hash {
 // Calling Close does not close the wrapped io.Writer originally passed to
 // NewWriter.
 func (w *Writer) Close() error {
+	defer sync.PutZlibWriter(w.zlib)
 	if err := w.zlib.Close(); err != nil {
 		return err
 	}
diff --git a/plumbing/format/packfile/common.go b/plumbing/format/packfile/common.go
index df423ad..36c5ef5 100644
--- a/plumbing/format/packfile/common.go
+++ b/plumbing/format/packfile/common.go
@@ -1,10 +1,7 @@
 package packfile
 
 import (
-	"bytes"
-	"compress/zlib"
 	"io"
-	"sync"
 
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
@@ -61,18 +58,3 @@ func WritePackfileToObjectStorage(
 
 	return err
 }
-
-var bufPool = sync.Pool{
-	New: func() interface{} {
-		return bytes.NewBuffer(nil)
-	},
-}
-
-var zlibInitBytes = []byte{0x78, 0x9c, 0x01, 0x00, 0x00, 0xff, 0xff, 0x00, 0x00, 0x00, 0x01}
-
-var zlibReaderPool = sync.Pool{
-	New: func() interface{} {
-		r, _ := zlib.NewReader(bytes.NewReader(zlibInitBytes))
-		return r
-	},
-}
diff --git a/plumbing/format/packfile/delta_test.go b/plumbing/format/packfile/delta_test.go
index 137e485..e8f5ea6 100644
--- a/plumbing/format/packfile/delta_test.go
+++ b/plumbing/format/packfile/delta_test.go
@@ -2,7 +2,7 @@ package packfile
 
 import (
 	"bytes"
-	"io/ioutil"
+	"io"
 	"math/rand"
 
 	"github.com/go-git/go-git/v5/plumbing"
@@ -109,14 +109,14 @@ func (s *DeltaSuite) TestAddDeltaReader(c *C) {
 		targetBuf := genBytes(t.target)
 
 		delta := DiffDelta(baseBuf, targetBuf)
-		deltaRC := ioutil.NopCloser(bytes.NewReader(delta))
+		deltaRC := io.NopCloser(bytes.NewReader(delta))
 
 		c.Log("Executing test case:", t.description)
 
 		resultRC, err := ReaderFromDelta(baseObj, deltaRC)
 		c.Assert(err, IsNil)
 
-		result, err := ioutil.ReadAll(resultRC)
+		result, err := io.ReadAll(resultRC)
 		c.Assert(err, IsNil)
 
 		err = resultRC.Close()
@@ -164,12 +164,12 @@ func (s *DeltaSuite) TestMaxCopySizeDeltaReader(c *C) {
 	targetBuf = append(targetBuf, byte(1))
 
 	delta := DiffDelta(baseBuf, targetBuf)
-	deltaRC := ioutil.NopCloser(bytes.NewReader(delta))
+	deltaRC := io.NopCloser(bytes.NewReader(delta))
 
 	resultRC, err := ReaderFromDelta(baseObj, deltaRC)
 	c.Assert(err, IsNil)
 
-	result, err := ioutil.ReadAll(resultRC)
+	result, err := io.ReadAll(resultRC)
 	c.Assert(err, IsNil)
 
 	err = resultRC.Close()
diff --git a/plumbing/format/packfile/diff_delta.go b/plumbing/format/packfile/diff_delta.go
index 1951b34..2c7a335 100644
--- a/plumbing/format/packfile/diff_delta.go
+++ b/plumbing/format/packfile/diff_delta.go
@@ -5,6 +5,7 @@ import (
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 // See https://github.com/jelmer/dulwich/blob/master/dulwich/pack.py and
@@ -43,18 +44,16 @@ func getDelta(index *deltaIndex, base, target plumbing.EncodedObject) (o plumbin
 
 	defer ioutil.CheckClose(tr, &err)
 
-	bb := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(bb)
-	bb.Reset()
+	bb := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(bb)
 
 	_, err = bb.ReadFrom(br)
 	if err != nil {
 		return nil, err
 	}
 
-	tb := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(tb)
-	tb.Reset()
+	tb := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(tb)
 
 	_, err = tb.ReadFrom(tr)
 	if err != nil {
@@ -80,9 +79,8 @@ func DiffDelta(src, tgt []byte) []byte {
 }
 
 func diffDelta(index *deltaIndex, src []byte, tgt []byte) []byte {
-	buf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(buf)
-	buf.Reset()
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
 	buf.Write(deltaEncodeSize(len(src)))
 	buf.Write(deltaEncodeSize(len(tgt)))
 
@@ -90,9 +88,8 @@ func diffDelta(index *deltaIndex, src []byte, tgt []byte) []byte {
 		index.init(src)
 	}
 
-	ibuf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(ibuf)
-	ibuf.Reset()
+	ibuf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(ibuf)
 	for i := 0; i < len(tgt); i++ {
 		offset, l := index.findMatch(src, tgt, i)
 
diff --git a/plumbing/format/packfile/encoder.go b/plumbing/format/packfile/encoder.go
index 5501f88..804f5a8 100644
--- a/plumbing/format/packfile/encoder.go
+++ b/plumbing/format/packfile/encoder.go
@@ -2,11 +2,11 @@ package packfile
 
 import (
 	"compress/zlib"
-	"crypto/sha1"
 	"fmt"
 	"io"
 
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/binary"
 	"github.com/go-git/go-git/v5/utils/ioutil"
@@ -28,7 +28,7 @@ type Encoder struct {
 // OFSDeltaObject. To use Reference deltas, set useRefDeltas to true.
 func NewEncoder(w io.Writer, s storer.EncodedObjectStorer, useRefDeltas bool) *Encoder {
 	h := plumbing.Hasher{
-		Hash: sha1.New(),
+		Hash: hash.New(hash.CryptoType),
 	}
 	mw := io.MultiWriter(w, h)
 	ow := newOffsetWriter(mw)
@@ -131,11 +131,7 @@ func (e *Encoder) entry(o *ObjectToPack) (err error) {
 	defer ioutil.CheckClose(or, &err)
 
 	_, err = io.Copy(e.zw, or)
-	if err != nil {
-		return err
-	}
-
-	return nil
+	return err
 }
 
 func (e *Encoder) writeBaseIfDelta(o *ObjectToPack) error {
diff --git a/plumbing/format/packfile/encoder_test.go b/plumbing/format/packfile/encoder_test.go
index c9d49c3..6719f37 100644
--- a/plumbing/format/packfile/encoder_test.go
+++ b/plumbing/format/packfile/encoder_test.go
@@ -3,10 +3,10 @@ package packfile
 import (
 	"bytes"
 	"io"
-	stdioutil "io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/idxfile"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/storage/memory"
 
 	"github.com/go-git/go-billy/v5/memfs"
@@ -30,10 +30,10 @@ func (s *EncoderSuite) SetUpTest(c *C) {
 }
 
 func (s *EncoderSuite) TestCorrectPackHeader(c *C) {
-	hash, err := s.enc.Encode([]plumbing.Hash{}, 10)
+	h, err := s.enc.Encode([]plumbing.Hash{}, 10)
 	c.Assert(err, IsNil)
 
-	hb := [20]byte(hash)
+	hb := [hash.Size]byte(h)
 
 	// PACK + VERSION + OBJECTS + HASH
 	expectedResult := []byte{'P', 'A', 'C', 'K', 0, 0, 0, 2, 0, 0, 0, 0}
@@ -51,7 +51,7 @@ func (s *EncoderSuite) TestCorrectPackWithOneEmptyObject(c *C) {
 	_, err := s.store.SetEncodedObject(o)
 	c.Assert(err, IsNil)
 
-	hash, err := s.enc.Encode([]plumbing.Hash{o.Hash()}, 10)
+	h, err := s.enc.Encode([]plumbing.Hash{o.Hash()}, 10)
 	c.Assert(err, IsNil)
 
 	// PACK + VERSION(2) + OBJECT NUMBER(1)
@@ -64,7 +64,7 @@ func (s *EncoderSuite) TestCorrectPackWithOneEmptyObject(c *C) {
 		[]byte{120, 156, 1, 0, 0, 255, 255, 0, 0, 0, 1}...)
 
 	// + HASH
-	hb := [20]byte(hash)
+	hb := [hash.Size]byte(h)
 	expectedResult = append(expectedResult, hb[:]...)
 
 	result := s.buf.Bytes()
@@ -277,13 +277,13 @@ func objectsEqual(c *C, o1, o2 plumbing.EncodedObject) {
 	r1, err := o1.Reader()
 	c.Assert(err, IsNil)
 
-	b1, err := stdioutil.ReadAll(r1)
+	b1, err := io.ReadAll(r1)
 	c.Assert(err, IsNil)
 
 	r2, err := o2.Reader()
 	c.Assert(err, IsNil)
 
-	b2, err := stdioutil.ReadAll(r2)
+	b2, err := io.ReadAll(r2)
 	c.Assert(err, IsNil)
 
 	c.Assert(bytes.Compare(b1, b2), Equals, 0)
diff --git a/plumbing/format/packfile/packfile.go b/plumbing/format/packfile/packfile.go
index 8dd6041..6852702 100644
--- a/plumbing/format/packfile/packfile.go
+++ b/plumbing/format/packfile/packfile.go
@@ -2,7 +2,6 @@ package packfile
 
 import (
 	"bytes"
-	"compress/zlib"
 	"fmt"
 	"io"
 	"os"
@@ -13,6 +12,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/format/idxfile"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 var (
@@ -138,9 +138,8 @@ func (p *Packfile) getObjectSize(h *ObjectHeader) (int64, error) {
 	case plumbing.CommitObject, plumbing.TreeObject, plumbing.BlobObject, plumbing.TagObject:
 		return h.Length, nil
 	case plumbing.REFDeltaObject, plumbing.OFSDeltaObject:
-		buf := bufPool.Get().(*bytes.Buffer)
-		defer bufPool.Put(buf)
-		buf.Reset()
+		buf := sync.GetBytesBuffer()
+		defer sync.PutBytesBuffer(buf)
 
 		if _, _, err := p.s.NextObject(buf); err != nil {
 			return 0, err
@@ -227,9 +226,9 @@ func (p *Packfile) getNextObject(h *ObjectHeader, hash plumbing.Hash) (plumbing.
 		// For delta objects we read the delta data and apply the small object
 		// optimization only if the expanded version of the object still meets
 		// the small object threshold condition.
-		buf := bufPool.Get().(*bytes.Buffer)
-		defer bufPool.Put(buf)
-		buf.Reset()
+		buf := sync.GetBytesBuffer()
+		defer sync.PutBytesBuffer(buf)
+
 		if _, _, err := p.s.NextObject(buf); err != nil {
 			return nil, err
 		}
@@ -290,14 +289,13 @@ func (p *Packfile) getObjectContent(offset int64) (io.ReadCloser, error) {
 
 func asyncReader(p *Packfile) (io.ReadCloser, error) {
 	reader := ioutil.NewReaderUsingReaderAt(p.file, p.s.r.offset)
-	zr := zlibReaderPool.Get().(io.ReadCloser)
-
-	if err := zr.(zlib.Resetter).Reset(reader, nil); err != nil {
+	zr, err := sync.GetZlibReader(reader)
+	if err != nil {
 		return nil, fmt.Errorf("zlib reset error: %s", err)
 	}
 
-	return ioutil.NewReadCloserWithCloser(zr, func() error {
-		zlibReaderPool.Put(zr)
+	return ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
+		sync.PutZlibReader(zr)
 		return nil
 	}), nil
 
@@ -373,9 +371,9 @@ func (p *Packfile) fillRegularObjectContent(obj plumbing.EncodedObject) (err err
 }
 
 func (p *Packfile) fillREFDeltaObjectContent(obj plumbing.EncodedObject, ref plumbing.Hash) error {
-	buf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(buf)
-	buf.Reset()
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
+
 	_, _, err := p.s.NextObject(buf)
 	if err != nil {
 		return err
@@ -417,9 +415,9 @@ func (p *Packfile) fillREFDeltaObjectContentWithBuffer(obj plumbing.EncodedObjec
 }
 
 func (p *Packfile) fillOFSDeltaObjectContent(obj plumbing.EncodedObject, offset int64) error {
-	buf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(buf)
-	buf.Reset()
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
+
 	_, _, err := p.s.NextObject(buf)
 	if err != nil {
 		return err
diff --git a/plumbing/format/packfile/parser.go b/plumbing/format/packfile/parser.go
index ee5c289..edbc0e7 100644
--- a/plumbing/format/packfile/parser.go
+++ b/plumbing/format/packfile/parser.go
@@ -4,12 +4,12 @@ import (
 	"bytes"
 	"errors"
 	"io"
-	stdioutil "io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/cache"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 var (
@@ -175,7 +175,8 @@ func (p *Parser) init() error {
 }
 
 func (p *Parser) indexObjects() error {
-	buf := new(bytes.Buffer)
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
 
 	for i := uint32(0); i < p.count; i++ {
 		buf.Reset()
@@ -219,6 +220,7 @@ func (p *Parser) indexObjects() error {
 			ota = newBaseObject(oh.Offset, oh.Length, t)
 		}
 
+		buf.Grow(int(oh.Length))
 		_, crc, err := p.scanner.NextObject(buf)
 		if err != nil {
 			return err
@@ -234,6 +236,15 @@ func (p *Parser) indexObjects() error {
 				return err
 			}
 
+			// Move children of placeholder parent into actual parent, in case this
+			// was a non-external delta reference.
+			if placeholder, ok := p.oiByHash[sha1]; ok {
+				ota.Children = placeholder.Children
+				for _, c := range ota.Children {
+					c.Parent = ota
+				}
+			}
+
 			ota.SHA1 = sha1
 			p.oiByHash[ota.SHA1] = ota
 		}
@@ -264,7 +275,9 @@ func (p *Parser) indexObjects() error {
 }
 
 func (p *Parser) resolveDeltas() error {
-	buf := &bytes.Buffer{}
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
+
 	for _, obj := range p.oi {
 		buf.Reset()
 		err := p.get(obj, buf)
@@ -283,9 +296,10 @@ func (p *Parser) resolveDeltas() error {
 
 		if !obj.IsDelta() && len(obj.Children) > 0 {
 			for _, child := range obj.Children {
-				if err := p.resolveObject(stdioutil.Discard, child, content); err != nil {
+				if err := p.resolveObject(io.Discard, child, content); err != nil {
 					return err
 				}
+				p.resolveExternalRef(child)
 			}
 
 			// Remove the delta from the cache.
@@ -298,6 +312,16 @@ func (p *Parser) resolveDeltas() error {
 	return nil
 }
 
+func (p *Parser) resolveExternalRef(o *objectInfo) {
+	if ref, ok := p.oiByHash[o.SHA1]; ok && ref.ExternalRef {
+		p.oiByHash[o.SHA1] = o
+		o.Children = ref.Children
+		for _, c := range o.Children {
+			c.Parent = o
+		}
+	}
+}
+
 func (p *Parser) get(o *objectInfo, buf *bytes.Buffer) (err error) {
 	if !o.ExternalRef { // skip cache check for placeholder parents
 		b, ok := p.cache.Get(o.Offset)
@@ -335,9 +359,8 @@ func (p *Parser) get(o *objectInfo, buf *bytes.Buffer) (err error) {
 	}
 
 	if o.DiskType.IsDelta() {
-		b := bufPool.Get().(*bytes.Buffer)
-		defer bufPool.Put(b)
-		b.Reset()
+		b := sync.GetBytesBuffer()
+		defer sync.PutBytesBuffer(b)
 		err := p.get(o.Parent, b)
 		if err != nil {
 			return err
@@ -371,9 +394,8 @@ func (p *Parser) resolveObject(
 	if !o.DiskType.IsDelta() {
 		return nil
 	}
-	buf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(buf)
-	buf.Reset()
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
 	err := p.readData(buf, o)
 	if err != nil {
 		return err
diff --git a/plumbing/format/packfile/parser_test.go b/plumbing/format/packfile/parser_test.go
index b0b4af8..b8d080f 100644
--- a/plumbing/format/packfile/parser_test.go
+++ b/plumbing/format/packfile/parser_test.go
@@ -10,8 +10,10 @@ import (
 	fixtures "github.com/go-git/go-git-fixtures/v4"
 	"github.com/go-git/go-git/v5"
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/cache"
 	"github.com/go-git/go-git/v5/plumbing/format/packfile"
 	"github.com/go-git/go-git/v5/plumbing/storer"
+	"github.com/go-git/go-git/v5/storage/filesystem"
 	. "gopkg.in/check.v1"
 )
 
@@ -132,6 +134,32 @@ func (s *ParserSuite) TestThinPack(c *C) {
 
 }
 
+func (s *ParserSuite) TestResolveExternalRefsInThinPack(c *C) {
+	extRefsThinPack := fixtures.ByTag("codecommit").One()
+
+	scanner := packfile.NewScanner(extRefsThinPack.Packfile())
+
+	obs := new(testObserver)
+	parser, err := packfile.NewParser(scanner, obs)
+	c.Assert(err, IsNil)
+
+	_, err = parser.Parse()
+	c.Assert(err, IsNil)
+}
+
+func (s *ParserSuite) TestResolveExternalRefs(c *C) {
+	extRefsThinPack := fixtures.ByTag("delta-before-base").One()
+
+	scanner := packfile.NewScanner(extRefsThinPack.Packfile())
+
+	obs := new(testObserver)
+	parser, err := packfile.NewParser(scanner, obs)
+	c.Assert(err, IsNil)
+
+	_, err = parser.Parse()
+	c.Assert(err, IsNil)
+}
+
 type observerObject struct {
 	hash   string
 	otype  plumbing.ObjectType
@@ -235,3 +263,29 @@ func BenchmarkParseBasic(b *testing.B) {
 		}
 	}
 }
+
+func BenchmarkParser(b *testing.B) {
+	f := fixtures.Basic().One()
+	defer fixtures.Clean()
+
+	b.ResetTimer()
+	for n := 0; n < b.N; n++ {
+		b.StopTimer()
+		scanner := packfile.NewScanner(f.Packfile())
+		fs := osfs.New(os.TempDir())
+		storage := filesystem.NewStorage(fs, cache.NewObjectLRUDefault())
+
+		parser, err := packfile.NewParserWithStorage(scanner, storage)
+		if err != nil {
+			b.Error(err)
+		}
+
+		b.StartTimer()
+		_, err = parser.Parse()
+
+		b.StopTimer()
+		if err != nil {
+			b.Error(err)
+		}
+	}
+}
diff --git a/plumbing/format/packfile/patch_delta.go b/plumbing/format/packfile/patch_delta.go
index 17da11e..f00562d 100644
--- a/plumbing/format/packfile/patch_delta.go
+++ b/plumbing/format/packfile/patch_delta.go
@@ -9,6 +9,7 @@ import (
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 // See https://github.com/git/git/blob/49fa3dc76179e04b0833542fa52d0f287a4955ac/delta.h
@@ -34,18 +35,16 @@ func ApplyDelta(target, base plumbing.EncodedObject, delta []byte) (err error) {
 
 	defer ioutil.CheckClose(w, &err)
 
-	buf := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(buf)
-	buf.Reset()
+	buf := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(buf)
 	_, err = buf.ReadFrom(r)
 	if err != nil {
 		return err
 	}
 	src := buf.Bytes()
 
-	dst := bufPool.Get().(*bytes.Buffer)
-	defer bufPool.Put(dst)
-	dst.Reset()
+	dst := sync.GetBytesBuffer()
+	defer sync.PutBytesBuffer(dst)
 	err = patchDelta(dst, src, delta)
 	if err != nil {
 		return err
@@ -53,9 +52,9 @@ func ApplyDelta(target, base plumbing.EncodedObject, delta []byte) (err error) {
 
 	target.SetSize(int64(dst.Len()))
 
-	b := byteSlicePool.Get().([]byte)
-	_, err = io.CopyBuffer(w, dst, b)
-	byteSlicePool.Put(b)
+	b := sync.GetByteSlice()
+	_, err = io.CopyBuffer(w, dst, *b)
+	sync.PutByteSlice(b)
 	return err
 }
 
diff --git a/plumbing/format/packfile/scanner.go b/plumbing/format/packfile/scanner.go
index 5d9e8fb..730343e 100644
--- a/plumbing/format/packfile/scanner.go
+++ b/plumbing/format/packfile/scanner.go
@@ -3,17 +3,15 @@ package packfile
 import (
 	"bufio"
 	"bytes"
-	"compress/zlib"
 	"fmt"
 	"hash"
 	"hash/crc32"
 	"io"
-	stdioutil "io/ioutil"
-	"sync"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/utils/binary"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 var (
@@ -114,7 +112,7 @@ func (s *Scanner) Header() (version, objects uint32, err error) {
 	return
 }
 
-// readSignature reads an returns the signature field in the packfile.
+// readSignature reads a returns the signature field in the packfile.
 func (s *Scanner) readSignature() ([]byte, error) {
 	var sig = make([]byte, 4)
 	if _, err := io.ReadFull(s.r, sig); err != nil {
@@ -243,7 +241,7 @@ func (s *Scanner) discardObjectIfNeeded() error {
 	}
 
 	h := s.pendingObject
-	n, _, err := s.NextObject(stdioutil.Discard)
+	n, _, err := s.NextObject(io.Discard)
 	if err != nil {
 		return err
 	}
@@ -323,14 +321,14 @@ func (s *Scanner) NextObject(w io.Writer) (written int64, crc32 uint32, err erro
 // ReadObject returns a reader for the object content and an error
 func (s *Scanner) ReadObject() (io.ReadCloser, error) {
 	s.pendingObject = nil
-	zr := zlibReaderPool.Get().(io.ReadCloser)
+	zr, err := sync.GetZlibReader(s.r)
 
-	if err := zr.(zlib.Resetter).Reset(s.r, nil); err != nil {
+	if err != nil {
 		return nil, fmt.Errorf("zlib reset error: %s", err)
 	}
 
-	return ioutil.NewReadCloserWithCloser(zr, func() error {
-		zlibReaderPool.Put(zr)
+	return ioutil.NewReadCloserWithCloser(zr.Reader, func() error {
+		sync.PutZlibReader(zr)
 		return nil
 	}), nil
 }
@@ -338,26 +336,20 @@ func (s *Scanner) ReadObject() (io.ReadCloser, error) {
 // ReadRegularObject reads and write a non-deltified object
 // from it zlib stream in an object entry in the packfile.
 func (s *Scanner) copyObject(w io.Writer) (n int64, err error) {
-	zr := zlibReaderPool.Get().(io.ReadCloser)
-	defer zlibReaderPool.Put(zr)
+	zr, err := sync.GetZlibReader(s.r)
+	defer sync.PutZlibReader(zr)
 
-	if err = zr.(zlib.Resetter).Reset(s.r, nil); err != nil {
+	if err != nil {
 		return 0, fmt.Errorf("zlib reset error: %s", err)
 	}
 
-	defer ioutil.CheckClose(zr, &err)
-	buf := byteSlicePool.Get().([]byte)
-	n, err = io.CopyBuffer(w, zr, buf)
-	byteSlicePool.Put(buf)
+	defer ioutil.CheckClose(zr.Reader, &err)
+	buf := sync.GetByteSlice()
+	n, err = io.CopyBuffer(w, zr.Reader, *buf)
+	sync.PutByteSlice(buf)
 	return
 }
 
-var byteSlicePool = sync.Pool{
-	New: func() interface{} {
-		return make([]byte, 32*1024)
-	},
-}
-
 // SeekFromStart sets a new offset from start, returns the old position before
 // the change.
 func (s *Scanner) SeekFromStart(offset int64) (previous int64, err error) {
@@ -387,9 +379,10 @@ func (s *Scanner) Checksum() (plumbing.Hash, error) {
 
 // Close reads the reader until io.EOF
 func (s *Scanner) Close() error {
-	buf := byteSlicePool.Get().([]byte)
-	_, err := io.CopyBuffer(stdioutil.Discard, s.r, buf)
-	byteSlicePool.Put(buf)
+	buf := sync.GetByteSlice()
+	_, err := io.CopyBuffer(io.Discard, s.r, *buf)
+	sync.PutByteSlice(buf)
+
 	return err
 }
 
@@ -399,13 +392,13 @@ func (s *Scanner) Flush() error {
 }
 
 // scannerReader has the following characteristics:
-// - Provides an io.SeekReader impl for bufio.Reader, when the underlying
-//   reader supports it.
-// - Keeps track of the current read position, for when the underlying reader
-//   isn't an io.SeekReader, but we still want to know the current offset.
-// - Writes to the hash writer what it reads, with the aid of a smaller buffer.
-//   The buffer helps avoid a performance penality for performing small writes
-//   to the crc32 hash writer.
+//   - Provides an io.SeekReader impl for bufio.Reader, when the underlying
+//     reader supports it.
+//   - Keeps track of the current read position, for when the underlying reader
+//     isn't an io.SeekReader, but we still want to know the current offset.
+//   - Writes to the hash writer what it reads, with the aid of a smaller buffer.
+//     The buffer helps avoid a performance penalty for performing small writes
+//     to the crc32 hash writer.
 type scannerReader struct {
 	reader io.Reader
 	crc    io.Writer
diff --git a/plumbing/format/packfile/scanner_test.go b/plumbing/format/packfile/scanner_test.go
index 892a27c..9dcc359 100644
--- a/plumbing/format/packfile/scanner_test.go
+++ b/plumbing/format/packfile/scanner_test.go
@@ -6,6 +6,7 @@ import (
 
 	fixtures "github.com/go-git/go-git-fixtures/v4"
 	"github.com/go-git/go-git/v5/plumbing"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 
 	. "gopkg.in/check.v1"
 )
@@ -71,7 +72,7 @@ func (s *ScannerSuite) testNextObjectHeader(c *C, tag string,
 
 	n, err := p.Checksum()
 	c.Assert(err, IsNil)
-	c.Assert(n, HasLen, 20)
+	c.Assert(n, HasLen, hash.Size)
 }
 
 func (s *ScannerSuite) TestNextObjectHeaderWithOutReadObject(c *C) {
diff --git a/plumbing/hash.go b/plumbing/hash.go
index afc602a..39bb73f 100644
--- a/plumbing/hash.go
+++ b/plumbing/hash.go
@@ -2,15 +2,15 @@ package plumbing
 
 import (
 	"bytes"
-	"crypto/sha1"
 	"encoding/hex"
-	"hash"
 	"sort"
 	"strconv"
+
+	"github.com/go-git/go-git/v5/plumbing/hash"
 )
 
 // Hash SHA1 hashed content
-type Hash [20]byte
+type Hash [hash.Size]byte
 
 // ZeroHash is Hash with value zero
 var ZeroHash Hash
@@ -46,7 +46,7 @@ type Hasher struct {
 }
 
 func NewHasher(t ObjectType, size int64) Hasher {
-	h := Hasher{sha1.New()}
+	h := Hasher{hash.New(hash.CryptoType)}
 	h.Write(t.Bytes())
 	h.Write([]byte(" "))
 	h.Write([]byte(strconv.FormatInt(size, 10)))
@@ -74,10 +74,11 @@ func (p HashSlice) Swap(i, j int)      { p[i], p[j] = p[j], p[i] }
 
 // IsHash returns true if the given string is a valid hash.
 func IsHash(s string) bool {
-	if len(s) != 40 {
+	switch len(s) {
+	case hash.HexSize:
+		_, err := hex.DecodeString(s)
+		return err == nil
+	default:
 		return false
 	}
-
-	_, err := hex.DecodeString(s)
-	return err == nil
 }
diff --git a/plumbing/hash/hash.go b/plumbing/hash/hash.go
new file mode 100644
index 0000000..82d1856
--- /dev/null
+++ b/plumbing/hash/hash.go
@@ -0,0 +1,60 @@
+// package hash provides a way for managing the
+// underlying hash implementations used across go-git.
+package hash
+
+import (
+	"crypto"
+	"fmt"
+	"hash"
+
+	"github.com/pjbgf/sha1cd"
+)
+
+// algos is a map of hash algorithms.
+var algos = map[crypto.Hash]func() hash.Hash{}
+
+func init() {
+	reset()
+}
+
+// reset resets the default algos value. Can be used after running tests
+// that registers new algorithms to avoid side effects.
+func reset() {
+	algos[crypto.SHA1] = sha1cd.New
+	algos[crypto.SHA256] = crypto.SHA256.New
+}
+
+// RegisterHash allows for the hash algorithm used to be overriden.
+// This ensures the hash selection for go-git must be explicit, when
+// overriding the default value.
+func RegisterHash(h crypto.Hash, f func() hash.Hash) error {
+	if f == nil {
+		return fmt.Errorf("cannot register hash: f is nil")
+	}
+
+	switch h {
+	case crypto.SHA1:
+		algos[h] = f
+	case crypto.SHA256:
+		algos[h] = f
+	default:
+		return fmt.Errorf("unsupported hash function: %v", h)
+	}
+	return nil
+}
+
+// Hash is the same as hash.Hash. This allows consumers
+// to not having to import this package alongside "hash".
+type Hash interface {
+	hash.Hash
+}
+
+// New returns a new Hash for the given hash function.
+// It panics if the hash function is not registered.
+func New(h crypto.Hash) Hash {
+	hh, ok := algos[h]
+	if !ok {
+		panic(fmt.Sprintf("hash algorithm not registered: %v", h))
+	}
+	return hh()
+}
diff --git a/plumbing/hash/hash_sha1.go b/plumbing/hash/hash_sha1.go
new file mode 100644
index 0000000..e3cb60f
--- /dev/null
+++ b/plumbing/hash/hash_sha1.go
@@ -0,0 +1,15 @@
+//go:build !sha256
+// +build !sha256
+
+package hash
+
+import "crypto"
+
+const (
+	// CryptoType defines what hash algorithm is being used.
+	CryptoType = crypto.SHA1
+	// Size defines the amount of bytes the hash yields.
+	Size = 20
+	// HexSize defines the strings size of the hash when represented in hexadecimal.
+	HexSize = 40
+)
diff --git a/plumbing/hash/hash_sha256.go b/plumbing/hash/hash_sha256.go
new file mode 100644
index 0000000..1c52b89
--- /dev/null
+++ b/plumbing/hash/hash_sha256.go
@@ -0,0 +1,15 @@
+//go:build sha256
+// +build sha256
+
+package hash
+
+import "crypto"
+
+const (
+	// CryptoType defines what hash algorithm is being used.
+	CryptoType = crypto.SHA256
+	// Size defines the amount of bytes the hash yields.
+	Size = 32
+	// HexSize defines the strings size of the hash when represented in hexadecimal.
+	HexSize = 64
+)
diff --git a/plumbing/hash/hash_test.go b/plumbing/hash/hash_test.go
new file mode 100644
index 0000000..f70ad11
--- /dev/null
+++ b/plumbing/hash/hash_test.go
@@ -0,0 +1,103 @@
+package hash
+
+import (
+	"crypto"
+	"crypto/sha1"
+	"crypto/sha512"
+	"encoding/hex"
+	"hash"
+	"strings"
+	"testing"
+)
+
+func TestRegisterHash(t *testing.T) {
+	// Reset default hash to avoid side effects.
+	defer reset()
+
+	tests := []struct {
+		name    string
+		hash    crypto.Hash
+		new     func() hash.Hash
+		wantErr string
+	}{
+		{
+			name: "sha1",
+			hash: crypto.SHA1,
+			new:  sha1.New,
+		},
+		{
+			name:    "sha1",
+			hash:    crypto.SHA1,
+			wantErr: "cannot register hash: f is nil",
+		},
+		{
+			name:    "sha512",
+			hash:    crypto.SHA512,
+			new:     sha512.New,
+			wantErr: "unsupported hash function",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := RegisterHash(tt.hash, tt.new)
+			if tt.wantErr == "" && err != nil {
+				t.Errorf("unexpected error: %v", err)
+			} else if tt.wantErr != "" && err == nil {
+				t.Errorf("expected error: %v got: nil", tt.wantErr)
+			} else if err != nil && !strings.Contains(err.Error(), tt.wantErr) {
+				t.Errorf("expected error: %v got: %v", tt.wantErr, err)
+			}
+		})
+	}
+}
+
+// Verifies that the SHA1 implementation used is collision-resistant
+// by default.
+func TestSha1Collision(t *testing.T) {
+	defer reset()
+
+	tests := []struct {
+		name    string
+		content string
+		hash    string
+		before  func()
+	}{
+		{
+			name:    "sha-mbles-1: with collision detection",
+			content: "99040d047fe81780012000ff4b65792069732070617274206f66206120636f6c6c6973696f6e212049742773206120747261702179c61af0afcc054515d9274e7307624b1dc7fb23988bb8de8b575dba7b9eab31c1674b6d974378a827732ff5851c76a2e60772b5a47ce1eac40bb993c12d8c70e24a4f8d5fcdedc1b32c9cf19e31af2429759d42e4dfdb31719f587623ee552939b6dcdc459fca53553b70f87ede30a247ea3af6c759a2f20b320d760db64ff479084fd3ccb3cdd48362d96a9c430617caff6c36c637e53fde28417f626fec54ed7943a46e5f5730f2bb38fb1df6e0090010d00e24ad78bf92641993608e8d158a789f34c46fe1e6027f35a4cbfb827076c50eca0e8b7cca69bb2c2b790259f9bf9570dd8d4437a3115faff7c3cac09ad25266055c27104755178eaeff825a2caa2acfb5de64ce7641dc59a541a9fc9c756756e2e23dc713c8c24c9790aa6b0e38a7f55f14452a1ca2850ddd9562fd9a18ad42496aa97008f74672f68ef461eb88b09933d626b4f918749cc027fddd6c425fc4216835d0134d15285bab2cb784a4f7cbb4fb514d4bf0f6237cf00a9e9f132b9a066e6fd17f6c42987478586ff651af96747fb426b9872b9a88e4063f59bb334cc00650f83a80c42751b71974d300fc2819a2e8f1e32c1b51cb18e6bfc4db9baef675d4aaf5b1574a047f8f6dd2ec153a93412293974d928f88ced9363cfef97ce2e742bf34c96b8ef3875676fea5cca8e5f7dea0bab2413d4de00ee71ee01f162bdb6d1eafd925e6aebaae6a354ef17cf205a404fbdb12fc454d41fdd95cf2459664a2ad032d1da60a73264075d7f1e0d6c1403ae7a0d861df3fe5707188dd5e07d1589b9f8b6630553f8fc352b3e0c27da80bddba4c64020d",
+			hash:    "4f3d9be4a472c4dae83c6314aa6c36a064c1fd14",
+		},
+		{
+			name:    "sha-mbles-1: with default SHA1",
+			content: "99040d047fe81780012000ff4b65792069732070617274206f66206120636f6c6c6973696f6e212049742773206120747261702179c61af0afcc054515d9274e7307624b1dc7fb23988bb8de8b575dba7b9eab31c1674b6d974378a827732ff5851c76a2e60772b5a47ce1eac40bb993c12d8c70e24a4f8d5fcdedc1b32c9cf19e31af2429759d42e4dfdb31719f587623ee552939b6dcdc459fca53553b70f87ede30a247ea3af6c759a2f20b320d760db64ff479084fd3ccb3cdd48362d96a9c430617caff6c36c637e53fde28417f626fec54ed7943a46e5f5730f2bb38fb1df6e0090010d00e24ad78bf92641993608e8d158a789f34c46fe1e6027f35a4cbfb827076c50eca0e8b7cca69bb2c2b790259f9bf9570dd8d4437a3115faff7c3cac09ad25266055c27104755178eaeff825a2caa2acfb5de64ce7641dc59a541a9fc9c756756e2e23dc713c8c24c9790aa6b0e38a7f55f14452a1ca2850ddd9562fd9a18ad42496aa97008f74672f68ef461eb88b09933d626b4f918749cc027fddd6c425fc4216835d0134d15285bab2cb784a4f7cbb4fb514d4bf0f6237cf00a9e9f132b9a066e6fd17f6c42987478586ff651af96747fb426b9872b9a88e4063f59bb334cc00650f83a80c42751b71974d300fc2819a2e8f1e32c1b51cb18e6bfc4db9baef675d4aaf5b1574a047f8f6dd2ec153a93412293974d928f88ced9363cfef97ce2e742bf34c96b8ef3875676fea5cca8e5f7dea0bab2413d4de00ee71ee01f162bdb6d1eafd925e6aebaae6a354ef17cf205a404fbdb12fc454d41fdd95cf2459664a2ad032d1da60a73264075d7f1e0d6c1403ae7a0d861df3fe5707188dd5e07d1589b9f8b6630553f8fc352b3e0c27da80bddba4c64020d",
+			hash:    "8ac60ba76f1999a1ab70223f225aefdc78d4ddc0",
+			before: func() {
+				RegisterHash(crypto.SHA1, sha1.New)
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if tt.before != nil {
+				tt.before()
+			}
+
+			h := New(crypto.SHA1)
+			data, err := hex.DecodeString(tt.content)
+			if err != nil {
+				t.Fatal(err)
+			}
+
+			h.Reset()
+			h.Write(data)
+			sum := h.Sum(nil)
+			got := hex.EncodeToString(sum)
+
+			if tt.hash != got {
+				t.Errorf("\n   got: %q\nwanted: %q", got, tt.hash)
+			}
+		})
+	}
+}
diff --git a/plumbing/memory.go b/plumbing/memory.go
index 21337cc..6d11271 100644
--- a/plumbing/memory.go
+++ b/plumbing/memory.go
@@ -25,13 +25,13 @@ func (o *MemoryObject) Hash() Hash {
 	return o.h
 }
 
-// Type return the ObjectType
+// Type returns the ObjectType
 func (o *MemoryObject) Type() ObjectType { return o.t }
 
 // SetType sets the ObjectType
 func (o *MemoryObject) SetType(t ObjectType) { o.t = t }
 
-// Size return the size of the object
+// Size returns the size of the object
 func (o *MemoryObject) Size() int64 { return o.sz }
 
 // SetSize set the object size, a content of the given size should be written
diff --git a/plumbing/memory_test.go b/plumbing/memory_test.go
index 2a141f4..f76b4f4 100644
--- a/plumbing/memory_test.go
+++ b/plumbing/memory_test.go
@@ -2,7 +2,6 @@ package plumbing
 
 import (
 	"io"
-	"io/ioutil"
 
 	. "gopkg.in/check.v1"
 )
@@ -52,7 +51,7 @@ func (s *MemoryObjectSuite) TestReader(c *C) {
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(reader.Close(), IsNil) }()
 
-	b, err := ioutil.ReadAll(reader)
+	b, err := io.ReadAll(reader)
 	c.Assert(err, IsNil)
 	c.Assert(b, DeepEquals, []byte("foo"))
 }
@@ -75,7 +74,7 @@ func (s *MemoryObjectSuite) TestSeekableReader(c *C) {
 	_, err = rs.Seek(pageSize, io.SeekStart)
 	c.Assert(err, IsNil)
 
-	b, err := ioutil.ReadAll(rs)
+	b, err := io.ReadAll(rs)
 	c.Assert(err, IsNil)
 	c.Assert(b, DeepEquals, []byte(payload))
 
diff --git a/plumbing/object/blob_test.go b/plumbing/object/blob_test.go
index 4461343..9481dbe 100644
--- a/plumbing/object/blob_test.go
+++ b/plumbing/object/blob_test.go
@@ -3,7 +3,6 @@ package object
 import (
 	"bytes"
 	"io"
-	"io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 
@@ -37,7 +36,7 @@ func (s *BlobsSuite) TestBlobHash(c *C) {
 	c.Assert(err, IsNil)
 	defer func() { c.Assert(reader.Close(), IsNil) }()
 
-	data, err := ioutil.ReadAll(reader)
+	data, err := io.ReadAll(reader)
 	c.Assert(err, IsNil)
 	c.Assert(string(data), Equals, "FOO")
 }
@@ -96,14 +95,14 @@ func (s *BlobsSuite) TestBlobIter(c *C) {
 		r1, err := b.Reader()
 		c.Assert(err, IsNil)
 
-		b1, err := ioutil.ReadAll(r1)
+		b1, err := io.ReadAll(r1)
 		c.Assert(err, IsNil)
 		c.Assert(r1.Close(), IsNil)
 
 		r2, err := blobs[i].Reader()
 		c.Assert(err, IsNil)
 
-		b2, err := ioutil.ReadAll(r2)
+		b2, err := io.ReadAll(r2)
 		c.Assert(err, IsNil)
 		c.Assert(r2.Close(), IsNil)
 
diff --git a/plumbing/object/change.go b/plumbing/object/change.go
index 8b119bc..3c619df 100644
--- a/plumbing/object/change.go
+++ b/plumbing/object/change.go
@@ -39,7 +39,7 @@ func (c *Change) Action() (merkletrie.Action, error) {
 	return merkletrie.Modify, nil
 }
 
-// Files return the files before and after a change.
+// Files returns the files before and after a change.
 // For insertions from will be nil. For deletions to will be nil.
 func (c *Change) Files() (from, to *File, err error) {
 	action, err := c.Action()
diff --git a/plumbing/object/commit.go b/plumbing/object/commit.go
index 7a1b8e5..8a0f35c 100644
--- a/plumbing/object/commit.go
+++ b/plumbing/object/commit.go
@@ -1,7 +1,6 @@
 package object
 
 import (
-	"bufio"
 	"bytes"
 	"context"
 	"errors"
@@ -14,6 +13,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 const (
@@ -180,9 +180,8 @@ func (c *Commit) Decode(o plumbing.EncodedObject) (err error) {
 	}
 	defer ioutil.CheckClose(reader, &err)
 
-	r := bufPool.Get().(*bufio.Reader)
-	defer bufPool.Put(r)
-	r.Reset(reader)
+	r := sync.GetBufioReader(reader)
+	defer sync.PutBufioReader(r)
 
 	var message bool
 	var pgpsig bool
@@ -377,6 +376,17 @@ func (c *Commit) Verify(armoredKeyRing string) (*openpgp.Entity, error) {
 	return openpgp.CheckArmoredDetachedSignature(keyring, er, signature, nil)
 }
 
+// Less defines a compare function to determine which commit is 'earlier' by:
+// - First use Committer.When
+// - If Committer.When are equal then use Author.When
+// - If Author.When also equal then compare the string value of the hash
+func (c *Commit) Less(rhs *Commit) bool {
+	return c.Committer.When.Before(rhs.Committer.When) ||
+		(c.Committer.When.Equal(rhs.Committer.When) &&
+			(c.Author.When.Before(rhs.Author.When) ||
+				(c.Author.When.Equal(rhs.Author.When) && bytes.Compare(c.Hash[:], rhs.Hash[:]) < 0)))
+}
+
 func indent(t string) string {
 	var output []string
 	for _, line := range strings.Split(t, "\n") {
diff --git a/plumbing/object/commit_test.go b/plumbing/object/commit_test.go
index 468a751..4b0f6b4 100644
--- a/plumbing/object/commit_test.go
+++ b/plumbing/object/commit_test.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"strings"
 	"time"
 
@@ -449,7 +448,7 @@ YIefGtzXfldDxg4=
 `
 
 	e, err := commit.Verify(armoredKeyRing)
-        c.Assert(err, IsNil)
+	c.Assert(err, IsNil)
 
 	_, ok := e.Identities["go-git test key"]
 	c.Assert(ok, Equals, true)
@@ -492,7 +491,7 @@ func (s *SuiteCommit) TestEncodeWithoutSignature(c *C) {
 	c.Assert(err, IsNil)
 	er, err := encoded.Reader()
 	c.Assert(err, IsNil)
-	payload, err := ioutil.ReadAll(er)
+	payload, err := io.ReadAll(er)
 	c.Assert(err, IsNil)
 
 	c.Assert(string(payload), Equals, ""+
@@ -504,3 +503,73 @@ func (s *SuiteCommit) TestEncodeWithoutSignature(c *C) {
 		"\n"+
 		"Merge branch 'master' of github.com:tyba/git-fixture\n")
 }
+
+func (s *SuiteCommit) TestLess(c *C) {
+	when1 := time.Now()
+	when2 := when1.Add(time.Hour)
+
+	hash1 := plumbing.NewHash("1669dce138d9b841a518c64b10914d88f5e488ea")
+	hash2 := plumbing.NewHash("2669dce138d9b841a518c64b10914d88f5e488ea")
+
+	commitLessTests := []struct {
+		Committer1When, Committer2When time.Time
+		Author1When, Author2When       time.Time
+		Hash1, Hash2                   plumbing.Hash
+		Exp                            bool
+	}{
+		{when1, when1, when1, when1, hash1, hash2, true},
+		{when1, when1, when1, when1, hash2, hash1, false},
+		{when1, when1, when1, when2, hash1, hash2, true},
+		{when1, when1, when1, when2, hash2, hash1, true},
+		{when1, when1, when2, when1, hash1, hash2, false},
+		{when1, when1, when2, when1, hash2, hash1, false},
+		{when1, when1, when2, when2, hash1, hash2, true},
+		{when1, when1, when2, when2, hash2, hash1, false},
+		{when1, when2, when1, when1, hash1, hash2, true},
+		{when1, when2, when1, when1, hash2, hash1, true},
+		{when1, when2, when1, when2, hash1, hash2, true},
+		{when1, when2, when1, when2, hash2, hash1, true},
+		{when1, when2, when2, when1, hash1, hash2, true},
+		{when1, when2, when2, when1, hash2, hash1, true},
+		{when1, when2, when2, when2, hash1, hash2, true},
+		{when1, when2, when2, when2, hash2, hash1, true},
+		{when2, when1, when1, when1, hash1, hash2, false},
+		{when2, when1, when1, when1, hash2, hash1, false},
+		{when2, when1, when1, when2, hash1, hash2, false},
+		{when2, when1, when1, when2, hash2, hash1, false},
+		{when2, when1, when2, when1, hash1, hash2, false},
+		{when2, when1, when2, when1, hash2, hash1, false},
+		{when2, when1, when2, when2, hash1, hash2, false},
+		{when2, when1, when2, when2, hash2, hash1, false},
+		{when2, when2, when1, when1, hash1, hash2, true},
+		{when2, when2, when1, when1, hash2, hash1, false},
+		{when2, when2, when1, when2, hash1, hash2, true},
+		{when2, when2, when1, when2, hash2, hash1, true},
+		{when2, when2, when2, when1, hash1, hash2, false},
+		{when2, when2, when2, when1, hash2, hash1, false},
+		{when2, when2, when2, when2, hash1, hash2, true},
+		{when2, when2, when2, when2, hash2, hash1, false},
+	}
+
+	for _, t := range commitLessTests {
+		commit1 := &Commit{
+			Hash: t.Hash1,
+			Author: Signature{
+				When: t.Author1When,
+			},
+			Committer: Signature{
+				When: t.Committer1When,
+			},
+		}
+		commit2 := &Commit{
+			Hash: t.Hash2,
+			Author: Signature{
+				When: t.Author2When,
+			},
+			Committer: Signature{
+				When: t.Committer2When,
+			},
+		}
+		c.Assert(commit1.Less(commit2), Equals, t.Exp)
+	}
+}
diff --git a/plumbing/object/common.go b/plumbing/object/common.go
deleted file mode 100644
index 3591f5f..0000000
--- a/plumbing/object/common.go
+++ /dev/null
@@ -1,12 +0,0 @@
-package object
-
-import (
-	"bufio"
-	"sync"
-)
-
-var bufPool = sync.Pool{
-	New: func() interface{} {
-		return bufio.NewReader(nil)
-	},
-}
diff --git a/plumbing/object/object_test.go b/plumbing/object/object_test.go
index 6c95eef..c4fdb4c 100644
--- a/plumbing/object/object_test.go
+++ b/plumbing/object/object_test.go
@@ -2,7 +2,6 @@ package object
 
 import (
 	"io"
-	"io/ioutil"
 	"testing"
 	"time"
 
@@ -103,7 +102,7 @@ func (s *ObjectsSuite) TestParseTree(c *C) {
 			reader, err := f.Reader()
 			c.Assert(err, IsNil)
 			defer func() { c.Assert(reader.Close(), IsNil) }()
-			content, _ := ioutil.ReadAll(reader)
+			content, _ := io.ReadAll(reader)
 			c.Assert(content, HasLen, 2780)
 		}
 	}
diff --git a/plumbing/object/rename.go b/plumbing/object/rename.go
index 7fed72c..ad2b902 100644
--- a/plumbing/object/rename.go
+++ b/plumbing/object/rename.go
@@ -403,10 +403,16 @@ func min(a, b int) int {
 	return b
 }
 
+const maxMatrixSize = 10000
+
 func buildSimilarityMatrix(srcs, dsts []*Change, renameScore int) (similarityMatrix, error) {
 	// Allocate for the worst-case scenario where every pair has a score
 	// that we need to consider. We might not need that many.
-	matrix := make(similarityMatrix, 0, len(srcs)*len(dsts))
+	matrixSize := len(srcs) * len(dsts)
+	if matrixSize > maxMatrixSize {
+		matrixSize = maxMatrixSize
+	}
+	matrix := make(similarityMatrix, 0, matrixSize)
 	srcSizes := make([]int64, len(srcs))
 	dstSizes := make([]int64, len(dsts))
 	dstTooLarge := make(map[int]bool)
@@ -735,10 +741,7 @@ func (i *similarityIndex) add(key int, cnt uint64) error {
 			// It's the same key, so increment the counter.
 			var err error
 			i.hashes[j], err = newKeyCountPair(key, v.count()+cnt)
-			if err != nil {
-				return err
-			}
-			return nil
+			return err
 		} else if j+1 >= len(i.hashes) {
 			j = 0
 		} else {
diff --git a/plumbing/object/signature.go b/plumbing/object/signature.go
new file mode 100644
index 0000000..91cf371
--- /dev/null
+++ b/plumbing/object/signature.go
@@ -0,0 +1,101 @@
+package object
+
+import "bytes"
+
+const (
+	signatureTypeUnknown signatureType = iota
+	signatureTypeOpenPGP
+	signatureTypeX509
+	signatureTypeSSH
+)
+
+var (
+	// openPGPSignatureFormat is the format of an OpenPGP signature.
+	openPGPSignatureFormat = signatureFormat{
+		[]byte("-----BEGIN PGP SIGNATURE-----"),
+		[]byte("-----BEGIN PGP MESSAGE-----"),
+	}
+	// x509SignatureFormat is the format of an X509 signature, which is
+	// a PKCS#7 (S/MIME) signature.
+	x509SignatureFormat = signatureFormat{
+		[]byte("-----BEGIN CERTIFICATE-----"),
+	}
+
+	// sshSignatureFormat is the format of an SSH signature.
+	sshSignatureFormat = signatureFormat{
+		[]byte("-----BEGIN SSH SIGNATURE-----"),
+	}
+)
+
+var (
+	// knownSignatureFormats is a map of known signature formats, indexed by
+	// their signatureType.
+	knownSignatureFormats = map[signatureType]signatureFormat{
+		signatureTypeOpenPGP: openPGPSignatureFormat,
+		signatureTypeX509:    x509SignatureFormat,
+		signatureTypeSSH:     sshSignatureFormat,
+	}
+)
+
+// signatureType represents the type of the signature.
+type signatureType int8
+
+// signatureFormat represents the beginning of a signature.
+type signatureFormat [][]byte
+
+// typeForSignature returns the type of the signature based on its format.
+func typeForSignature(b []byte) signatureType {
+	for t, i := range knownSignatureFormats {
+		for _, begin := range i {
+			if bytes.HasPrefix(b, begin) {
+				return t
+			}
+		}
+	}
+	return signatureTypeUnknown
+}
+
+// parseSignedBytes returns the position of the last signature block found in
+// the given bytes. If no signature block is found, it returns -1.
+//
+// When multiple signature blocks are found, the position of the last one is
+// returned. Any tailing bytes after this signature block start should be
+// considered part of the signature.
+//
+// Given this, it would be safe to use the returned position to split the bytes
+// into two parts: the first part containing the message, the second part
+// containing the signature.
+//
+// Example:
+//
+//	message := []byte(`Message with signature
+//
+//	-----BEGIN SSH SIGNATURE-----
+//	...`)
+//
+//	var signature string
+//	if pos, _ := parseSignedBytes(message); pos != -1 {
+//		signature = string(message[pos:])
+//		message = message[:pos]
+//	}
+//
+// This logic is on par with git's gpg-interface.c:parse_signed_buffer().
+// https://github.com/git/git/blob/7c2ef319c52c4997256f5807564523dfd4acdfc7/gpg-interface.c#L668
+func parseSignedBytes(b []byte) (int, signatureType) {
+	var n, match = 0, -1
+	var t signatureType
+	for n < len(b) {
+		var i = b[n:]
+		if st := typeForSignature(i); st != signatureTypeUnknown {
+			match = n
+			t = st
+		}
+		if eol := bytes.IndexByte(i, '\n'); eol >= 0 {
+			n += eol + 1
+			continue
+		}
+		// If we reach this point, we've reached the end.
+		break
+	}
+	return match, t
+}
diff --git a/plumbing/object/signature_test.go b/plumbing/object/signature_test.go
new file mode 100644
index 0000000..1bdb1d1
--- /dev/null
+++ b/plumbing/object/signature_test.go
@@ -0,0 +1,180 @@
+package object
+
+import (
+	"bytes"
+	"testing"
+)
+
+func Test_typeForSignature(t *testing.T) {
+	tests := []struct {
+		name string
+		b    []byte
+		want signatureType
+	}{
+		{
+			name: "known signature format (PGP)",
+			b: []byte(`-----BEGIN PGP SIGNATURE-----
+
+iHUEABYKAB0WIQTMqU0ycQ3f6g3PMoWMmmmF4LuV8QUCYGebVwAKCRCMmmmF4LuV
+8VtyAP9LbuXAhtK6FQqOjKybBwlV70rLcXVP24ubDuz88VVwSgD+LuObsasWq6/U
+TssDKHUR2taa53bQYjkZQBpvvwOrLgc=
+=YQUf
+-----END PGP SIGNATURE-----`),
+			want: signatureTypeOpenPGP,
+		},
+		{
+			name: "known signature format (SSH)",
+			b: []byte(`-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----`),
+			want: signatureTypeSSH,
+		},
+		{
+			name: "known signature format (X509)",
+			b: []byte(`-----BEGIN CERTIFICATE-----
+MIIDZjCCAk6gAwIBAgIJALZ9Z3Z9Z3Z9MA0GCSqGSIb3DQEBCwUAMIGIMQswCQYD
+VQQGEwJTRTEOMAwGA1UECAwFVGV4YXMxDjAMBgNVBAcMBVRleGFzMQ4wDAYDVQQK
+DAVUZXhhczEOMAwGA1UECwwFVGV4YXMxGDAWBgNVBAMMD1RleGFzIENlcnRpZmlj
+YXRlMB4XDTE3MDUyNjE3MjY0MloXDTI3MDUyNDE3MjY0MlowgYgxCzAJBgNVBAYT
+AlNFMQ4wDAYDVQQIDAVUZXhhczEOMAwGA1UEBwwFVGV4YXMxDjAMBgNVBAoMBVRl
+eGFzMQ4wDAYDVQQLDAVUZXhhczEYMBYGA1UEAwwPVGV4YXMgQ2VydGlmaWNhdGUw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDQZ9Z3Z9Z3Z9Z3Z9Z3Z9Z3
+-----END CERTIFICATE-----`),
+			want: signatureTypeX509,
+		},
+		{
+			name: "unknown signature format",
+			b: []byte(`-----BEGIN ARBITRARY SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+-----END UNKNOWN SIGNATURE-----`),
+			want: signatureTypeUnknown,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := typeForSignature(tt.b); got != tt.want {
+				t.Errorf("typeForSignature() = %v, want %v", got, tt.want)
+			}
+		})
+	}
+}
+
+func Test_parseSignedBytes(t *testing.T) {
+	tests := []struct {
+		name          string
+		b             []byte
+		wantSignature []byte
+		wantType      signatureType
+	}{
+		{
+			name: "detects signature and type",
+			b: []byte(`signed tag
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEE/h5sbbqJFh9j1AdUSqtFFGopTmwFAmB5XFkACgkQSqtFFGop
+TmxvgAv+IPjX5WCLFUIMx8hquMZp1VkhQrseE7rljUYaYpga8gZ9s4kseTGhy7Un
+61U3Ro6cTPEiQF/FkAGzSdPuGqv0ARBqHDX2tUI9+Zs/K8aG8tN+JTaof0gBcTyI
+BLbZVYDTxbS9whxSDewQd0OvBG1m9ISLUhjXo6mbaVvrKXNXTHg40MPZ8ZxjR/vN
+hxXXoUVnFyEDo+v6nK56mYtapThDaQQHHzD6D3VaCq3Msog7qAh9/ZNBmgb88aQ3
+FoK8PHMyr5elsV3mE9bciZBUc+dtzjOvp94uQ5ZKUXaPusXaYXnKpVnzhyer6RBI
+gJLWtPwAinqmN41rGJ8jDAGrpPNjaRrMhGtbyVUPUf19OxuUIroe77sIIKTP0X2o
+Wgp56dYpTst0JcGv/FYCeau/4pTRDfwHAOcDiBQ/0ag9IrZp9P8P9zlKmzNPEraV
+pAe1/EFuhv2UDLucAiWM8iDZIcw8iN0OYMOGUmnk0WuGIo7dzLeqMGY+ND5n5Z8J
+sZC//k6m
+=VhHy
+-----END PGP SIGNATURE-----`),
+			wantSignature: []byte(`-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEE/h5sbbqJFh9j1AdUSqtFFGopTmwFAmB5XFkACgkQSqtFFGop
+TmxvgAv+IPjX5WCLFUIMx8hquMZp1VkhQrseE7rljUYaYpga8gZ9s4kseTGhy7Un
+61U3Ro6cTPEiQF/FkAGzSdPuGqv0ARBqHDX2tUI9+Zs/K8aG8tN+JTaof0gBcTyI
+BLbZVYDTxbS9whxSDewQd0OvBG1m9ISLUhjXo6mbaVvrKXNXTHg40MPZ8ZxjR/vN
+hxXXoUVnFyEDo+v6nK56mYtapThDaQQHHzD6D3VaCq3Msog7qAh9/ZNBmgb88aQ3
+FoK8PHMyr5elsV3mE9bciZBUc+dtzjOvp94uQ5ZKUXaPusXaYXnKpVnzhyer6RBI
+gJLWtPwAinqmN41rGJ8jDAGrpPNjaRrMhGtbyVUPUf19OxuUIroe77sIIKTP0X2o
+Wgp56dYpTst0JcGv/FYCeau/4pTRDfwHAOcDiBQ/0ag9IrZp9P8P9zlKmzNPEraV
+pAe1/EFuhv2UDLucAiWM8iDZIcw8iN0OYMOGUmnk0WuGIo7dzLeqMGY+ND5n5Z8J
+sZC//k6m
+=VhHy
+-----END PGP SIGNATURE-----`),
+			wantType: signatureTypeOpenPGP,
+		},
+		{
+			name: "last signature for multiple signatures",
+			b: []byte(`signed tag
+-----BEGIN PGP SIGNATURE-----
+
+iQGzBAABCAAdFiEE/h5sbbqJFh9j1AdUSqtFFGopTmwFAmB5XFkACgkQSqtFFGop
+TmxvgAv+IPjX5WCLFUIMx8hquMZp1VkhQrseE7rljUYaYpga8gZ9s4kseTGhy7Un
+61U3Ro6cTPEiQF/FkAGzSdPuGqv0ARBqHDX2tUI9+Zs/K8aG8tN+JTaof0gBcTyI
+BLbZVYDTxbS9whxSDewQd0OvBG1m9ISLUhjXo6mbaVvrKXNXTHg40MPZ8ZxjR/vN
+hxXXoUVnFyEDo+v6nK56mYtapThDaQQHHzD6D3VaCq3Msog7qAh9/ZNBmgb88aQ3
+FoK8PHMyr5elsV3mE9bciZBUc+dtzjOvp94uQ5ZKUXaPusXaYXnKpVnzhyer6RBI
+gJLWtPwAinqmN41rGJ8jDAGrpPNjaRrMhGtbyVUPUf19OxuUIroe77sIIKTP0X2o
+Wgp56dYpTst0JcGv/FYCeau/4pTRDfwHAOcDiBQ/0ag9IrZp9P8P9zlKmzNPEraV
+pAe1/EFuhv2UDLucAiWM8iDZIcw8iN0OYMOGUmnk0WuGIo7dzLeqMGY+ND5n5Z8J
+sZC//k6m
+=VhHy
+-----END PGP SIGNATURE-----
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----`),
+			wantSignature: []byte(`-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----`),
+			wantType: signatureTypeSSH,
+		},
+		{
+			name: "signature with trailing data",
+			b: []byte(`An invalid
+
+-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----
+
+signed tag`),
+			wantSignature: []byte(`-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----
+
+signed tag`),
+			wantType: signatureTypeSSH,
+		},
+		{
+			name:          "data without signature",
+			b:             []byte(`Some message`),
+			wantSignature: []byte(``),
+			wantType:      signatureTypeUnknown,
+		},
+	}
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			pos, st := parseSignedBytes(tt.b)
+			var signature []byte
+			if pos >= 0 {
+				signature = tt.b[pos:]
+			}
+			if !bytes.Equal(signature, tt.wantSignature) {
+				t.Errorf("parseSignedBytes() got = %s for pos = %v, want %s", signature, pos, tt.wantSignature)
+			}
+			if st != tt.wantType {
+				t.Errorf("parseSignedBytes() got1 = %v, want %v", st, tt.wantType)
+			}
+		})
+	}
+}
diff --git a/plumbing/object/tag.go b/plumbing/object/tag.go
index 216010d..cf46c08 100644
--- a/plumbing/object/tag.go
+++ b/plumbing/object/tag.go
@@ -1,18 +1,16 @@
 package object
 
 import (
-	"bufio"
 	"bytes"
 	"fmt"
 	"io"
-	stdioutil "io/ioutil"
 	"strings"
 
 	"github.com/ProtonMail/go-crypto/openpgp"
-
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 // Tag represents an annotated tag object. It points to a single git object of
@@ -93,9 +91,9 @@ func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 	}
 	defer ioutil.CheckClose(reader, &err)
 
-	r := bufPool.Get().(*bufio.Reader)
-	defer bufPool.Put(r)
-	r.Reset(reader)
+	r := sync.GetBufioReader(reader)
+	defer sync.PutBufioReader(r)
+
 	for {
 		var line []byte
 		line, err = r.ReadBytes('\n')
@@ -128,40 +126,15 @@ func (t *Tag) Decode(o plumbing.EncodedObject) (err error) {
 		}
 	}
 
-	data, err := stdioutil.ReadAll(r)
+	data, err := io.ReadAll(r)
 	if err != nil {
 		return err
 	}
-
-	var pgpsig bool
-	// Check if data contains PGP signature.
-	if bytes.Contains(data, []byte(beginpgp)) {
-		// Split the lines at newline.
-		messageAndSig := bytes.Split(data, []byte("\n"))
-
-		for _, l := range messageAndSig {
-			if pgpsig {
-				if bytes.Contains(l, []byte(endpgp)) {
-					t.PGPSignature += endpgp + "\n"
-					break
-				} else {
-					t.PGPSignature += string(l) + "\n"
-				}
-				continue
-			}
-
-			// Check if it's the beginning of a PGP signature.
-			if bytes.Contains(l, []byte(beginpgp)) {
-				t.PGPSignature += beginpgp + "\n"
-				pgpsig = true
-				continue
-			}
-
-			t.Message += string(l) + "\n"
-		}
-	} else {
-		t.Message = string(data)
+	if sm, _ := parseSignedBytes(data); sm >= 0 {
+		t.PGPSignature = string(data[sm:])
+		data = data[:sm]
 	}
+	t.Message = string(data)
 
 	return nil
 }
diff --git a/plumbing/object/tag_test.go b/plumbing/object/tag_test.go
index cd1d15d..d374c6c 100644
--- a/plumbing/object/tag_test.go
+++ b/plumbing/object/tag_test.go
@@ -3,7 +3,6 @@ package object
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"strings"
 	"time"
 
@@ -312,6 +311,27 @@ RUysgqjcpT8+iQM1PblGfHR4XAhuOqN5Fx06PSaFZhqvWFezJ28/CLyX5q+oIVk=
 	c.Assert(decoded.PGPSignature, Equals, pgpsignature)
 }
 
+func (s *TagSuite) TestSSHSignatureSerialization(c *C) {
+	encoded := &plumbing.MemoryObject{}
+	decoded := &Tag{}
+	tag := s.tag(c, plumbing.NewHash("b742a2a9fa0afcfa9a6fad080980fbc26b007c69"))
+
+	signature := `-----BEGIN SSH SIGNATURE-----
+U1NIU0lHAAAAAQAAADMAAAALc3NoLWVkMjU1MTkAAAAgij/EfHS8tCjolj5uEANXgKzFfp
+0D7wOhjWVbYZH6KugAAAADZ2l0AAAAAAAAAAZzaGE1MTIAAABTAAAAC3NzaC1lZDI1NTE5
+AAAAQIYHMhSVV9L2xwJuV8eWMLjThya8yXgCHDzw3p01D19KirrabW0veiichPB5m+Ihtr
+MKEQruIQWJb+8HVXwssA4=
+-----END SSH SIGNATURE-----`
+	tag.PGPSignature = signature
+
+	err := tag.Encode(encoded)
+	c.Assert(err, IsNil)
+
+	err = decoded.Decode(encoded)
+	c.Assert(err, IsNil)
+	c.Assert(decoded.PGPSignature, Equals, signature)
+}
+
 func (s *TagSuite) TestVerify(c *C) {
 	ts := time.Unix(1617403017, 0)
 	loc, _ := time.LoadLocation("UTC")
@@ -445,7 +465,7 @@ func (s *TagSuite) TestEncodeWithoutSignature(c *C) {
 	c.Assert(err, IsNil)
 	er, err := encoded.Reader()
 	c.Assert(err, IsNil)
-	payload, err := ioutil.ReadAll(er)
+	payload, err := io.ReadAll(er)
 	c.Assert(err, IsNil)
 
 	c.Assert(string(payload), Equals, ""+
diff --git a/plumbing/object/tree.go b/plumbing/object/tree.go
index 5e6378c..e9f7666 100644
--- a/plumbing/object/tree.go
+++ b/plumbing/object/tree.go
@@ -1,7 +1,6 @@
 package object
 
 import (
-	"bufio"
 	"context"
 	"errors"
 	"fmt"
@@ -14,6 +13,7 @@ import (
 	"github.com/go-git/go-git/v5/plumbing/filemode"
 	"github.com/go-git/go-git/v5/plumbing/storer"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/go-git/go-git/v5/utils/sync"
 )
 
 const (
@@ -230,9 +230,9 @@ func (t *Tree) Decode(o plumbing.EncodedObject) (err error) {
 	}
 	defer ioutil.CheckClose(reader, &err)
 
-	r := bufPool.Get().(*bufio.Reader)
-	defer bufPool.Put(r)
-	r.Reset(reader)
+	r := sync.GetBufioReader(reader)
+	defer sync.PutBufioReader(r)
+
 	for {
 		str, err := r.ReadString(' ')
 		if err != nil {
diff --git a/plumbing/protocol/packp/advrefs.go b/plumbing/protocol/packp/advrefs.go
index 1bd724c..f93ad30 100644
--- a/plumbing/protocol/packp/advrefs.go
+++ b/plumbing/protocol/packp/advrefs.go
@@ -57,7 +57,7 @@ func (a *AdvRefs) AddReference(r *plumbing.Reference) error {
 	switch r.Type() {
 	case plumbing.SymbolicReference:
 		v := fmt.Sprintf("%s:%s", r.Name().String(), r.Target().String())
-		a.Capabilities.Add(capability.SymRef, v)
+		return a.Capabilities.Add(capability.SymRef, v)
 	case plumbing.HashReference:
 		a.References[r.Name().String()] = r.Hash()
 	default:
@@ -96,12 +96,12 @@ func (a *AdvRefs) addRefs(s storer.ReferenceStorer) error {
 //
 // Git versions prior to 1.8.4.3 has an special procedure to get
 // the reference where is pointing to HEAD:
-// - Check if a reference called master exists. If exists and it
-//	 has the same hash as HEAD hash, we can say that HEAD is pointing to master
-// - If master does not exists or does not have the same hash as HEAD,
-//   order references and check in that order if that reference has the same
-//   hash than HEAD. If yes, set HEAD pointing to that branch hash
-// - If no reference is found, throw an error
+//   - Check if a reference called master exists. If exists and it
+//     has the same hash as HEAD hash, we can say that HEAD is pointing to master
+//   - If master does not exists or does not have the same hash as HEAD,
+//     order references and check in that order if that reference has the same
+//     hash than HEAD. If yes, set HEAD pointing to that branch hash
+//   - If no reference is found, throw an error
 func (a *AdvRefs) resolveHead(s storer.ReferenceStorer) error {
 	if a.Head == nil {
 		return nil
diff --git a/plumbing/protocol/packp/advrefs_decode.go b/plumbing/protocol/packp/advrefs_decode.go
index 63bbe5a..f8d26a2 100644
--- a/plumbing/protocol/packp/advrefs_decode.go
+++ b/plumbing/protocol/packp/advrefs_decode.go
@@ -133,6 +133,7 @@ func decodeFirstHash(p *advRefsDecoder) decoderStateFn {
 		return nil
 	}
 
+	// TODO: Use object-format (when available) for hash size. Git 2.41+
 	if len(p.line) < hashSize {
 		p.error("cannot read hash, pkt-line too short")
 		return nil
diff --git a/plumbing/protocol/packp/advrefs_decode_test.go b/plumbing/protocol/packp/advrefs_decode_test.go
index 83b0b01..d127145 100644
--- a/plumbing/protocol/packp/advrefs_decode_test.go
+++ b/plumbing/protocol/packp/advrefs_decode_test.go
@@ -218,6 +218,16 @@ func (s *AdvRefsDecodeSuite) TestCaps(c *C) {
 			{Name: capability.SymRef, Values: []string{"HEAD:refs/heads/master"}},
 			{Name: capability.Agent, Values: []string{"foo=bar"}},
 		},
+	}, {
+		input: []string{
+			"0000000000000000000000000000000000000000 capabilities^{}\x00report-status report-status-v2 delete-refs side-band-64k quiet atomic ofs-delta object-format=sha1 agent=git/2.41.0\n",
+			pktline.FlushString,
+		},
+		capabilities: []entry{
+			{Name: capability.ReportStatus, Values: []string(nil)},
+			{Name: capability.ObjectFormat, Values: []string{"sha1"}},
+			{Name: capability.Agent, Values: []string{"git/2.41.0"}},
+		},
 	}} {
 		ar := s.testDecodeOK(c, test.input)
 		for _, fixCap := range test.capabilities {
diff --git a/plumbing/protocol/packp/capability/capability.go b/plumbing/protocol/packp/capability/capability.go
index 8d6a56f..b52e8a4 100644
--- a/plumbing/protocol/packp/capability/capability.go
+++ b/plumbing/protocol/packp/capability/capability.go
@@ -1,6 +1,11 @@
 // Package capability defines the server and client capabilities.
 package capability
 
+import (
+	"fmt"
+	"os"
+)
+
 // Capability describes a server or client capability.
 type Capability string
 
@@ -238,7 +243,15 @@ const (
 	Filter Capability = "filter"
 )
 
-const DefaultAgent = "go-git/4.x"
+const userAgent = "go-git/5.x"
+
+// DefaultAgent provides the user agent string.
+func DefaultAgent() string {
+	if envUserAgent, ok := os.LookupEnv("GO_GIT_USER_AGENT_EXTRA"); ok {
+		return fmt.Sprintf("%s %s", userAgent, envUserAgent)
+	}
+	return userAgent
+}
 
 var known = map[Capability]bool{
 	MultiACK: true, MultiACKDetailed: true, NoDone: true, ThinPack: true,
diff --git a/plumbing/protocol/packp/capability/capability_test.go b/plumbing/protocol/packp/capability/capability_test.go
new file mode 100644
index 0000000..f1fd028
--- /dev/null
+++ b/plumbing/protocol/packp/capability/capability_test.go
@@ -0,0 +1,22 @@
+package capability
+
+import (
+	"fmt"
+	"os"
+
+	check "gopkg.in/check.v1"
+)
+
+var _ = check.Suite(&SuiteCapabilities{})
+
+func (s *SuiteCapabilities) TestDefaultAgent(c *check.C) {
+	os.Unsetenv("GO_GIT_USER_AGENT_EXTRA")
+	ua := DefaultAgent()
+	c.Assert(ua, check.Equals, userAgent)
+}
+
+func (s *SuiteCapabilities) TestEnvAgent(c *check.C) {
+	os.Setenv("GO_GIT_USER_AGENT_EXTRA", "abc xyz")
+	ua := DefaultAgent()
+	c.Assert(ua, check.Equals, fmt.Sprintf("%s %s", userAgent, "abc xyz"))
+}
diff --git a/plumbing/protocol/packp/capability/list.go b/plumbing/protocol/packp/capability/list.go
index f41ec79..553d81c 100644
--- a/plumbing/protocol/packp/capability/list.go
+++ b/plumbing/protocol/packp/capability/list.go
@@ -86,7 +86,9 @@ func (l *List) Get(capability Capability) []string {
 
 // Set sets a capability removing the previous values
 func (l *List) Set(capability Capability, values ...string) error {
-	delete(l.m, capability)
+	if _, ok := l.m[capability]; ok {
+		l.m[capability].Values = l.m[capability].Values[:0]
+	}
 	return l.Add(capability, values...)
 }
 
diff --git a/plumbing/protocol/packp/capability/list_test.go b/plumbing/protocol/packp/capability/list_test.go
index 61b0b13..71181cb 100644
--- a/plumbing/protocol/packp/capability/list_test.go
+++ b/plumbing/protocol/packp/capability/list_test.go
@@ -122,6 +122,17 @@ func (s *SuiteCapabilities) TestSetEmpty(c *check.C) {
 	c.Assert(cap.Get(Agent), check.HasLen, 1)
 }
 
+func (s *SuiteCapabilities) TestSetDuplicate(c *check.C) {
+	cap := NewList()
+	err := cap.Set(Agent, "baz")
+	c.Assert(err, check.IsNil)
+
+	err = cap.Set(Agent, "bar")
+	c.Assert(err, check.IsNil)
+
+	c.Assert(cap.String(), check.Equals, "agent=bar")
+}
+
 func (s *SuiteCapabilities) TestGetEmpty(c *check.C) {
 	cap := NewList()
 	c.Assert(cap.Get(Agent), check.HasLen, 0)
diff --git a/plumbing/protocol/packp/sideband/demux_test.go b/plumbing/protocol/packp/sideband/demux_test.go
index 6cda703..8f23353 100644
--- a/plumbing/protocol/packp/sideband/demux_test.go
+++ b/plumbing/protocol/packp/sideband/demux_test.go
@@ -4,7 +4,6 @@ import (
 	"bytes"
 	"errors"
 	"io"
-	"io/ioutil"
 	"testing"
 
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
@@ -101,7 +100,7 @@ func (s *SidebandSuite) TestDecodeWithProgress(c *C) {
 	c.Assert(n, Equals, 26)
 	c.Assert(content, DeepEquals, expected)
 
-	progress, err := ioutil.ReadAll(output)
+	progress, err := io.ReadAll(output)
 	c.Assert(err, IsNil)
 	c.Assert(progress, DeepEquals, []byte{'F', 'O', 'O', '\n'})
 }
diff --git a/plumbing/protocol/packp/srvresp.go b/plumbing/protocol/packp/srvresp.go
index b3a7ee8..8cd0a72 100644
--- a/plumbing/protocol/packp/srvresp.go
+++ b/plumbing/protocol/packp/srvresp.go
@@ -21,11 +21,6 @@ type ServerResponse struct {
 // Decode decodes the response into the struct, isMultiACK should be true, if
 // the request was done with multi_ack or multi_ack_detailed capabilities.
 func (r *ServerResponse) Decode(reader *bufio.Reader, isMultiACK bool) error {
-	// TODO: implement support for multi_ack or multi_ack_detailed responses
-	if isMultiACK {
-		return errors.New("multi_ack and multi_ack_detailed are not supported")
-	}
-
 	s := pktline.NewScanner(reader)
 
 	for s.Scan() {
@@ -48,7 +43,23 @@ func (r *ServerResponse) Decode(reader *bufio.Reader, isMultiACK bool) error {
 		}
 	}
 
-	return s.Err()
+	// isMultiACK is true when the remote server advertises the related
+	// capabilities when they are not in transport.UnsupportedCapabilities.
+	//
+	// Users may decide to remove multi_ack and multi_ack_detailed from the
+	// unsupported capabilities list, which allows them to do initial clones
+	// from Azure DevOps.
+	//
+	// Follow-up fetches may error, therefore errors are wrapped with additional
+	// information highlighting that this capabilities are not supported by go-git.
+	//
+	// TODO: Implement support for multi_ack or multi_ack_detailed responses.
+	err := s.Err()
+	if err != nil && isMultiACK {
+		return fmt.Errorf("multi_ack and multi_ack_detailed are not supported: %w", err)
+	}
+
+	return err
 }
 
 // stopReading detects when a valid command such as ACK or NAK is found to be
@@ -113,8 +124,9 @@ func (r *ServerResponse) decodeACKLine(line []byte) error {
 }
 
 // Encode encodes the ServerResponse into a writer.
-func (r *ServerResponse) Encode(w io.Writer) error {
-	if len(r.ACKs) > 1 {
+func (r *ServerResponse) Encode(w io.Writer, isMultiACK bool) error {
+	if len(r.ACKs) > 1 && !isMultiACK {
+		// For further information, refer to comments in the Decode func above.
 		return errors.New("multi_ack and multi_ack_detailed are not supported")
 	}
 
diff --git a/plumbing/protocol/packp/srvresp_test.go b/plumbing/protocol/packp/srvresp_test.go
index 02fab42..aa0af52 100644
--- a/plumbing/protocol/packp/srvresp_test.go
+++ b/plumbing/protocol/packp/srvresp_test.go
@@ -72,8 +72,21 @@ func (s *ServerResponseSuite) TestDecodeMalformed(c *C) {
 	c.Assert(err, NotNil)
 }
 
+// multi_ack isn't fully implemented, this ensures that Decode ignores that fact,
+// as in some circumstances that's OK to assume so.
+//
+// TODO: Review as part of multi_ack implementation.
 func (s *ServerResponseSuite) TestDecodeMultiACK(c *C) {
+	raw := "" +
+		"0031ACK 1111111111111111111111111111111111111111\n" +
+		"0031ACK 6ecf0ef2c2dffb796033e5a02219af86ec6584e5\n" +
+		"00080PACK\n"
+
 	sr := &ServerResponse{}
-	err := sr.Decode(bufio.NewReader(bytes.NewBuffer(nil)), true)
-	c.Assert(err, NotNil)
+	err := sr.Decode(bufio.NewReader(bytes.NewBufferString(raw)), true)
+	c.Assert(err, IsNil)
+
+	c.Assert(sr.ACKs, HasLen, 2)
+	c.Assert(sr.ACKs[0], Equals, plumbing.NewHash("1111111111111111111111111111111111111111"))
+	c.Assert(sr.ACKs[1], Equals, plumbing.NewHash("6ecf0ef2c2dffb796033e5a02219af86ec6584e5"))
 }
diff --git a/plumbing/protocol/packp/ulreq.go b/plumbing/protocol/packp/ulreq.go
index ddec06e..344f8c7 100644
--- a/plumbing/protocol/packp/ulreq.go
+++ b/plumbing/protocol/packp/ulreq.go
@@ -95,7 +95,7 @@ func NewUploadRequestFromCapabilities(adv *capability.List) *UploadRequest {
 	}
 
 	if adv.Supports(capability.Agent) {
-		r.Capabilities.Set(capability.Agent, capability.DefaultAgent)
+		r.Capabilities.Set(capability.Agent, capability.DefaultAgent())
 	}
 
 	return r
diff --git a/plumbing/protocol/packp/ulreq_decode_test.go b/plumbing/protocol/packp/ulreq_decode_test.go
index 9628f0f..efcc7b4 100644
--- a/plumbing/protocol/packp/ulreq_decode_test.go
+++ b/plumbing/protocol/packp/ulreq_decode_test.go
@@ -8,6 +8,7 @@ import (
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
+	"github.com/go-git/go-git/v5/plumbing/hash"
 	"github.com/go-git/go-git/v5/plumbing/protocol/packp/capability"
 
 	. "gopkg.in/check.v1"
@@ -119,8 +120,8 @@ type byHash []plumbing.Hash
 func (a byHash) Len() int      { return len(a) }
 func (a byHash) Swap(i, j int) { a[i], a[j] = a[j], a[i] }
 func (a byHash) Less(i, j int) bool {
-	ii := [20]byte(a[i])
-	jj := [20]byte(a[j])
+	ii := [hash.Size]byte(a[i])
+	jj := [hash.Size]byte(a[j])
 	return bytes.Compare(ii[:], jj[:]) < 0
 }
 
diff --git a/plumbing/protocol/packp/ulreq_test.go b/plumbing/protocol/packp/ulreq_test.go
index 0b3b616..2797a4e 100644
--- a/plumbing/protocol/packp/ulreq_test.go
+++ b/plumbing/protocol/packp/ulreq_test.go
@@ -25,7 +25,7 @@ func (s *UlReqSuite) TestNewUploadRequestFromCapabilities(c *C) {
 
 	r := NewUploadRequestFromCapabilities(cap)
 	c.Assert(r.Capabilities.String(), Equals,
-		"multi_ack_detailed side-band-64k thin-pack ofs-delta agent=go-git/4.x",
+		"multi_ack_detailed side-band-64k thin-pack ofs-delta agent=go-git/5.x",
 	)
 }
 
diff --git a/plumbing/protocol/packp/updreq.go b/plumbing/protocol/packp/updreq.go
index 5dbd8ac..8f39b39 100644
--- a/plumbing/protocol/packp/updreq.go
+++ b/plumbing/protocol/packp/updreq.go
@@ -59,7 +59,7 @@ func NewReferenceUpdateRequestFromCapabilities(adv *capability.List) *ReferenceU
 	r := NewReferenceUpdateRequest()
 
 	if adv.Supports(capability.Agent) {
-		r.Capabilities.Set(capability.Agent, capability.DefaultAgent)
+		r.Capabilities.Set(capability.Agent, capability.DefaultAgent())
 	}
 
 	if adv.Supports(capability.ReportStatus) {
diff --git a/plumbing/protocol/packp/updreq_decode.go b/plumbing/protocol/packp/updreq_decode.go
index 2c9843a..076de54 100644
--- a/plumbing/protocol/packp/updreq_decode.go
+++ b/plumbing/protocol/packp/updreq_decode.go
@@ -6,7 +6,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	"io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
@@ -81,7 +80,7 @@ func (req *ReferenceUpdateRequest) Decode(r io.Reader) error {
 	var ok bool
 	rc, ok = r.(io.ReadCloser)
 	if !ok {
-		rc = ioutil.NopCloser(r)
+		rc = io.NopCloser(r)
 	}
 
 	d := &updReqDecoder{r: rc, s: pktline.NewScanner(r)}
diff --git a/plumbing/protocol/packp/updreq_decode_test.go b/plumbing/protocol/packp/updreq_decode_test.go
index 2630112..bdcbdf5 100644
--- a/plumbing/protocol/packp/updreq_decode_test.go
+++ b/plumbing/protocol/packp/updreq_decode_test.go
@@ -3,7 +3,6 @@ package packp
 import (
 	"bytes"
 	"io"
-	"io/ioutil"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
@@ -157,7 +156,7 @@ func (s *UpdReqDecodeSuite) TestOneUpdateCommand(c *C) {
 	expected.Commands = []*Command{
 		{Name: name, Old: hash1, New: hash2},
 	}
-	expected.Packfile = ioutil.NopCloser(bytes.NewReader([]byte{}))
+	expected.Packfile = io.NopCloser(bytes.NewReader([]byte{}))
 
 	payloads := []string{
 		"1ecf0ef2c2dffb796033e5a02219af86ec6584e5 2ecf0ef2c2dffb796033e5a02219af86ec6584e5 myref\x00",
@@ -177,7 +176,7 @@ func (s *UpdReqDecodeSuite) TestMultipleCommands(c *C) {
 		{Name: plumbing.ReferenceName("myref2"), Old: plumbing.ZeroHash, New: hash2},
 		{Name: plumbing.ReferenceName("myref3"), Old: hash1, New: plumbing.ZeroHash},
 	}
-	expected.Packfile = ioutil.NopCloser(bytes.NewReader([]byte{}))
+	expected.Packfile = io.NopCloser(bytes.NewReader([]byte{}))
 
 	payloads := []string{
 		"1ecf0ef2c2dffb796033e5a02219af86ec6584e5 2ecf0ef2c2dffb796033e5a02219af86ec6584e5 myref1\x00",
@@ -200,7 +199,7 @@ func (s *UpdReqDecodeSuite) TestMultipleCommandsAndCapabilities(c *C) {
 		{Name: plumbing.ReferenceName("myref3"), Old: hash1, New: plumbing.ZeroHash},
 	}
 	expected.Capabilities.Add("shallow")
-	expected.Packfile = ioutil.NopCloser(bytes.NewReader([]byte{}))
+	expected.Packfile = io.NopCloser(bytes.NewReader([]byte{}))
 
 	payloads := []string{
 		"1ecf0ef2c2dffb796033e5a02219af86ec6584e5 2ecf0ef2c2dffb796033e5a02219af86ec6584e5 myref1\x00shallow",
@@ -224,7 +223,7 @@ func (s *UpdReqDecodeSuite) TestMultipleCommandsAndCapabilitiesShallow(c *C) {
 	}
 	expected.Capabilities.Add("shallow")
 	expected.Shallow = &hash1
-	expected.Packfile = ioutil.NopCloser(bytes.NewReader([]byte{}))
+	expected.Packfile = io.NopCloser(bytes.NewReader([]byte{}))
 
 	payloads := []string{
 		"shallow 1ecf0ef2c2dffb796033e5a02219af86ec6584e5",
@@ -247,7 +246,7 @@ func (s *UpdReqDecodeSuite) TestWithPackfile(c *C) {
 		{Name: name, Old: hash1, New: hash2},
 	}
 	packfileContent := []byte("PACKabc")
-	expected.Packfile = ioutil.NopCloser(bytes.NewReader(packfileContent))
+	expected.Packfile = io.NopCloser(bytes.NewReader(packfileContent))
 
 	payloads := []string{
 		"1ecf0ef2c2dffb796033e5a02219af86ec6584e5 2ecf0ef2c2dffb796033e5a02219af86ec6584e5 myref\x00",
@@ -298,10 +297,10 @@ func (s *UpdReqDecodeSuite) testDecodeOkExpected(c *C, expected *ReferenceUpdate
 }
 
 func (s *UpdReqDecodeSuite) compareReaders(c *C, a io.ReadCloser, b io.ReadCloser) {
-	pba, err := ioutil.ReadAll(a)
+	pba, err := io.ReadAll(a)
 	c.Assert(err, IsNil)
 	c.Assert(a.Close(), IsNil)
-	pbb, err := ioutil.ReadAll(b)
+	pbb, err := io.ReadAll(b)
 	c.Assert(err, IsNil)
 	c.Assert(b.Close(), IsNil)
 	c.Assert(pba, DeepEquals, pbb)
diff --git a/plumbing/protocol/packp/updreq_encode_test.go b/plumbing/protocol/packp/updreq_encode_test.go
index 4370b79..97868bd 100644
--- a/plumbing/protocol/packp/updreq_encode_test.go
+++ b/plumbing/protocol/packp/updreq_encode_test.go
@@ -2,13 +2,12 @@ package packp
 
 import (
 	"bytes"
+	"io"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
 	"github.com/go-git/go-git/v5/plumbing/protocol/packp/capability"
 
-	"io/ioutil"
-
 	. "gopkg.in/check.v1"
 )
 
@@ -128,7 +127,7 @@ func (s *UpdReqEncodeSuite) TestWithPackfile(c *C) {
 
 	packfileContent := []byte("PACKabc")
 	packfileReader := bytes.NewReader(packfileContent)
-	packfileReadCloser := ioutil.NopCloser(packfileReader)
+	packfileReadCloser := io.NopCloser(packfileReader)
 
 	r := NewReferenceUpdateRequest()
 	r.Commands = []*Command{
diff --git a/plumbing/protocol/packp/updreq_test.go b/plumbing/protocol/packp/updreq_test.go
index c4ccbaf..80e03fb 100644
--- a/plumbing/protocol/packp/updreq_test.go
+++ b/plumbing/protocol/packp/updreq_test.go
@@ -23,14 +23,14 @@ func (s *UpdReqSuite) TestNewReferenceUpdateRequestFromCapabilities(c *C) {
 
 	r := NewReferenceUpdateRequestFromCapabilities(cap)
 	c.Assert(r.Capabilities.String(), Equals,
-		"agent=go-git/4.x report-status",
+		"agent=go-git/5.x report-status",
 	)
 
 	cap = capability.NewList()
 	cap.Set(capability.Agent, "foo")
 
 	r = NewReferenceUpdateRequestFromCapabilities(cap)
-	c.Assert(r.Capabilities.String(), Equals, "agent=go-git/4.x")
+	c.Assert(r.Capabilities.String(), Equals, "agent=go-git/5.x")
 
 	cap = capability.NewList()
 
diff --git a/plumbing/protocol/packp/uppackreq.go b/plumbing/protocol/packp/uppackreq.go
index de2206b..48f4438 100644
--- a/plumbing/protocol/packp/uppackreq.go
+++ b/plumbing/protocol/packp/uppackreq.go
@@ -38,10 +38,10 @@ func NewUploadPackRequestFromCapabilities(adv *capability.List) *UploadPackReque
 	}
 }
 
-// IsEmpty a request if empty if Haves are contained in the Wants, or if Wants
-// length is zero
+// IsEmpty returns whether a request is empty - it is empty if Haves are contained
+// in the Wants, or if Wants length is zero, and we don't have any shallows
 func (r *UploadPackRequest) IsEmpty() bool {
-	return isSubset(r.Wants, r.Haves)
+	return isSubset(r.Wants, r.Haves) && len(r.Shallows) == 0
 }
 
 func isSubset(needle []plumbing.Hash, haystack []plumbing.Hash) bool {
diff --git a/plumbing/protocol/packp/uppackreq_test.go b/plumbing/protocol/packp/uppackreq_test.go
index f723e3c..ad38565 100644
--- a/plumbing/protocol/packp/uppackreq_test.go
+++ b/plumbing/protocol/packp/uppackreq_test.go
@@ -18,7 +18,7 @@ func (s *UploadPackRequestSuite) TestNewUploadPackRequestFromCapabilities(c *C)
 	cap.Set(capability.Agent, "foo")
 
 	r := NewUploadPackRequestFromCapabilities(cap)
-	c.Assert(r.Capabilities.String(), Equals, "agent=go-git/4.x")
+	c.Assert(r.Capabilities.String(), Equals, "agent=go-git/5.x")
 }
 
 func (s *UploadPackRequestSuite) TestIsEmpty(c *C) {
@@ -41,6 +41,13 @@ func (s *UploadPackRequestSuite) TestIsEmpty(c *C) {
 	r.Haves = append(r.Haves, plumbing.NewHash("d82f291cde9987322c8a0c81a325e1ba6159684c"))
 
 	c.Assert(r.IsEmpty(), Equals, true)
+
+	r = NewUploadPackRequest()
+	r.Wants = append(r.Wants, plumbing.NewHash("d82f291cde9987322c8a0c81a325e1ba6159684c"))
+	r.Haves = append(r.Haves, plumbing.NewHash("d82f291cde9987322c8a0c81a325e1ba6159684c"))
+	r.Shallows = append(r.Shallows, plumbing.NewHash("2b41ef280fdb67a9b250678686a0c3e03b0a9989"))
+
+	c.Assert(r.IsEmpty(), Equals, false)
 }
 
 type UploadHavesSuite struct{}
diff --git a/plumbing/protocol/packp/uppackresp.go b/plumbing/protocol/packp/uppackresp.go
index 26ae61e..a485cb7 100644
--- a/plumbing/protocol/packp/uppackresp.go
+++ b/plumbing/protocol/packp/uppackresp.go
@@ -78,7 +78,7 @@ func (r *UploadPackResponse) Encode(w io.Writer) (err error) {
 		}
 	}
 
-	if err := r.ServerResponse.Encode(w); err != nil {
+	if err := r.ServerResponse.Encode(w, r.isMultiACK); err != nil {
 		return err
 	}
 
diff --git a/plumbing/protocol/packp/uppackresp_test.go b/plumbing/protocol/packp/uppackresp_test.go
index 260dc57..8fbf924 100644
--- a/plumbing/protocol/packp/uppackresp_test.go
+++ b/plumbing/protocol/packp/uppackresp_test.go
@@ -2,7 +2,7 @@ package packp
 
 import (
 	"bytes"
-	"io/ioutil"
+	"io"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/protocol/packp/capability"
@@ -21,10 +21,10 @@ func (s *UploadPackResponseSuite) TestDecodeNAK(c *C) {
 	res := NewUploadPackResponse(req)
 	defer res.Close()
 
-	err := res.Decode(ioutil.NopCloser(bytes.NewBufferString(raw)))
+	err := res.Decode(io.NopCloser(bytes.NewBufferString(raw)))
 	c.Assert(err, IsNil)
 
-	pack, err := ioutil.ReadAll(res)
+	pack, err := io.ReadAll(res)
 	c.Assert(err, IsNil)
 	c.Assert(pack, DeepEquals, []byte("PACK"))
 }
@@ -38,10 +38,10 @@ func (s *UploadPackResponseSuite) TestDecodeDepth(c *C) {
 	res := NewUploadPackResponse(req)
 	defer res.Close()
 
-	err := res.Decode(ioutil.NopCloser(bytes.NewBufferString(raw)))
+	err := res.Decode(io.NopCloser(bytes.NewBufferString(raw)))
 	c.Assert(err, IsNil)
 
-	pack, err := ioutil.ReadAll(res)
+	pack, err := io.ReadAll(res)
 	c.Assert(err, IsNil)
 	c.Assert(pack, DeepEquals, []byte("PACK"))
 }
@@ -55,10 +55,14 @@ func (s *UploadPackResponseSuite) TestDecodeMalformed(c *C) {
 	res := NewUploadPackResponse(req)
 	defer res.Close()
 
-	err := res.Decode(ioutil.NopCloser(bytes.NewBufferString(raw)))
+	err := res.Decode(io.NopCloser(bytes.NewBufferString(raw)))
 	c.Assert(err, NotNil)
 }
 
+// multi_ack isn't fully implemented, this ensures that Decode ignores that fact,
+// as in some circumstances that's OK to assume so.
+//
+// TODO: Review as part of multi_ack implementation.
 func (s *UploadPackResponseSuite) TestDecodeMultiACK(c *C) {
 	req := NewUploadPackRequest()
 	req.Capabilities.Set(capability.MultiACK)
@@ -66,8 +70,8 @@ func (s *UploadPackResponseSuite) TestDecodeMultiACK(c *C) {
 	res := NewUploadPackResponse(req)
 	defer res.Close()
 
-	err := res.Decode(ioutil.NopCloser(bytes.NewBuffer(nil)))
-	c.Assert(err, NotNil)
+	err := res.Decode(io.NopCloser(bytes.NewBuffer(nil)))
+	c.Assert(err, IsNil)
 }
 
 func (s *UploadPackResponseSuite) TestReadNoDecode(c *C) {
@@ -83,7 +87,7 @@ func (s *UploadPackResponseSuite) TestReadNoDecode(c *C) {
 }
 
 func (s *UploadPackResponseSuite) TestEncodeNAK(c *C) {
-	pf := ioutil.NopCloser(bytes.NewBuffer([]byte("[PACK]")))
+	pf := io.NopCloser(bytes.NewBuffer([]byte("[PACK]")))
 	req := NewUploadPackRequest()
 	res := NewUploadPackResponseWithPackfile(req, pf)
 	defer func() { c.Assert(res.Close(), IsNil) }()
@@ -96,7 +100,7 @@ func (s *UploadPackResponseSuite) TestEncodeNAK(c *C) {
 }
 
 func (s *UploadPackResponseSuite) TestEncodeDepth(c *C) {
-	pf := ioutil.NopCloser(bytes.NewBuffer([]byte("PACK")))
+	pf := io.NopCloser(bytes.NewBuffer([]byte("PACK")))
 	req := NewUploadPackRequest()
 	req.Depth = DepthCommits(1)
 
@@ -111,7 +115,7 @@ func (s *UploadPackResponseSuite) TestEncodeDepth(c *C) {
 }
 
 func (s *UploadPackResponseSuite) TestEncodeMultiACK(c *C) {
-	pf := ioutil.NopCloser(bytes.NewBuffer([]byte("[PACK]")))
+	pf := io.NopCloser(bytes.NewBuffer([]byte("[PACK]")))
 	req := NewUploadPackRequest()
 
 	res := NewUploadPackResponseWithPackfile(req, pf)
diff --git a/plumbing/reference.go b/plumbing/reference.go
index 08e908f..5a67f69 100644
--- a/plumbing/reference.go
+++ b/plumbing/reference.go
@@ -15,10 +15,11 @@ const (
 	symrefPrefix    = "ref: "
 )
 
-// RefRevParseRules are a set of rules to parse references into short names.
-// These are the same rules as used by git in shorten_unambiguous_ref.
+// RefRevParseRules are a set of rules to parse references into short names, or expand into a full reference.
+// These are the same rules as used by git in shorten_unambiguous_ref and expand_ref.
 // See: https://github.com/git/git/blob/e0aaa1b6532cfce93d87af9bc813fb2e7a7ce9d7/refs.c#L417
 var RefRevParseRules = []string{
+	"%s",
 	"refs/%s",
 	"refs/tags/%s",
 	"refs/heads/%s",
@@ -113,7 +114,7 @@ func (r ReferenceName) String() string {
 func (r ReferenceName) Short() string {
 	s := string(r)
 	res := s
-	for _, format := range RefRevParseRules {
+	for _, format := range RefRevParseRules[1:] {
 		_, err := fmt.Sscanf(s, format, &res)
 		if err == nil {
 			continue
@@ -126,6 +127,7 @@ func (r ReferenceName) Short() string {
 const (
 	HEAD   ReferenceName = "HEAD"
 	Master ReferenceName = "refs/heads/master"
+	Main   ReferenceName = "refs/heads/main"
 )
 
 // Reference is a representation of git reference
@@ -168,22 +170,22 @@ func NewHashReference(n ReferenceName, h Hash) *Reference {
 	}
 }
 
-// Type return the type of a reference
+// Type returns the type of a reference
 func (r *Reference) Type() ReferenceType {
 	return r.t
 }
 
-// Name return the name of a reference
+// Name returns the name of a reference
 func (r *Reference) Name() ReferenceName {
 	return r.n
 }
 
-// Hash return the hash of a hash reference
+// Hash returns the hash of a hash reference
 func (r *Reference) Hash() Hash {
 	return r.h
 }
 
-// Target return the target of a symbolic reference
+// Target returns the target of a symbolic reference
 func (r *Reference) Target() ReferenceName {
 	return r.target
 }
@@ -204,6 +206,21 @@ func (r *Reference) Strings() [2]string {
 }
 
 func (r *Reference) String() string {
-	s := r.Strings()
-	return fmt.Sprintf("%s %s", s[1], s[0])
+	ref := ""
+	switch r.Type() {
+	case HashReference:
+		ref = r.Hash().String()
+	case SymbolicReference:
+		ref = symrefPrefix + r.Target().String()
+	default:
+		return ""
+	}
+
+	name := r.Name().String()
+	var v strings.Builder
+	v.Grow(len(ref) + len(name) + 1)
+	v.WriteString(ref)
+	v.WriteString(" ")
+	v.WriteString(name)
+	return v.String()
 }
diff --git a/plumbing/reference_test.go b/plumbing/reference_test.go
index b3ccf53..04dfef9 100644
--- a/plumbing/reference_test.go
+++ b/plumbing/reference_test.go
@@ -1,6 +1,10 @@
 package plumbing
 
-import . "gopkg.in/check.v1"
+import (
+	"testing"
+
+	. "gopkg.in/check.v1"
+)
 
 type ReferenceSuite struct{}
 
@@ -98,3 +102,21 @@ func (s *ReferenceSuite) TestIsTag(c *C) {
 	r := ReferenceName("refs/tags/v3.1.")
 	c.Assert(r.IsTag(), Equals, true)
 }
+
+func benchMarkReferenceString(r *Reference, b *testing.B) {
+	for n := 0; n < b.N; n++ {
+		_ = r.String()
+	}
+}
+
+func BenchmarkReferenceStringSymbolic(b *testing.B) {
+	benchMarkReferenceString(NewSymbolicReference("v3.1.1", "refs/tags/v3.1.1"), b)
+}
+
+func BenchmarkReferenceStringHash(b *testing.B) {
+	benchMarkReferenceString(NewHashReference("v3.1.1", NewHash("6ecf0ef2c2dffb796033e5a02219af86ec6584e5")), b)
+}
+
+func BenchmarkReferenceStringInvalid(b *testing.B) {
+	benchMarkReferenceString(&Reference{}, b)
+}
diff --git a/plumbing/transport/client/client.go b/plumbing/transport/client/client.go
index 20c3d05..1948c23 100644
--- a/plumbing/transport/client/client.go
+++ b/plumbing/transport/client/client.go
@@ -3,10 +3,7 @@
 package client
 
 import (
-	"crypto/tls"
-	"crypto/x509"
 	"fmt"
-	gohttp "net/http"
 
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	"github.com/go-git/go-git/v5/plumbing/transport/file"
@@ -24,14 +21,6 @@ var Protocols = map[string]transport.Transport{
 	"file":  file.DefaultClient,
 }
 
-var insecureClient = http.NewClient(&gohttp.Client{
-	Transport: &gohttp.Transport{
-		TLSClientConfig: &tls.Config{
-			InsecureSkipVerify: true,
-		},
-	},
-})
-
 // InstallProtocol adds or modifies an existing protocol.
 func InstallProtocol(scheme string, c transport.Transport) {
 	if c == nil {
@@ -50,27 +39,6 @@ func NewClient(endpoint *transport.Endpoint) (transport.Transport, error) {
 }
 
 func getTransport(endpoint *transport.Endpoint) (transport.Transport, error) {
-	if endpoint.Protocol == "https" {
-		if endpoint.InsecureSkipTLS {
-			return insecureClient, nil
-		}
-
-		if len(endpoint.CaBundle) != 0 {
-			rootCAs, _ := x509.SystemCertPool()
-			if rootCAs == nil {
-				rootCAs = x509.NewCertPool()
-			}
-			rootCAs.AppendCertsFromPEM(endpoint.CaBundle)
-			return http.NewClient(&gohttp.Client{
-				Transport: &gohttp.Transport{
-					TLSClientConfig: &tls.Config{
-						RootCAs: rootCAs,
-					},
-				},
-			}), nil
-		}
-	}
-
 	f, ok := Protocols[endpoint.Protocol]
 	if !ok {
 		return nil, fmt.Errorf("unsupported scheme %q", endpoint.Protocol)
diff --git a/plumbing/transport/common.go b/plumbing/transport/common.go
index a9ee2ca..c6a054a 100644
--- a/plumbing/transport/common.go
+++ b/plumbing/transport/common.go
@@ -112,10 +112,41 @@ type Endpoint struct {
 	Port int
 	// Path is the repository path.
 	Path string
-	// InsecureSkipTLS skips ssl verify if protocal is https
+	// InsecureSkipTLS skips ssl verify if protocol is https
 	InsecureSkipTLS bool
 	// CaBundle specify additional ca bundle with system cert pool
 	CaBundle []byte
+	// Proxy provides info required for connecting to a proxy.
+	Proxy ProxyOptions
+}
+
+type ProxyOptions struct {
+	URL      string
+	Username string
+	Password string
+}
+
+func (o *ProxyOptions) Validate() error {
+	if o.URL != "" {
+		_, err := url.Parse(o.URL)
+		return err
+	}
+	return nil
+}
+
+func (o *ProxyOptions) FullURL() (*url.URL, error) {
+	proxyURL, err := url.Parse(o.URL)
+	if err != nil {
+		return nil, err
+	}
+	if o.Username != "" {
+		if o.Password != "" {
+			proxyURL.User = url.UserPassword(o.Username, o.Password)
+		} else {
+			proxyURL.User = url.User(o.Username)
+		}
+	}
+	return proxyURL, nil
 }
 
 var defaultPorts = map[string]int{
@@ -196,11 +227,17 @@ func parseURL(endpoint string) (*Endpoint, error) {
 		pass, _ = u.User.Password()
 	}
 
+	host := u.Hostname()
+	if strings.Contains(host, ":") {
+		// IPv6 address
+		host = "[" + host + "]"
+	}
+
 	return &Endpoint{
 		Protocol: u.Scheme,
 		User:     user,
 		Password: pass,
-		Host:     u.Hostname(),
+		Host:     host,
 		Port:     getPort(u),
 		Path:     getPath(u),
 	}, nil
diff --git a/plumbing/transport/common_test.go b/plumbing/transport/common_test.go
index 0c5a01a..d9f12ab 100644
--- a/plumbing/transport/common_test.go
+++ b/plumbing/transport/common_test.go
@@ -95,16 +95,28 @@ func (s *SuiteCommon) TestNewEndpointSCPLike(c *C) {
 	c.Assert(e.String(), Equals, "ssh://git@github.com/user/repository.git")
 }
 
-func (s *SuiteCommon) TestNewEndpointSCPLikeWithPort(c *C) {
+func (s *SuiteCommon) TestNewEndpointSCPLikeWithNumericPath(c *C) {
 	e, err := NewEndpoint("git@github.com:9999/user/repository.git")
 	c.Assert(err, IsNil)
 	c.Assert(e.Protocol, Equals, "ssh")
 	c.Assert(e.User, Equals, "git")
 	c.Assert(e.Password, Equals, "")
 	c.Assert(e.Host, Equals, "github.com")
-	c.Assert(e.Port, Equals, 9999)
-	c.Assert(e.Path, Equals, "user/repository.git")
-	c.Assert(e.String(), Equals, "ssh://git@github.com:9999/user/repository.git")
+	c.Assert(e.Port, Equals, 22)
+	c.Assert(e.Path, Equals, "9999/user/repository.git")
+	c.Assert(e.String(), Equals, "ssh://git@github.com/9999/user/repository.git")
+}
+
+func (s *SuiteCommon) TestNewEndpointSCPLikeWithPort(c *C) {
+	e, err := NewEndpoint("git@github.com:8080:9999/user/repository.git")
+	c.Assert(err, IsNil)
+	c.Assert(e.Protocol, Equals, "ssh")
+	c.Assert(e.User, Equals, "git")
+	c.Assert(e.Password, Equals, "")
+	c.Assert(e.Host, Equals, "github.com")
+	c.Assert(e.Port, Equals, 8080)
+	c.Assert(e.Path, Equals, "9999/user/repository.git")
+	c.Assert(e.String(), Equals, "ssh://git@github.com:8080/9999/user/repository.git")
 }
 
 func (s *SuiteCommon) TestNewEndpointFileAbs(c *C) {
@@ -186,3 +198,15 @@ func (s *SuiteCommon) TestFilterUnsupportedCapabilities(c *C) {
 	FilterUnsupportedCapabilities(l)
 	c.Assert(l.Supports(capability.MultiACK), Equals, false)
 }
+
+func (s *SuiteCommon) TestNewEndpointIPv6(c *C) {
+	// see issue https://github.com/go-git/go-git/issues/740
+	//
+	//	IPv6 host names are not being properly handled, which results in unhelpful
+	//	error messages depending on the format used.
+	//
+	e, err := NewEndpoint("http://[::1]:8080/foo.git")
+	c.Assert(err, IsNil)
+	c.Assert(e.Host, Equals, "[::1]")
+	c.Assert(e.String(), Equals, "http://[::1]:8080/foo.git")
+}
diff --git a/plumbing/transport/file/common_test.go b/plumbing/transport/file/common_test.go
index 4d6612b..7e033a8 100644
--- a/plumbing/transport/file/common_test.go
+++ b/plumbing/transport/file/common_test.go
@@ -1,7 +1,6 @@
 package file
 
 import (
-	"io/ioutil"
 	"os"
 	"os/exec"
 	"path/filepath"
@@ -25,7 +24,7 @@ func (s *CommonSuite) SetUpSuite(c *C) {
 	}
 
 	var err error
-	s.tmpDir, err = ioutil.TempDir("", "")
+	s.tmpDir, err = os.MkdirTemp("", "")
 	c.Assert(err, IsNil)
 	s.ReceivePackBin = filepath.Join(s.tmpDir, "git-receive-pack")
 	s.UploadPackBin = filepath.Join(s.tmpDir, "git-upload-pack")
diff --git a/plumbing/transport/git/common.go b/plumbing/transport/git/common.go
index 306aae2..92fc0be 100644
--- a/plumbing/transport/git/common.go
+++ b/plumbing/transport/git/common.go
@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"io"
 	"net"
+	"strconv"
 
 	"github.com/go-git/go-git/v5/plumbing/format/pktline"
 	"github.com/go-git/go-git/v5/plumbing/transport"
@@ -69,7 +70,7 @@ func (c *command) getHostWithPort() string {
 		port = DefaultPort
 	}
 
-	return fmt.Sprintf("%s:%d", host, port)
+	return net.JoinHostPort(host, strconv.Itoa(port))
 }
 
 // StderrPipe git protocol doesn't have any dedicated error channel
@@ -77,14 +78,14 @@ func (c *command) StderrPipe() (io.Reader, error) {
 	return nil, nil
 }
 
-// StdinPipe return the underlying connection as WriteCloser, wrapped to prevent
+// StdinPipe returns the underlying connection as WriteCloser, wrapped to prevent
 // call to the Close function from the connection, a command execution in git
 // protocol can't be closed or killed
 func (c *command) StdinPipe() (io.WriteCloser, error) {
 	return ioutil.WriteNopCloser(c.conn), nil
 }
 
-// StdoutPipe return the underlying connection as Reader
+// StdoutPipe returns the underlying connection as Reader
 func (c *command) StdoutPipe() (io.Reader, error) {
 	return c.conn, nil
 }
@@ -92,7 +93,7 @@ func (c *command) StdoutPipe() (io.Reader, error) {
 func endpointToCommand(cmd string, ep *transport.Endpoint) string {
 	host := ep.Host
 	if ep.Port != DefaultPort {
-		host = fmt.Sprintf("%s:%d", ep.Host, ep.Port)
+		host = net.JoinHostPort(ep.Host, strconv.Itoa(ep.Port))
 	}
 
 	return fmt.Sprintf("%s %s%chost=%s%c", cmd, ep.Path, 0, host, 0)
diff --git a/plumbing/transport/git/common_test.go b/plumbing/transport/git/common_test.go
index 3391aaf..7389919 100644
--- a/plumbing/transport/git/common_test.go
+++ b/plumbing/transport/git/common_test.go
@@ -2,7 +2,6 @@ package git
 
 import (
 	"fmt"
-	"io/ioutil"
 	"net"
 	"os"
 	"os/exec"
@@ -37,7 +36,7 @@ func (s *BaseSuite) SetUpTest(c *C) {
 	s.port, err = freePort()
 	c.Assert(err, IsNil)
 
-	s.base, err = ioutil.TempDir(os.TempDir(), fmt.Sprintf("go-git-protocol-%d", s.port))
+	s.base, err = os.MkdirTemp(os.TempDir(), fmt.Sprintf("go-git-protocol-%d", s.port))
 	c.Assert(err, IsNil)
 }
 
diff --git a/plumbing/transport/http/common.go b/plumbing/transport/http/common.go
index d57c0fe..a7cdc1e 100644
--- a/plumbing/transport/http/common.go
+++ b/plumbing/transport/http/common.go
@@ -4,16 +4,22 @@ package http
 import (
 	"bytes"
 	"context"
+	"crypto/tls"
+	"crypto/x509"
 	"fmt"
 	"net"
 	"net/http"
+	"net/url"
+	"reflect"
 	"strconv"
 	"strings"
+	"sync"
 
 	"github.com/go-git/go-git/v5/plumbing"
 	"github.com/go-git/go-git/v5/plumbing/protocol/packp"
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	"github.com/go-git/go-git/v5/utils/ioutil"
+	"github.com/golang/groupcache/lru"
 )
 
 // it requires a bytes.Buffer, because we need to know the length
@@ -67,6 +73,17 @@ func advertisedReferences(ctx context.Context, s *session, serviceName string) (
 		return nil, err
 	}
 
+	// Git 2.41+ returns a zero-id plus capabilities when an empty
+	// repository is being cloned. This skips the existing logic within
+	// advrefs_decode.decodeFirstHash, which expects a flush-pkt instead.
+	//
+	// This logic aligns with plumbing/transport/internal/common/common.go.
+	if ar.IsEmpty() &&
+		// Empty repositories are valid for git-receive-pack.
+		transport.ReceivePackServiceName != serviceName {
+		return nil, transport.ErrEmptyRemoteRepository
+	}
+
 	transport.FilterUnsupportedCapabilities(ar.Capabilities)
 	s.advRefs = ar
 
@@ -74,40 +91,83 @@ func advertisedReferences(ctx context.Context, s *session, serviceName string) (
 }
 
 type client struct {
-	c *http.Client
+	c          *http.Client
+	transports *lru.Cache
+	m          sync.RWMutex
 }
 
-// DefaultClient is the default HTTP client, which uses `http.DefaultClient`.
-var DefaultClient = NewClient(nil)
+// ClientOptions holds user configurable options for the client.
+type ClientOptions struct {
+	// CacheMaxEntries is the max no. of entries that the transport objects
+	// cache will hold at any given point of time. It must be a positive integer.
+	// Calling `client.addTransport()` after the cache has reached the specified
+	// size, will result in the least recently used transport getting deleted
+	// before the provided transport is added to the cache.
+	CacheMaxEntries int
+}
+
+var (
+	// defaultTransportCacheSize is the default capacity of the transport objects cache.
+	// Its value is 0 because transport caching is turned off by default and is an
+	// opt-in feature.
+	defaultTransportCacheSize = 0
+
+	// DefaultClient is the default HTTP client, which uses a net/http client configured
+	// with http.DefaultTransport.
+	DefaultClient = NewClient(nil)
+)
 
 // NewClient creates a new client with a custom net/http client.
 // See `InstallProtocol` to install and override default http client.
-// Unless a properly initialized client is given, it will fall back into
-// `http.DefaultClient`.
+// If the net/http client is nil or empty, it will use a net/http client configured
+// with http.DefaultTransport.
 //
 // Note that for HTTP client cannot distinguish between private repositories and
 // unexistent repositories on GitHub. So it returns `ErrAuthorizationRequired`
 // for both.
 func NewClient(c *http.Client) transport.Transport {
 	if c == nil {
-		return &client{http.DefaultClient}
+		c = &http.Client{
+			Transport: http.DefaultTransport,
+		}
 	}
+	return NewClientWithOptions(c, &ClientOptions{
+		CacheMaxEntries: defaultTransportCacheSize,
+	})
+}
 
-	return &client{
+// NewClientWithOptions returns a new client configured with the provided net/http client
+// and other custom options specific to the client.
+// If the net/http client is nil or empty, it will use a net/http client configured
+// with http.DefaultTransport.
+func NewClientWithOptions(c *http.Client, opts *ClientOptions) transport.Transport {
+	if c == nil {
+		c = &http.Client{
+			Transport: http.DefaultTransport,
+		}
+	}
+	cl := &client{
 		c: c,
 	}
+
+	if opts != nil {
+		if opts.CacheMaxEntries > 0 {
+			cl.transports = lru.New(opts.CacheMaxEntries)
+		}
+	}
+	return cl
 }
 
 func (c *client) NewUploadPackSession(ep *transport.Endpoint, auth transport.AuthMethod) (
 	transport.UploadPackSession, error) {
 
-	return newUploadPackSession(c.c, ep, auth)
+	return newUploadPackSession(c, ep, auth)
 }
 
 func (c *client) NewReceivePackSession(ep *transport.Endpoint, auth transport.AuthMethod) (
 	transport.ReceivePackSession, error) {
 
-	return newReceivePackSession(c.c, ep, auth)
+	return newReceivePackSession(c, ep, auth)
 }
 
 type session struct {
@@ -117,10 +177,106 @@ type session struct {
 	advRefs  *packp.AdvRefs
 }
 
-func newSession(c *http.Client, ep *transport.Endpoint, auth transport.AuthMethod) (*session, error) {
+func transportWithInsecureTLS(transport *http.Transport) {
+	if transport.TLSClientConfig == nil {
+		transport.TLSClientConfig = &tls.Config{}
+	}
+	transport.TLSClientConfig.InsecureSkipVerify = true
+}
+
+func transportWithCABundle(transport *http.Transport, caBundle []byte) error {
+	rootCAs, err := x509.SystemCertPool()
+	if err != nil {
+		return err
+	}
+	if rootCAs == nil {
+		rootCAs = x509.NewCertPool()
+	}
+	rootCAs.AppendCertsFromPEM(caBundle)
+	if transport.TLSClientConfig == nil {
+		transport.TLSClientConfig = &tls.Config{}
+	}
+	transport.TLSClientConfig.RootCAs = rootCAs
+	return nil
+}
+
+func transportWithProxy(transport *http.Transport, proxyURL *url.URL) {
+	transport.Proxy = http.ProxyURL(proxyURL)
+}
+
+func configureTransport(transport *http.Transport, ep *transport.Endpoint) error {
+	if len(ep.CaBundle) > 0 {
+		if err := transportWithCABundle(transport, ep.CaBundle); err != nil {
+			return err
+		}
+	}
+	if ep.InsecureSkipTLS {
+		transportWithInsecureTLS(transport)
+	}
+
+	if ep.Proxy.URL != "" {
+		proxyURL, err := ep.Proxy.FullURL()
+		if err != nil {
+			return err
+		}
+		transportWithProxy(transport, proxyURL)
+	}
+	return nil
+}
+
+func newSession(c *client, ep *transport.Endpoint, auth transport.AuthMethod) (*session, error) {
+	var httpClient *http.Client
+
+	// We need to configure the http transport if there are transport specific
+	// options present in the endpoint.
+	if len(ep.CaBundle) > 0 || ep.InsecureSkipTLS || ep.Proxy.URL != "" {
+		var transport *http.Transport
+		// if the client wasn't configured to have a cache for transports then just configure
+		// the transport and use it directly, otherwise try to use the cache.
+		if c.transports == nil {
+			tr, ok := c.c.Transport.(*http.Transport)
+			if !ok {
+				return nil, fmt.Errorf("expected underlying client transport to be of type: %s; got: %s",
+					reflect.TypeOf(transport), reflect.TypeOf(c.c.Transport))
+			}
+
+			transport = tr.Clone()
+			configureTransport(transport, ep)
+		} else {
+			transportOpts := transportOptions{
+				caBundle:        string(ep.CaBundle),
+				insecureSkipTLS: ep.InsecureSkipTLS,
+			}
+			if ep.Proxy.URL != "" {
+				proxyURL, err := ep.Proxy.FullURL()
+				if err != nil {
+					return nil, err
+				}
+				transportOpts.proxyURL = *proxyURL
+			}
+			var found bool
+			transport, found = c.fetchTransport(transportOpts)
+
+			if !found {
+				transport = c.c.Transport.(*http.Transport).Clone()
+				configureTransport(transport, ep)
+				c.addTransport(transportOpts, transport)
+			}
+		}
+
+		httpClient = &http.Client{
+			Transport:     transport,
+			CheckRedirect: c.c.CheckRedirect,
+			Jar:           c.c.Jar,
+			Timeout:       c.c.Timeout,
+		}
+	} else {
+		httpClient = c.c
+	}
+
 	s := &session{
 		auth:     basicAuthFromEndpoint(ep),
-		client:   c,
+		client:   httpClient,
 		endpoint: ep,
 	}
 	if auth != nil {
diff --git a/plumbing/transport/http/common_test.go b/plumbing/transport/http/common_test.go
index 4122e62..1517228 100644
--- a/plumbing/transport/http/common_test.go
+++ b/plumbing/transport/http/common_test.go
@@ -3,7 +3,6 @@ package http
 import (
 	"crypto/tls"
 	"fmt"
-	"io/ioutil"
 	"log"
 	"net"
 	"net/http"
@@ -91,6 +90,60 @@ func (s *ClientSuite) TestNewHTTPError40x(c *C) {
 		"unexpected client error.*")
 }
 
+func (s *ClientSuite) Test_newSession(c *C) {
+	cl := NewClientWithOptions(nil, &ClientOptions{
+		CacheMaxEntries: 2,
+	}).(*client)
+
+	insecureEP := s.Endpoint
+	insecureEP.InsecureSkipTLS = true
+	session, err := newSession(cl, insecureEP, nil)
+	c.Assert(err, IsNil)
+
+	sessionTransport := session.client.Transport.(*http.Transport)
+	c.Assert(sessionTransport.TLSClientConfig.InsecureSkipVerify, Equals, true)
+	t, ok := cl.fetchTransport(transportOptions{
+		insecureSkipTLS: true,
+	})
+	// transport should be cached.
+	c.Assert(ok, Equals, true)
+	// cached transport should be the one that's used.
+	c.Assert(sessionTransport, Equals, t)
+
+	caEndpoint := insecureEP
+	caEndpoint.CaBundle = []byte("this is the way")
+	session, err = newSession(cl, caEndpoint, nil)
+	c.Assert(err, IsNil)
+
+	sessionTransport = session.client.Transport.(*http.Transport)
+	c.Assert(sessionTransport.TLSClientConfig.InsecureSkipVerify, Equals, true)
+	c.Assert(sessionTransport.TLSClientConfig.RootCAs, NotNil)
+	t, ok = cl.fetchTransport(transportOptions{
+		insecureSkipTLS: true,
+		caBundle:        "this is the way",
+	})
+	// transport should be cached.
+	c.Assert(ok, Equals, true)
+	// cached transport should be the one that's used.
+	c.Assert(sessionTransport, Equals, t)
+
+	session, err = newSession(cl, caEndpoint, nil)
+	c.Assert(err, IsNil)
+	sessionTransport = session.client.Transport.(*http.Transport)
+	// transport that's going to be used should be cached already.
+	c.Assert(sessionTransport, Equals, t)
+	// no new transport got cached.
+	c.Assert(cl.transports.Len(), Equals, 2)
+
+	// if the cache does not exist, the transport should still be correctly configured.
+	cl.transports = nil
+	session, err = newSession(cl, insecureEP, nil)
+	c.Assert(err, IsNil)
+
+	sessionTransport = session.client.Transport.(*http.Transport)
+	c.Assert(sessionTransport.TLSClientConfig.InsecureSkipVerify, Equals, true)
+}
+
 func (s *ClientSuite) testNewHTTPError(c *C, code int, msg string) {
 	req, _ := http.NewRequest("GET", "foo", nil)
 	res := &http.Response{
@@ -168,7 +221,7 @@ func (s *BaseSuite) SetUpTest(c *C) {
 	l, err := net.Listen("tcp", "localhost:0")
 	c.Assert(err, IsNil)
 
-	base, err := ioutil.TempDir(os.TempDir(), fmt.Sprintf("go-git-http-%d", s.port))
+	base, err := os.MkdirTemp(os.TempDir(), fmt.Sprintf("go-git-http-%d", s.port))
 	c.Assert(err, IsNil)
 
 	s.port = l.Addr().(*net.TCPAddr).Port
diff --git a/plumbing/transport/http/internal/test/proxy_test.go b/plumbing/transport/http/internal/test/proxy_test.go
new file mode 100644
index 0000000..6ae2943
--- /dev/null
+++ b/plumbing/transport/http/internal/test/proxy_test.go
@@ -0,0 +1,72 @@
+package test
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	nethttp "net/http"
+	"os"
+	"sync/atomic"
+	"testing"
+
+	"github.com/elazarl/goproxy"
+
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/http"
+
+	. "gopkg.in/check.v1"
+)
+
+// Hook up gocheck into the "go test" runner.
+func Test(t *testing.T) { TestingT(t) }
+
+type ProxySuite struct{}
+
+var _ = Suite(&ProxySuite{})
+
+var proxiedRequests int32
+
+// This test tests proxy support via an env var, i.e. `HTTPS_PROXY`.
+// Its located in a separate package because golang caches the value
+// of proxy env vars leading to misleading/unexpected test results.
+func (s *ProxySuite) TestAdvertisedReferences(c *C) {
+	proxy := goproxy.NewProxyHttpServer()
+	proxy.Verbose = true
+	SetupHTTPSProxy(proxy, &proxiedRequests)
+	httpsListener, err := net.Listen("tcp", ":0")
+	c.Assert(err, IsNil)
+	defer httpsListener.Close()
+	httpProxyAddr := fmt.Sprintf("localhost:%d", httpsListener.Addr().(*net.TCPAddr).Port)
+
+	proxyServer := nethttp.Server{
+		Addr:    httpProxyAddr,
+		Handler: proxy,
+		// Due to how golang manages http/2 when provided with custom TLS config,
+		// servers and clients running in the same process leads to issues.
+		// Ref: https://github.com/golang/go/issues/21336
+		TLSConfig: &tls.Config{
+			NextProtos: []string{"http/1.1"},
+		},
+	}
+	go proxyServer.ServeTLS(httpsListener, "../../testdata/certs/server.crt", "../../testdata/certs/server.key")
+	defer proxyServer.Close()
+	os.Setenv("HTTPS_PROXY", fmt.Sprintf("https://user:pass@%s", httpProxyAddr))
+	defer os.Unsetenv("HTTPS_PROXY")
+
+	endpoint, err := transport.NewEndpoint("https://github.com/git-fixtures/basic.git")
+	c.Assert(err, IsNil)
+	endpoint.InsecureSkipTLS = true
+
+	client := http.DefaultClient
+	session, err := client.NewUploadPackSession(endpoint, nil)
+	c.Assert(err, IsNil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	info, err := session.AdvertisedReferencesContext(ctx)
+	c.Assert(err, IsNil)
+	c.Assert(info, NotNil)
+	proxyUsed := atomic.LoadInt32(&proxiedRequests) > 0
+	c.Assert(proxyUsed, Equals, true)
+}
diff --git a/plumbing/transport/http/internal/test/test_utils.go b/plumbing/transport/http/internal/test/test_utils.go
new file mode 100644
index 0000000..6665fb3
--- /dev/null
+++ b/plumbing/transport/http/internal/test/test_utils.go
@@ -0,0 +1,43 @@
+package test
+
+import (
+	"encoding/base64"
+	"strings"
+	"sync/atomic"
+
+	"github.com/elazarl/goproxy"
+)
+
+func SetupHTTPSProxy(proxy *goproxy.ProxyHttpServer, proxiedRequests *int32) {
+	var proxyHandler goproxy.FuncHttpsHandler = func(host string, ctx *goproxy.ProxyCtx) (*goproxy.ConnectAction, string) {
+		if strings.Contains(host, "github.com") {
+			user, pass, _ := ParseBasicAuth(ctx.Req.Header.Get("Proxy-Authorization"))
+			if user != "user" || pass != "pass" {
+				return goproxy.RejectConnect, host
+			}
+			atomic.AddInt32(proxiedRequests, 1)
+			return goproxy.OkConnect, host
+		}
+		// Reject if it isn't our request.
+		return goproxy.RejectConnect, host
+	}
+	proxy.OnRequest().HandleConnect(proxyHandler)
+}
+
+// adapted from https://github.com/golang/go/blob/2ef70d9d0f98832c8103a7968b195e560a8bb262/src/net/http/request.go#L959
+func ParseBasicAuth(auth string) (username, password string, ok bool) {
+	const prefix = "Basic "
+	if len(auth) < len(prefix) || !strings.EqualFold(auth[:len(prefix)], prefix) {
+		return "", "", false
+	}
+	c, err := base64.StdEncoding.DecodeString(auth[len(prefix):])
+	if err != nil {
+		return "", "", false
+	}
+	cs := string(c)
+	username, password, ok = strings.Cut(cs, ":")
+	if !ok {
+		return "", "", false
+	}
+	return username, password, true
+}
diff --git a/plumbing/transport/http/proxy_test.go b/plumbing/transport/http/proxy_test.go
new file mode 100644
index 0000000..f3024da
--- /dev/null
+++ b/plumbing/transport/http/proxy_test.go
@@ -0,0 +1,119 @@
+package http
+
+import (
+	"context"
+	"crypto/tls"
+	"fmt"
+	"net"
+	"net/http"
+	"strings"
+	"sync/atomic"
+
+	"github.com/elazarl/goproxy"
+	fixtures "github.com/go-git/go-git-fixtures/v4"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/http/internal/test"
+
+	. "gopkg.in/check.v1"
+)
+
+type ProxySuite struct {
+	u UploadPackSuite
+	fixtures.Suite
+}
+
+var _ = Suite(&ProxySuite{})
+
+var proxiedRequests int32
+
+func (s *ProxySuite) TestAdvertisedReferences(c *C) {
+	s.u.SetUpTest(c)
+	proxy := goproxy.NewProxyHttpServer()
+	proxy.Verbose = true
+	setupHTTPProxy(proxy, &proxiedRequests)
+	httpListener, err := net.Listen("tcp", ":0")
+	c.Assert(err, IsNil)
+	defer httpListener.Close()
+
+	httpProxyAddr := fmt.Sprintf("http://localhost:%d", httpListener.Addr().(*net.TCPAddr).Port)
+	proxyServer := http.Server{
+		Addr:    httpProxyAddr,
+		Handler: proxy,
+	}
+	go proxyServer.Serve(httpListener)
+	defer proxyServer.Close()
+
+	endpoint := s.u.prepareRepository(c, fixtures.Basic().One(), "basic.git")
+	endpoint.Proxy = transport.ProxyOptions{
+		URL:      httpProxyAddr,
+		Username: "user",
+		Password: "pass",
+	}
+
+	s.u.Client = NewClient(nil)
+	session, err := s.u.Client.NewUploadPackSession(endpoint, nil)
+	c.Assert(err, IsNil)
+
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	info, err := session.AdvertisedReferencesContext(ctx)
+	c.Assert(err, IsNil)
+	c.Assert(info, NotNil)
+	proxyUsed := atomic.LoadInt32(&proxiedRequests) > 0
+	c.Assert(proxyUsed, Equals, true)
+
+	atomic.StoreInt32(&proxiedRequests, 0)
+	test.SetupHTTPSProxy(proxy, &proxiedRequests)
+	httpsListener, err := net.Listen("tcp", ":0")
+	c.Assert(err, IsNil)
+	defer httpsListener.Close()
+	httpsProxyAddr := fmt.Sprintf("https://localhost:%d", httpsListener.Addr().(*net.TCPAddr).Port)
+
+	tlsProxyServer := http.Server{
+		Addr:    httpsProxyAddr,
+		Handler: proxy,
+		// Due to how golang manages http/2 when provided with custom TLS config,
+		// servers and clients running in the same process leads to issues.
+		// Ref: https://github.com/golang/go/issues/21336
+		TLSConfig: &tls.Config{
+			NextProtos: []string{"http/1.1"},
+		},
+	}
+	go tlsProxyServer.ServeTLS(httpsListener, "testdata/certs/server.crt", "testdata/certs/server.key")
+	defer tlsProxyServer.Close()
+
+	endpoint, err = transport.NewEndpoint("https://github.com/git-fixtures/basic.git")
+	c.Assert(err, IsNil)
+	endpoint.Proxy = transport.ProxyOptions{
+		URL:      httpsProxyAddr,
+		Username: "user",
+		Password: "pass",
+	}
+	endpoint.InsecureSkipTLS = true
+
+	session, err = s.u.Client.NewUploadPackSession(endpoint, nil)
+	c.Assert(err, IsNil)
+
+	info, err = session.AdvertisedReferencesContext(ctx)
+	c.Assert(err, IsNil)
+	c.Assert(info, NotNil)
+	proxyUsed = atomic.LoadInt32(&proxiedRequests) > 0
+	c.Assert(proxyUsed, Equals, true)
+}
+
+func setupHTTPProxy(proxy *goproxy.ProxyHttpServer, proxiedRequests *int32) {
+	// The request is being forwarded to the local test git server in this handler.
+	var proxyHandler goproxy.FuncReqHandler = func(req *http.Request, ctx *goproxy.ProxyCtx) (*http.Request, *http.Response) {
+		if strings.Contains(req.Host, "localhost") {
+			user, pass, _ := test.ParseBasicAuth(req.Header.Get("Proxy-Authorization"))
+			if user != "user" || pass != "pass" {
+				return req, goproxy.NewResponse(req, goproxy.ContentTypeText, http.StatusUnauthorized, "")
+			}
+			atomic.AddInt32(proxiedRequests, 1)
+			return req, nil
+		}
+		// Reject if it isn't our request.
+		return req, goproxy.NewResponse(req, goproxy.ContentTypeText, http.StatusForbidden, "")
+	}
+	proxy.OnRequest().Do(proxyHandler)
+}
diff --git a/plumbing/transport/http/receive_pack.go b/plumbing/transport/http/receive_pack.go
index 4d14ff2..4387ecf 100644
--- a/plumbing/transport/http/receive_pack.go
+++ b/plumbing/transport/http/receive_pack.go
@@ -19,7 +19,7 @@ type rpSession struct {
 	*session
 }
 
-func newReceivePackSession(c *http.Client, ep *transport.Endpoint, auth transport.AuthMethod) (transport.ReceivePackSession, error) {
+func newReceivePackSession(c *client, ep *transport.Endpoint, auth transport.AuthMethod) (transport.ReceivePackSession, error) {
 	s, err := newSession(c, ep, auth)
 	return &rpSession{s}, err
 }
diff --git a/plumbing/transport/http/testdata/certs/server.crt b/plumbing/transport/http/testdata/certs/server.crt
new file mode 100644
index 0000000..9bdec2c
--- /dev/null
+++ b/plumbing/transport/http/testdata/certs/server.crt
@@ -0,0 +1,22 @@
+-----BEGIN CERTIFICATE-----
+MIIDkzCCAnugAwIBAgIUWcuzUyG3EfGsXVUH0BAmnCJyNHswDQYJKoZIhvcNAQEL
+BQAwWTELMAkGA1UEBhMCQVUxEzARBgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoM
+GEludGVybmV0IFdpZGdpdHMgUHR5IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MB4X
+DTIzMDMwNzA3MTgwNloXDTI0MDMwNjA3MTgwNlowWTELMAkGA1UEBhMCQVUxEzAR
+BgNVBAgMClNvbWUtU3RhdGUxITAfBgNVBAoMGEludGVybmV0IFdpZGdpdHMgUHR5
+IEx0ZDESMBAGA1UEAwwJbG9jYWxob3N0MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A
+MIIBCgKCAQEAvyKX6vJXt1u+WBfBNJByFDAb7msdsk6SiPFlX5uyilaWmlRxvLo1
+GZMjjuQbs4wU6BAoZcgiELnsC9GSyxgrhk7NIW3ud/QD7s8ZxETxFLb0ur6tJj7/
+ETEcU/AKSl1FpeJbGHqGipYp5+0GU0zPDxRYqC2N3+fcGZPQbBwxb1f+MrBjWutb
+3eNYTLdPH3W7RUqbunC1KZRJ8XOcU5XZ4qEaMkZYdz1QItxwPnpPuSZs53ga3TDF
+zclpQcT8OH2JNwSI6bwlwFJ0Es06manw7XHmgd8anhix9FdsQYaTOW4kqh1iKQ/P
+jPG50bdTUEqlOsaa+9av/qf+90npzt3xqQIDAQABo1MwUTAdBgNVHQ4EFgQUqTqb
+q+jiJVgwftQS+YLcQWnvTuAwHwYDVR0jBBgwFoAUqTqbq+jiJVgwftQS+YLcQWnv
+TuAwDwYDVR0TAQH/BAUwAwEB/zANBgkqhkiG9w0BAQsFAAOCAQEAVUaFSikxyCy1
+4P/ZZgeuR7vEJ5vWBxKPw/jFNZUFWy2Ag32w1BhrDwoYoc1Awg76QF2TqBQAhFNm
+ek9aE+L83P/R2UhE9+LHnzwdMXt9HYOI1grONk2z3lMI1y4FCJBxHfGyC/XMoNgZ
+qP7UdLgLGTIMN3O1Fww416Hn8BHzxN4o5ZEHJZ6QPMuN8OLk9oVu3yQIq/QcmSDH
+GT2RiwT5IJWMUKK1UrV+y3/T9FwW2qqu+LX+coxjk7HgDWy3y66V9ahLBt8kONcr
+qK0zutoQ5WPSmvnD2Nr0LVLGXEd7hbQNO7bgjO2YOBtnagUQJt72i/OmvZv8Mfnp
+Bu6Qgl5hDw==
+-----END CERTIFICATE-----
diff --git a/plumbing/transport/http/testdata/certs/server.key b/plumbing/transport/http/testdata/certs/server.key
new file mode 100644
index 0000000..9a0cd8f
--- /dev/null
+++ b/plumbing/transport/http/testdata/certs/server.key
@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvgIBADANBgkqhkiG9w0BAQEFAASCBKgwggSkAgEAAoIBAQC/Ipfq8le3W75Y
+F8E0kHIUMBvuax2yTpKI8WVfm7KKVpaaVHG8ujUZkyOO5BuzjBToEChlyCIQuewL
+0ZLLGCuGTs0hbe539APuzxnERPEUtvS6vq0mPv8RMRxT8ApKXUWl4lsYeoaKlinn
+7QZTTM8PFFioLY3f59wZk9BsHDFvV/4ysGNa61vd41hMt08fdbtFSpu6cLUplEnx
+c5xTldnioRoyRlh3PVAi3HA+ek+5JmzneBrdMMXNyWlBxPw4fYk3BIjpvCXAUnQS
+zTqZqfDtceaB3xqeGLH0V2xBhpM5biSqHWIpD8+M8bnRt1NQSqU6xpr71q/+p/73
+SenO3fGpAgMBAAECggEAQUjenQhzv5Rdmpdajcq8vHqGP9Rki0/dK1tQpex3elsD
+C+nGA5GSq46feaIeeCBjz7QdKE7Im+/1WUAXJLm3vCNUW5PB/UTixwIEKg7mTY4E
+X3jbiZHA661boKv/x9C+BmAff2fyZonN/ILwQymcG+l2MtOEfzMh8baUXSjwFbhg
+B08u4iXjee0y9I0CGMYWfasHLOIuhACCFKtqnvdQp8B82g8eSPhme5IjfPP8KZVr
+00n6z8m00HVk6/yYJ8pVZ82j3T+wH6IqvlvaC320sbto8YXV6i8GWHaJumzU4/9s
+IRm4459E+NmNcLNY/TCu89zsfrgNirN+qFfvJIOTxQKBgQDtME8s4UP0MhGuJ2lD
+1HD64fAxMC6Xp/QSzY91Yn79UNssUUV+IwjuUnLIz3U8DBs/QETLm7CkNtI7h5m5
+dBdeBBzCRGxhe8WqRfvceu4s0zr08ZkDaKLjFsBSnBsXZhKAAuRqBjnGAoAiKgVa
+WpEAug00ThhQjipSY9tO9NSBawKBgQDOSz+8m2HJFktEdSctKIB9DesqlAg7YCyy
+dHzywP0/r7wEvsCN7xPgCT5g8JBkRaFvLLKgw7gMKAUx8V2iwizEoDCAs/pbTWji
+uZwPC8lWtbkpBMQIaP4Wap+GyFQJKv1/qZduwpkwkj+ok+m3WwIW55VFGyLn3XGG
+VcLZm83aOwKBgQDXXI/nXjqHVZb8HEjWD+Ttx4yB/Q+xIAzbrc3edap8c5guKzUA
+DOulCTOz5bq65PsweTh970V6NVS6PKt12lUFRpKeSeZmtS2LJ7RCQ1RTWxAjK+MV
+V0LfEt9ZouhuXH3bwcSICFMY2VhirOjjW2xhzo0Cuw4UxqDi4kxU6rSxNQKBgQCI
+sn5KmV/jot0/QK40E0mJFEcHkM4foiwcGGqPZWiq4eUh89CefJTb+OQX0nCrsSQ3
+ChRXyTlU/NPsczcL2cVWiZt6PUihZZsh2cJaigHhbkuCrcDEneX4rrCE3IwrAwy1
+oohRAawG7nI2X8UYFbs9uDlGcKPhpvBKBtw13DM87wKBgE8fOiFoTph//6piU7dV
+pN33UfhPcAFwsIzxAH6Ljo6BYx2hfPRCxI2g0wchk6ydbDecLgMwVgugdJZ6+tRf
+P+YV3wEwPcWOvWby3+EmJh0cXUTl6ZMA+eR4pvCi6kf2xJf9dRmEeNNhOuzn9Y0J
+cT9yhBFG4iejKP0iTwET1JKY
+-----END PRIVATE KEY-----
diff --git a/plumbing/transport/http/transport.go b/plumbing/transport/http/transport.go
new file mode 100644
index 0000000..052f3c8
--- /dev/null
+++ b/plumbing/transport/http/transport.go
@@ -0,0 +1,40 @@
+package http
+
+import (
+	"net/http"
+	"net/url"
+)
+
+// transportOptions contains transport specific configuration.
+type transportOptions struct {
+	insecureSkipTLS bool
+	// []byte is not comparable.
+	caBundle string
+	proxyURL url.URL
+}
+
+func (c *client) addTransport(opts transportOptions, transport *http.Transport) {
+	c.m.Lock()
+	c.transports.Add(opts, transport)
+	c.m.Unlock()
+}
+
+func (c *client) removeTransport(opts transportOptions) {
+	c.m.Lock()
+	c.transports.Remove(opts)
+	c.m.Unlock()
+}
+
+func (c *client) fetchTransport(opts transportOptions) (*http.Transport, bool) {
+	c.m.RLock()
+	t, ok := c.transports.Get(opts)
+	c.m.RUnlock()
+	if !ok {
+		return nil, false
+	}
+	transport, ok := t.(*http.Transport)
+	if !ok {
+		return nil, false
+	}
+	return transport, true
+}
diff --git a/plumbing/transport/http/upload_pack.go b/plumbing/transport/http/upload_pack.go
index e735b3d..4f85145 100644
--- a/plumbing/transport/http/upload_pack.go
+++ b/plumbing/transport/http/upload_pack.go
@@ -19,7 +19,7 @@ type upSession struct {
 	*session
 }
 
-func newUploadPackSession(c *http.Client, ep *transport.Endpoint, auth transport.AuthMethod) (transport.UploadPackSession, error) {
+func newUploadPackSession(c *client, ep *transport.Endpoint, auth transport.AuthMethod) (transport.UploadPackSession, error) {
 	s, err := newSession(c, ep, auth)
 	return &upSession{s}, err
 }
diff --git a/plumbing/transport/http/upload_pack_test.go b/plumbing/transport/http/upload_pack_test.go
index c088ecc..abb7adf 100644
--- a/plumbing/transport/http/upload_pack_test.go
+++ b/plumbing/transport/http/upload_pack_test.go
@@ -3,7 +3,7 @@ package http
 import (
 	"context"
 	"fmt"
-	"io/ioutil"
+	"io"
 	"net/url"
 	"os"
 	"path/filepath"
@@ -49,7 +49,7 @@ func (s *UploadPackSuite) TestuploadPackRequestToReader(c *C) {
 
 	sr, err := uploadPackRequestToReader(r)
 	c.Assert(err, IsNil)
-	b, _ := ioutil.ReadAll(sr)
+	b, _ := io.ReadAll(sr)
 	c.Assert(string(b), Equals,
 		"0032want 2b41ef280fdb67a9b250678686a0c3e03b0a9989\n"+
 			"0032want d82f291cde9987322c8a0c81a325e1ba6159684c\n0000"+
diff --git a/plumbing/transport/internal/common/common.go b/plumbing/transport/internal/common/common.go
index d0e9a29..5fdf425 100644
--- a/plumbing/transport/internal/common/common.go
+++ b/plumbing/transport/internal/common/common.go
@@ -11,7 +11,6 @@ import (
 	"errors"
 	"fmt"
 	"io"
-	stdioutil "io/ioutil"
 	"strings"
 	"time"
 
@@ -156,7 +155,7 @@ func (c *client) listenFirstError(r io.Reader) chan string {
 			close(errLine)
 		}
 
-		_, _ = io.Copy(stdioutil.Discard, r)
+		_, _ = io.Copy(io.Discard, r)
 	}()
 
 	return errLine
@@ -233,7 +232,7 @@ func (s *session) handleAdvRefDecodeError(err error) error {
 // UploadPack performs a request to the server to fetch a packfile. A reader is
 // returned with the packfile content. The reader must be closed after reading.
 func (s *session) UploadPack(ctx context.Context, req *packp.UploadPackRequest) (*packp.UploadPackResponse, error) {
-	if req.IsEmpty() && len(req.Shallows) == 0 {
+	if req.IsEmpty() {
 		return nil, transport.ErrEmptyUploadPackRequest
 	}
 
@@ -374,7 +373,7 @@ func (s *session) checkNotFoundError() error {
 	case <-t.C:
 		return ErrTimeoutExceeded
 	case line, ok := <-s.firstErrLine:
-		if !ok {
+		if !ok || len(line) == 0 {
 			return nil
 		}
 
diff --git a/plumbing/transport/internal/common/common_test.go b/plumbing/transport/internal/common/common_test.go
index c60ef3b..affa787 100644
--- a/plumbing/transport/internal/common/common_test.go
+++ b/plumbing/transport/internal/common/common_test.go
@@ -76,3 +76,17 @@ func (s *CommonSuite) TestIsRepoNotFoundErrorForGogsAccessDenied(c *C) {
 
 	c.Assert(isRepoNotFound, Equals, true)
 }
+
+func (s *CommonSuite) TestCheckNotFoundError(c *C) {
+	firstErrLine := make(chan string, 1)
+
+	session := session{
+		firstErrLine: firstErrLine,
+	}
+
+	firstErrLine <- ""
+
+	err := session.checkNotFoundError()
+
+	c.Assert(err, IsNil)
+}
diff --git a/plumbing/transport/server/server.go b/plumbing/transport/server/server.go
index 8ab70fe..11fa0c8 100644
--- a/plumbing/transport/server/server.go
+++ b/plumbing/transport/server/server.go
@@ -189,7 +189,7 @@ func (s *upSession) objectsToUpload(req *packp.UploadPackRequest) ([]plumbing.Ha
 }
 
 func (*upSession) setSupportedCapabilities(c *capability.List) error {
-	if err := c.Set(capability.Agent, capability.DefaultAgent); err != nil {
+	if err := c.Set(capability.Agent, capability.DefaultAgent()); err != nil {
 		return err
 	}
 
@@ -355,7 +355,7 @@ func (s *rpSession) reportStatus() *packp.ReportStatus {
 }
 
 func (*rpSession) setSupportedCapabilities(c *capability.List) error {
-	if err := c.Set(capability.Agent, capability.DefaultAgent); err != nil {
+	if err := c.Set(capability.Agent, capability.DefaultAgent()); err != nil {
 		return err
 	}
 
diff --git a/plumbing/transport/ssh/auth_method.go b/plumbing/transport/ssh/auth_method.go
index 3514669..ac4e358 100644
--- a/plumbing/transport/ssh/auth_method.go
+++ b/plumbing/transport/ssh/auth_method.go
@@ -3,17 +3,15 @@ package ssh
 import (
 	"errors"
 	"fmt"
-	"io/ioutil"
 	"os"
 	"os/user"
 	"path/filepath"
 
 	"github.com/go-git/go-git/v5/plumbing/transport"
 
-	"github.com/mitchellh/go-homedir"
+	"github.com/skeema/knownhosts"
 	sshagent "github.com/xanzy/ssh-agent"
 	"golang.org/x/crypto/ssh"
-	"golang.org/x/crypto/ssh/knownhosts"
 )
 
 const DefaultUsername = "git"
@@ -135,7 +133,7 @@ func NewPublicKeys(user string, pemBytes []byte, password string) (*PublicKeys,
 // encoded private key. An encryption password should be given if the pemBytes
 // contains a password encrypted PEM block otherwise password should be empty.
 func NewPublicKeysFromFile(user, pemFile, password string) (*PublicKeys, error) {
-	bytes, err := ioutil.ReadFile(pemFile)
+	bytes, err := os.ReadFile(pemFile)
 	if err != nil {
 		return nil, err
 	}
@@ -224,12 +222,19 @@ func (a *PublicKeysCallback) ClientConfig() (*ssh.ClientConfig, error) {
 //
 // If list of files is empty, then it will be read from the SSH_KNOWN_HOSTS
 // environment variable, example:
-//   /home/foo/custom_known_hosts_file:/etc/custom_known/hosts_file
+//
+//	/home/foo/custom_known_hosts_file:/etc/custom_known/hosts_file
 //
 // If SSH_KNOWN_HOSTS is not set the following file locations will be used:
-//   ~/.ssh/known_hosts
-//   /etc/ssh/ssh_known_hosts
+//
+//	~/.ssh/known_hosts
+//	/etc/ssh/ssh_known_hosts
 func NewKnownHostsCallback(files ...string) (ssh.HostKeyCallback, error) {
+	kh, err := newKnownHosts(files...)
+	return ssh.HostKeyCallback(kh), err
+}
+
+func newKnownHosts(files ...string) (knownhosts.HostKeyCallback, error) {
 	var err error
 
 	if len(files) == 0 {
@@ -251,7 +256,7 @@ func getDefaultKnownHostsFiles() ([]string, error) {
 		return files, nil
 	}
 
-	homeDirPath, err := homedir.Dir()
+	homeDirPath, err := os.UserHomeDir()
 	if err != nil {
 		return nil, err
 	}
diff --git a/plumbing/transport/ssh/common.go b/plumbing/transport/ssh/common.go
index 46e7913..1531603 100644
--- a/plumbing/transport/ssh/common.go
+++ b/plumbing/transport/ssh/common.go
@@ -4,12 +4,14 @@ package ssh
 import (
 	"context"
 	"fmt"
+	"net"
 	"reflect"
 	"strconv"
 	"strings"
 
 	"github.com/go-git/go-git/v5/plumbing/transport"
 	"github.com/go-git/go-git/v5/plumbing/transport/internal/common"
+	"github.com/skeema/knownhosts"
 
 	"github.com/kevinburke/ssh_config"
 	"golang.org/x/crypto/ssh"
@@ -121,10 +123,24 @@ func (c *command) connect() error {
 	if err != nil {
 		return err
 	}
+	hostWithPort := c.getHostWithPort()
+	if config.HostKeyCallback == nil {
+		kh, err := newKnownHosts()
+		if err != nil {
+			return err
+		}
+		config.HostKeyCallback = kh.HostKeyCallback()
+		config.HostKeyAlgorithms = kh.HostKeyAlgorithms(hostWithPort)
+	} else if len(config.HostKeyAlgorithms) == 0 {
+		// Set the HostKeyAlgorithms based on HostKeyCallback.
+		// For background see https://github.com/go-git/go-git/issues/411 as well as
+		// https://github.com/golang/go/issues/29286 for root cause.
+		config.HostKeyAlgorithms = knownhosts.HostKeyAlgorithms(config.HostKeyCallback, hostWithPort)
+	}
 
 	overrideConfig(c.config, config)
 
-	c.client, err = dial("tcp", c.getHostWithPort(), config)
+	c.client, err = dial("tcp", hostWithPort, c.endpoint.Proxy, config)
 	if err != nil {
 		return err
 	}
@@ -139,7 +155,7 @@ func (c *command) connect() error {
 	return nil
 }
 
-func dial(network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
+func dial(network, addr string, proxyOpts transport.ProxyOptions, config *ssh.ClientConfig) (*ssh.Client, error) {
 	var (
 		ctx    = context.Background()
 		cancel context.CancelFunc
@@ -151,10 +167,33 @@ func dial(network, addr string, config *ssh.ClientConfig) (*ssh.Client, error) {
 	}
 	defer cancel()
 
-	conn, err := proxy.Dial(ctx, network, addr)
+	var conn net.Conn
+	var err error
+
+	if proxyOpts.URL != "" {
+		proxyUrl, err := proxyOpts.FullURL()
+		if err != nil {
+			return nil, err
+		}
+		dialer, err := proxy.FromURL(proxyUrl, proxy.Direct)
+		if err != nil {
+			return nil, err
+		}
+
+		// Try to use a ContextDialer, but fall back to a Dialer if that goes south.
+		ctxDialer, ok := dialer.(proxy.ContextDialer)
+		if !ok {
+			return nil, fmt.Errorf("expected ssh proxy dialer to be of type %s; got %s",
+				reflect.TypeOf(ctxDialer), reflect.TypeOf(dialer))
+		}
+		conn, err = ctxDialer.DialContext(ctx, "tcp", addr)
+	} else {
+		conn, err = proxy.Dial(ctx, network, addr)
+	}
 	if err != nil {
 		return nil, err
 	}
+
 	c, chans, reqs, err := ssh.NewClientConn(conn, addr, config)
 	if err != nil {
 		return nil, err
@@ -173,7 +212,7 @@ func (c *command) getHostWithPort() string {
 		port = DefaultPort
 	}
 
-	return fmt.Sprintf("%s:%d", host, port)
+	return net.JoinHostPort(host, strconv.Itoa(port))
 }
 
 func (c *command) doGetHostWithPortFromSSHConfig() (addr string, found bool) {
@@ -201,7 +240,7 @@ func (c *command) doGetHostWithPortFromSSHConfig() (addr string, found bool) {
 		}
 	}
 
-	addr = fmt.Sprintf("%s:%d", host, port)
+	addr = net.JoinHostPort(host, strconv.Itoa(port))
 	return
 }
 
diff --git a/plumbing/transport/ssh/common_test.go b/plumbing/transport/ssh/common_test.go
index 6d634d5..496e82d 100644
--- a/plumbing/transport/ssh/common_test.go
+++ b/plumbing/transport/ssh/common_test.go
@@ -5,23 +5,25 @@ import (
 
 	"github.com/go-git/go-git/v5/plumbing/transport"
 
+	"github.com/gliderlabs/ssh"
 	"github.com/kevinburke/ssh_config"
-	"golang.org/x/crypto/ssh"
+	stdssh "golang.org/x/crypto/ssh"
+	"golang.org/x/crypto/ssh/testdata"
 	. "gopkg.in/check.v1"
 )
 
 func Test(t *testing.T) { TestingT(t) }
 
 func (s *SuiteCommon) TestOverrideConfig(c *C) {
-	config := &ssh.ClientConfig{
+	config := &stdssh.ClientConfig{
 		User: "foo",
-		Auth: []ssh.AuthMethod{
-			ssh.Password("yourpassword"),
+		Auth: []stdssh.AuthMethod{
+			stdssh.Password("yourpassword"),
 		},
-		HostKeyCallback: ssh.FixedHostKey(nil),
+		HostKeyCallback: stdssh.FixedHostKey(nil),
 	}
 
-	target := &ssh.ClientConfig{}
+	target := &stdssh.ClientConfig{}
 	overrideConfig(config, target)
 
 	c.Assert(target.User, Equals, "foo")
@@ -30,11 +32,11 @@ func (s *SuiteCommon) TestOverrideConfig(c *C) {
 }
 
 func (s *SuiteCommon) TestOverrideConfigKeep(c *C) {
-	config := &ssh.ClientConfig{
+	config := &stdssh.ClientConfig{
 		User: "foo",
 	}
 
-	target := &ssh.ClientConfig{
+	target := &stdssh.ClientConfig{
 		User: "bar",
 	}
 
@@ -93,12 +95,69 @@ func (s *SuiteCommon) TestDefaultSSHConfigWildcard(c *C) {
 	c.Assert(cmd.getHostWithPort(), Equals, "github.com:22")
 }
 
+func (s *SuiteCommon) TestIgnoreHostKeyCallback(c *C) {
+	uploadPack := &UploadPackSuite{
+		opts: []ssh.Option{
+			ssh.HostKeyPEM(testdata.PEMBytes["ed25519"]),
+		},
+	}
+	uploadPack.SetUpSuite(c)
+	// Use the default client, which does not have a host key callback
+	uploadPack.Client = DefaultClient
+	auth, err := NewPublicKeys("foo", testdata.PEMBytes["rsa"], "")
+	c.Assert(err, IsNil)
+	c.Assert(auth, NotNil)
+	auth.HostKeyCallback = stdssh.InsecureIgnoreHostKey()
+	ep := uploadPack.newEndpoint(c, "bar.git")
+	ps, err := uploadPack.Client.NewUploadPackSession(ep, auth)
+	c.Assert(err, IsNil)
+	c.Assert(ps, NotNil)
+}
+
+func (s *SuiteCommon) TestFixedHostKeyCallback(c *C) {
+	hostKey, err := stdssh.ParsePrivateKey(testdata.PEMBytes["ed25519"])
+	c.Assert(err, IsNil)
+	uploadPack := &UploadPackSuite{
+		opts: []ssh.Option{
+			ssh.HostKeyPEM(testdata.PEMBytes["ed25519"]),
+		},
+	}
+	uploadPack.SetUpSuite(c)
+	// Use the default client, which does not have a host key callback
+	uploadPack.Client = DefaultClient
+	auth, err := NewPublicKeys("foo", testdata.PEMBytes["rsa"], "")
+	c.Assert(err, IsNil)
+	c.Assert(auth, NotNil)
+	auth.HostKeyCallback = stdssh.FixedHostKey(hostKey.PublicKey())
+	ep := uploadPack.newEndpoint(c, "bar.git")
+	ps, err := uploadPack.Client.NewUploadPackSession(ep, auth)
+	c.Assert(err, IsNil)
+	c.Assert(ps, NotNil)
+}
+
+func (s *SuiteCommon) TestFailHostKeyCallback(c *C) {
+	uploadPack := &UploadPackSuite{
+		opts: []ssh.Option{
+			ssh.HostKeyPEM(testdata.PEMBytes["ed25519"]),
+		},
+	}
+	uploadPack.SetUpSuite(c)
+	// Use the default client, which does not have a host key callback
+	uploadPack.Client = DefaultClient
+	auth, err := NewPublicKeys("foo", testdata.PEMBytes["rsa"], "")
+	c.Assert(err, IsNil)
+	c.Assert(auth, NotNil)
+	ep := uploadPack.newEndpoint(c, "bar.git")
+	_, err = uploadPack.Client.NewUploadPackSession(ep, auth)
+	c.Assert(err, NotNil)
+}
+
 func (s *SuiteCommon) TestIssue70(c *C) {
 	uploadPack := &UploadPackSuite{}
 	uploadPack.SetUpSuite(c)
 
-	config := &ssh.ClientConfig{
-		HostKeyCallback: ssh.InsecureIgnoreHostKey(),
+	config := &stdssh.ClientConfig{
+		HostKeyCallback: stdssh.InsecureIgnoreHostKey(),
 	}
 	r := &runner{
 		config: config,
diff --git a/plumbing/transport/ssh/internal/test/proxy_test.go b/plumbing/transport/ssh/internal/test/proxy_test.go
new file mode 100644
index 0000000..8e775f8
--- /dev/null
+++ b/plumbing/transport/ssh/internal/test/proxy_test.go
@@ -0,0 +1,112 @@
+package test
+
+import (
+	"context"
+	"fmt"
+	"log"
+	"net"
+	"os"
+	"path/filepath"
+	"sync/atomic"
+	"testing"
+
+	"github.com/armon/go-socks5"
+	"github.com/gliderlabs/ssh"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	ggssh "github.com/go-git/go-git/v5/plumbing/transport/ssh"
+
+	fixtures "github.com/go-git/go-git-fixtures/v4"
+	stdssh "golang.org/x/crypto/ssh"
+	. "gopkg.in/check.v1"
+)
+
+func Test(t *testing.T) { TestingT(t) }
+
+type ProxyEnvSuite struct {
+	fixtures.Suite
+	port int
+	base string
+}
+
+var _ = Suite(&ProxyEnvSuite{})
+
+var socksProxiedRequests int32
+
+// This test tests proxy support via an env var, i.e. `ALL_PROXY`.
+// Its located in a separate package because golang caches the value
+// of proxy env vars leading to misleading/unexpected test results.
+func (s *ProxyEnvSuite) TestCommand(c *C) {
+	socksListener, err := net.Listen("tcp", "localhost:0")
+	c.Assert(err, IsNil)
+
+	socksServer, err := socks5.New(&socks5.Config{
+		Rules: TestProxyRule{},
+	})
+	c.Assert(err, IsNil)
+	go func() {
+		socksServer.Serve(socksListener)
+	}()
+	socksProxyAddr := fmt.Sprintf("socks5://localhost:%d", socksListener.Addr().(*net.TCPAddr).Port)
+	os.Setenv("ALL_PROXY", socksProxyAddr)
+	defer os.Unsetenv("ALL_PROXY")
+
+	sshListener, err := net.Listen("tcp", "localhost:0")
+	c.Assert(err, IsNil)
+	sshServer := &ssh.Server{Handler: HandlerSSH}
+	go func() {
+		log.Fatal(sshServer.Serve(sshListener))
+	}()
+
+	s.port = sshListener.Addr().(*net.TCPAddr).Port
+	s.base, err = os.MkdirTemp(os.TempDir(), fmt.Sprintf("go-git-ssh-%d", s.port))
+	c.Assert(err, IsNil)
+
+	ggssh.DefaultAuthBuilder = func(user string) (ggssh.AuthMethod, error) {
+		return &ggssh.Password{User: user}, nil
+	}
+
+	ep := s.prepareRepository(c, fixtures.Basic().One(), "basic.git")
+	c.Assert(err, IsNil)
+
+	client := ggssh.NewClient(&stdssh.ClientConfig{
+		HostKeyCallback: stdssh.InsecureIgnoreHostKey(),
+	})
+	r, err := client.NewUploadPackSession(ep, nil)
+	c.Assert(err, IsNil)
+	defer func() { c.Assert(r.Close(), IsNil) }()
+
+	info, err := r.AdvertisedReferences()
+	c.Assert(err, IsNil)
+	c.Assert(info, NotNil)
+	proxyUsed := atomic.LoadInt32(&socksProxiedRequests) > 0
+	c.Assert(proxyUsed, Equals, true)
+}
+
+func (s *ProxyEnvSuite) prepareRepository(c *C, f *fixtures.Fixture, name string) *transport.Endpoint {
+	fs := f.DotGit()
+
+	err := fixtures.EnsureIsBare(fs)
+	c.Assert(err, IsNil)
+
+	path := filepath.Join(s.base, name)
+	err = os.Rename(fs.Root(), path)
+	c.Assert(err, IsNil)
+
+	return s.newEndpoint(c, name)
+}
+
+func (s *ProxyEnvSuite) newEndpoint(c *C, name string) *transport.Endpoint {
+	ep, err := transport.NewEndpoint(fmt.Sprintf(
+		"ssh://git@localhost:%d/%s/%s", s.port, filepath.ToSlash(s.base), name,
+	))
+
+	c.Assert(err, IsNil)
+	return ep
+}
+
+type TestProxyRule struct{}
+
+func (dr TestProxyRule) Allow(ctx context.Context, req *socks5.Request) (context.Context, bool) {
+	atomic.AddInt32(&socksProxiedRequests, 1)
+	return ctx, true
+}
diff --git a/plumbing/transport/ssh/internal/test/test_utils.go b/plumbing/transport/ssh/internal/test/test_utils.go
new file mode 100644
index 0000000..c3797b1
--- /dev/null
+++ b/plumbing/transport/ssh/internal/test/test_utils.go
@@ -0,0 +1,83 @@
+package test
+
+import (
+	"fmt"
+	"io"
+	"os/exec"
+	"runtime"
+	"strings"
+	"sync"
+
+	"github.com/gliderlabs/ssh"
+)
+
+func HandlerSSH(s ssh.Session) {
+	cmd, stdin, stderr, stdout, err := buildCommand(s.Command())
+	if err != nil {
+		fmt.Println(err)
+		return
+	}
+
+	if err := cmd.Start(); err != nil {
+		fmt.Println(err)
+		return
+	}
+
+	go func() {
+		defer stdin.Close()
+		io.Copy(stdin, s)
+	}()
+
+	var wg sync.WaitGroup
+	wg.Add(2)
+
+	go func() {
+		defer wg.Done()
+		io.Copy(s.Stderr(), stderr)
+	}()
+
+	go func() {
+		defer wg.Done()
+		io.Copy(s, stdout)
+	}()
+
+	wg.Wait()
+
+	if err := cmd.Wait(); err != nil {
+		return
+	}
+
+}
+
+func buildCommand(c []string) (cmd *exec.Cmd, stdin io.WriteCloser, stderr, stdout io.ReadCloser, err error) {
+	if len(c) != 2 {
+		err = fmt.Errorf("invalid command")
+		return
+	}
+
+	// fix for Windows environments
+	var path string
+	if runtime.GOOS == "windows" {
+		path = strings.Replace(c[1], "/C:/", "C:/", 1)
+	} else {
+		path = c[1]
+	}
+
+	cmd = exec.Command(c[0], path)
+	stdout, err = cmd.StdoutPipe()
+	if err != nil {
+		return
+	}
+
+	stdin, err = cmd.StdinPipe()
+	if err != nil {
+		return
+	}
+
+	stderr, err = cmd.StderrPipe()
+	if err != nil {
+		return
+	}
+
+	return
+}
diff --git a/plumbing/transport/ssh/proxy_test.go b/plumbing/transport/ssh/proxy_test.go
index 3caf1ff..2ba98e8 100644
--- a/plumbing/transport/ssh/proxy_test.go
+++ b/plumbing/transport/ssh/proxy_test.go
@@ -1,36 +1,87 @@
 package ssh
 
 import (
+	"context"
 	"fmt"
 	"log"
 	"net"
 	"os"
+	"sync/atomic"
 
 	"github.com/armon/go-socks5"
+	"github.com/gliderlabs/ssh"
+	"github.com/go-git/go-git/v5/plumbing/transport"
+	"github.com/go-git/go-git/v5/plumbing/transport/ssh/internal/test"
+
+	fixtures "github.com/go-git/go-git-fixtures/v4"
+	stdssh "golang.org/x/crypto/ssh"
 	. "gopkg.in/check.v1"
 )
 
 type ProxySuite struct {
-	UploadPackSuite
+	u UploadPackSuite
+	fixtures.Suite
 }
 
 var _ = Suite(&ProxySuite{})
 
-func (s *ProxySuite) SetUpSuite(c *C) {
-	s.UploadPackSuite.SetUpSuite(c)
+var socksProxiedRequests int32
 
-	l, err := net.Listen("tcp", "localhost:0")
+func (s *ProxySuite) TestCommand(c *C) {
+	socksListener, err := net.Listen("tcp", "localhost:0")
 	c.Assert(err, IsNil)
 
-	server, err := socks5.New(&socks5.Config{})
+	socksServer, err := socks5.New(&socks5.Config{
+		AuthMethods: []socks5.Authenticator{socks5.UserPassAuthenticator{
+			Credentials: socks5.StaticCredentials{
+				"user": "pass",
+			},
+		}},
+		Rules: TestProxyRule{},
+	})
 	c.Assert(err, IsNil)
+	go func() {
+		socksServer.Serve(socksListener)
+	}()
+	socksProxyAddr := fmt.Sprintf("socks5://localhost:%d", socksListener.Addr().(*net.TCPAddr).Port)
 
-	port := l.Addr().(*net.TCPAddr).Port
-
-	err = os.Setenv("ALL_PROXY", fmt.Sprintf("socks5://localhost:%d", port))
+	sshListener, err := net.Listen("tcp", "localhost:0")
 	c.Assert(err, IsNil)
-
+	sshServer := &ssh.Server{Handler: test.HandlerSSH}
 	go func() {
-		log.Fatal(server.Serve(l))
+		log.Fatal(sshServer.Serve(sshListener))
 	}()
+
+	s.u.port = sshListener.Addr().(*net.TCPAddr).Port
+	s.u.base, err = os.MkdirTemp(os.TempDir(), fmt.Sprintf("go-git-ssh-%d", s.u.port))
+	c.Assert(err, IsNil)
+
+	DefaultAuthBuilder = func(user string) (AuthMethod, error) {
+		return &Password{User: user}, nil
+	}
+
+	ep := s.u.prepareRepository(c, fixtures.Basic().One(), "basic.git")
+	c.Assert(err, IsNil)
+	ep.Proxy = transport.ProxyOptions{
+		URL:      socksProxyAddr,
+		Username: "user",
+		Password: "pass",
+	}
+
+	runner := runner{
+		config: &stdssh.ClientConfig{
+			HostKeyCallback: stdssh.InsecureIgnoreHostKey(),
+		},
+	}
+	_, err = runner.Command(transport.UploadPackServiceName, ep, nil)
+	c.Assert(err, IsNil)
+	proxyUsed := atomic.LoadInt32(&socksProxiedRequests) > 0
+	c.Assert(proxyUsed, Equals, true)
+}
+
+type TestProxyRule struct{}
+
+func (dr TestProxyRule) Allow(ctx context.Context, req *socks5.Request) (context.Context, bool) {
+	atomic.AddInt32(&socksProxiedRequests, 1)
+	return ctx, true
 }
diff --git a/plumbing/transport/ssh/upload_pack_test.go b/plumbing/transport/ssh/upload_pack_test.go
index e65e04a..67af566 100644
--- a/plumbing/transport/ssh/upload_pack_test.go
+++ b/plumbing/transport/ssh/upload_pack_test.go
@@ -3,7 +3,6 @@ package ssh
 import (
 	"fmt"
 	"io"
-	"io/ioutil"
 	"log"
 	"net"
 	"os"
@@ -14,6 +13,7 @@ import (
 	"sync"
 
 	"github.com/go-git/go-git/v5/plumbing/transport"
+	testutils "github.com/go-git/go-git/v5/plumbing/transport/ssh/internal/test"
 	"github.com/go-git/go-git/v5/plumbing/transport/test"
 
 	"github.com/gliderlabs/ssh"
@@ -25,6 +25,7 @@ import (
 type UploadPackSuite struct {
 	test.UploadPackSuite
 	fixtures.Suite
+	opts []ssh.Option
 
 	port int
 	base string
@@ -41,7 +42,7 @@ func (s *UploadPackSuite) SetUpSuite(c *C) {
 	c.Assert(err, IsNil)
 
 	s.port = l.Addr().(*net.TCPAddr).Port
-	s.base, err = ioutil.TempDir(os.TempDir(), fmt.Sprintf("go-git-ssh-%d", s.port))
+	s.base, err = os.MkdirTemp(os.TempDir(), fmt.Sprintf("go-git-ssh-%d", s.port))
 	c.Assert(err, IsNil)
 
 	DefaultAuthBuilder = func(user string) (AuthMethod, error) {
@@ -56,7 +57,10 @@ func (s *UploadPackSuite) SetUpSuite(c *C) {
 	s.UploadPackSuite.EmptyEndpoint = s.prepareRepository(c, fixtures.ByTag("empty").One(), "empty.git")
 	s.UploadPackSuite.NonExistentEndpoint = s.newEndpoint(c, "non-existent.git")
 
-	server := &ssh.Server{Handler: handlerSSH}
+	server := &ssh.Server{Handler: testutils.HandlerSSH}
+	for _, opt := range s.opts {
+		opt(server)
+	}
 	go func() {
 		log.Fatal(server.Serve(l))
 	}()
diff --git a/plumbing/transport/test/receive_pack.go b/plumbing/transport/test/receive_pack.go
index 018d38e..9414fba 100644
--- a/plumbing/transport/test/receive_pack.go
+++ b/plumbing/transport/test/receive_pack.go
@@ -1,13 +1,11 @@
 // Package test implements common test suite for different transport
 // implementations.
-//
 package test
 
 import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"os"
 	"path/filepath"
 
@@ -235,7 +233,7 @@ func (s *ReceivePackSuite) receivePackNoCheck(c *C, ep *transport.Endpoint,
 
 	if rootPath != "" && err == nil && stat.IsDir() {
 		objectPath := filepath.Join(rootPath, "objects/pack")
-		files, err := ioutil.ReadDir(objectPath)
+		files, err := os.ReadDir(objectPath)
 		c.Assert(err, IsNil)
 
 		for _, file := range files {
@@ -371,5 +369,5 @@ func (s *ReceivePackSuite) emptyPackfile() io.ReadCloser {
 		panic(err)
 	}
 
-	return ioutil.NopCloser(&buf)
+	return io.NopCloser(&buf)
 }
diff --git a/plumbing/transport/test/upload_pack.go b/plumbing/transport/test/upload_pack.go
index 3ee029d..f7842eb 100644
--- a/plumbing/transport/test/upload_pack.go
+++ b/plumbing/transport/test/upload_pack.go
@@ -1,13 +1,11 @@
 // Package test implements common test suite for different transport
 // implementations.
-//
 package test
 
 import (
 	"bytes"
 	"context"
 	"io"
-	"io/ioutil"
 	"time"
 
 	"github.com/go-git/go-git/v5/plumbing"
@@ -154,7 +152,7 @@ func (s *UploadPackSuite) TestUploadPackWithContextOnRead(c *C) {
 
 	cancel()
 
-	_, err = io.Copy(ioutil.Discard, reader)
+	_, err = io.Copy(io.Discard, reader)
 	c.Assert(err, NotNil)
 
 	err = reader.Close()
@@ -255,7 +253,7 @@ func (s *UploadPackSuite) TestFetchError(c *C) {
 }
 
 func (s *UploadPackSuite) checkObjectNumber(c *C, r io.Reader, n int) {
-	b, err := ioutil.ReadAll(r)
+	b, err := io.ReadAll(r)
 	c.Assert(err, IsNil)
 	buf := bytes.NewBuffer(b)
 	storage := memory.NewStorage()