upstream release. Also disable upstream's vendoring of libgit2 as Arch ships a recent enough version not to need it.