diff --git a/.travis.yml b/.travis.yml
index e9be72df9..98804f2c6 100644
--- a/.travis.yml
+++ b/.travis.yml
@@ -1,14 +1,12 @@
 language: c
 
 sudo: required
-dist: trusty
+dist: xenial
 
 # don't build tags separately
 if: tag IS blank
 
-compiler:
-  - gcc
-  - clang
+compiler: gcc
 
 cache: ccache
 
@@ -29,54 +27,73 @@ after_success:
 
 after_failure:
   - cat config.log
+  - sleep 1
 
 env:
   global:
     - TESTS_REDUCED_KEYLENGTHS=yes
     - LEAK_DETECTIVE=no
     - MONOLITHIC=no
-  matrix:
-    - TEST=all
-    - TEST=all MONOLITHIC=yes
-    - TEST=all LEAK_DETECTIVE=yes
-    - TEST=default
-    - TEST=default MONOLITHIC=yes
-    - TEST=default LEAK_DETECTIVE=yes
-    - TEST=botan
-    - TEST=botan LEAK_DETECTIVE=yes
-    - TEST=openssl
-    - TEST=openssl LEAK_DETECTIVE=yes
-    - TEST=gcrypt
-    - TEST=gcrypt LEAK_DETECTIVE=yes
-    # we can't test Vstr as negative int args are not properly passed to CBs
-    - TEST=printf-builtin
-    - TEST=printf-builtin LEAK_DETECTIVE=yes
 
 matrix:
   include:
-    - compiler: clang
-      os: osx
-      env: TEST=osx
-    - compiler: gcc
-      env: TEST=sonarcloud
-      if: env(SONAR_TOKEN) IS present
+    - env: TEST=sonarcloud
+      if: type = push
       git:
         depth: false
       addons:
         sonarcloud:
           organization: "strongswan"
-    - compiler: gcc
-      env: TEST=coverage
-    - compiler: clang
-      env: TEST=fuzzing MONOLITHIC=yes
-    - compiler: gcc
-      env: TEST=dist
-    - compiler: gcc
-      env: TEST=apidoc
-    - compiler: gcc
-      env: TEST=win64 MONOLITHIC=yes
-    # this does not work on 14.04 due to a missing @4 decoration for
-    # TryAcquireSRWLockExclusive in MinGW 3.1.0
-    - compiler: gcc
-      env: TEST=win32 MONOLITHIC=yes
-      dist: precise
+    - env: TEST=osx
+      compiler: clang
+      os: osx
+    - env: TEST=all
+    - env: TEST=all
+      compiler: clang
+    - env: TEST=all MONOLITHIC=yes
+    - env: TEST=all MONOLITHIC=yes
+      compiler: clang
+    - env: TEST=all LEAK_DETECTIVE=yes
+    - env: TEST=all LEAK_DETECTIVE=yes
+      compiler: clang
+    - env: TEST=coverage
+    - env: TEST=fuzzing MONOLITHIC=yes
+      compiler: clang
+    - env: TEST=win64 MONOLITHIC=yes
+    - env: TEST=win32 MONOLITHIC=yes
+    - env: TEST=dist
+    # "default" with GCC is already tested with "dist" above
+    - env: TEST=default
+      compiler: clang
+    - env: TEST=default MONOLITHIC=yes
+    - env: TEST=default MONOLITHIC=yes
+      compiler: clang
+    - env: TEST=default LEAK_DETECTIVE=yes
+    - env: TEST=default LEAK_DETECTIVE=yes
+      compiler: clang
+    # we can't test Vstr as negative int args are not properly passed to CBs
+    - env: TEST=printf-builtin
+    - env: TEST=printf-builtin
+      compiler: clang
+    - env: TEST=printf-builtin LEAK_DETECTIVE=yes
+    - env: TEST=printf-builtin LEAK_DETECTIVE=yes
+      compiler: clang
+    - env: TEST=botan
+    - env: TEST=botan
+      compiler: clang
+    - env: TEST=botan LEAK_DETECTIVE=yes
+    - env: TEST=botan LEAK_DETECTIVE=yes
+      compiler: clang
+    - env: TEST=openssl
+    - env: TEST=openssl
+      compiler: clang
+    - env: TEST=openssl LEAK_DETECTIVE=yes
+    - env: TEST=openssl LEAK_DETECTIVE=yes
+      compiler: clang
+    - env: TEST=gcrypt
+    - env: TEST=gcrypt
+      compiler: clang
+    - env: TEST=gcrypt LEAK_DETECTIVE=yes
+    - env: TEST=gcrypt LEAK_DETECTIVE=yes
+      compiler: clang
+    - env: TEST=apidoc
diff --git a/Doxyfile.in b/Doxyfile.in
index 6c59d86c9..a1f3f8819 100644
--- a/Doxyfile.in
+++ b/Doxyfile.in
@@ -1789,18 +1789,6 @@ GENERATE_XML           = NO
 
 XML_OUTPUT             = xml
 
-# The XML_SCHEMA tag can be used to specify a XML schema, which can be used by a
-# validating XML parser to check the syntax of the XML files.
-# This tag requires that the tag GENERATE_XML is set to YES.
-
-XML_SCHEMA             =
-
-# The XML_DTD tag can be used to specify a XML DTD, which can be used by a
-# validating XML parser to check the syntax of the XML files.
-# This tag requires that the tag GENERATE_XML is set to YES.
-
-XML_DTD                =
-
 # If the XML_PROGRAMLISTING tag is set to YES doxygen will dump the program
 # listings (including syntax highlighting and cross-referencing information) to
 # the XML output. Note that enabling this will significantly increase the size
diff --git a/Makefile.am b/Makefile.am
index 54b822050..958edc6fe 100644
--- a/Makefile.am
+++ b/Makefile.am
@@ -24,6 +24,11 @@ config_includedir = $(ipseclibdir)/include
 nodist_config_include_HEADERS = config.h
 endif
 
+# we can't (and shouldn't) install/uninstall system files during make distcheck,
+# so override the autodetected path for systemd units
+AM_DISTCHECK_CONFIGURE_FLAGS = \
+	--with-systemdsystemunitdir='$$(prefix)/lib/systemd/system'
+
 # we leave config files behind intentionally so prevent distcheck from complaining
 distuninstallcheck_listfiles = find . -type f \! -name '*.conf' \! -name '*.secrets' -print
 
diff --git a/scripts/test.sh b/scripts/test.sh
index 77c94249d..1998f2178 100755
--- a/scripts/test.sh
+++ b/scripts/test.sh
@@ -49,7 +49,8 @@ build_tss2()
 	curl -L $TSS2_SRC | tar xz -C $TRAVIS_BUILD_DIR/.. &&
 	cd $TSS2_DIR &&
 	./configure &&
-	sudo make -j4 install >/dev/null &&
+	make -j4 >/dev/null &&
+	sudo make install >/dev/null &&
 	sudo ldconfig || exit $?
 	cd -
 }
@@ -98,11 +99,9 @@ all|coverage|sonarcloud)
 			--disable-kernel-pfroute --disable-keychain
 			--disable-lock-profiler --disable-padlock --disable-fuzzing
 			--disable-osx-attr --disable-tkm --disable-uci
-			--disable-systemd --disable-soup --disable-unwind-backtraces
+			--disable-soup --disable-unwind-backtraces
 			--disable-svc --disable-dbghelp-backtraces --disable-socket-win
 			--disable-kernel-wfp --disable-kernel-iph --disable-winhttp"
-	# Ubuntu 14.04 does not provide libnm
-	CONFIG="$CONFIG --disable-nm"
 	# not enabled on the build server
 	CONFIG="$CONFIG --disable-af-alg"
 	if test "$TEST" != "coverage"; then
@@ -113,8 +112,8 @@ all|coverage|sonarcloud)
 	fi
 	DEPS="$DEPS libcurl4-gnutls-dev libsoup2.4-dev libunbound-dev libldns-dev
 		  libmysqlclient-dev libsqlite3-dev clearsilver-dev libfcgi-dev
-		  libpcsclite-dev libpam0g-dev binutils-dev libunwind8-dev
-		  libjson0-dev iptables-dev python-pip libtspi-dev"
+		  libpcsclite-dev libpam0g-dev binutils-dev libunwind8-dev libnm-dev
+		  libjson0-dev iptables-dev python-pip libtspi-dev libsystemd-dev"
 	PYDEPS="pytest"
 	if test "$1" = "deps"; then
 		build_botan
@@ -130,10 +129,12 @@ win*)
 			--enable-updown --enable-ext-auth --enable-libipsec
 			--enable-tnccs-20 --enable-imc-attestation --enable-imv-attestation
 			--enable-imc-os --enable-imv-os --enable-tnc-imv --enable-tnc-imc
-			--enable-pki --enable-swanctl --enable-socket-win"
+			--enable-pki --enable-swanctl --enable-socket-win
+			--enable-kernel-iph --enable-kernel-wfp --enable-winhttp"
 	# no make check for Windows binaries unless we run on a windows host
 	if test "$APPVEYOR" != "True"; then
 		TARGET=
+		CCACHE=ccache
 	else
 		CONFIG="$CONFIG --enable-openssl"
 		CFLAGS="$CFLAGS -I/c/OpenSSL-$TEST/include"
@@ -144,21 +145,14 @@ win*)
 	DEPS="gcc-mingw-w64-base"
 	case "$TEST" in
 	win64)
-		# headers on 12.04 are too old, so we only build the plugins here
-		CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces
-				--enable-kernel-iph --enable-kernel-wfp --enable-winhttp"
+		CONFIG="--host=x86_64-w64-mingw32 $CONFIG --enable-dbghelp-backtraces"
 		DEPS="gcc-mingw-w64-x86-64 binutils-mingw-w64-x86-64 mingw-w64-x86-64-dev $DEPS"
-		CC="x86_64-w64-mingw32-gcc"
-		# apply patch to MinGW headers
-		if test "$APPVEYOR" != "True" -a -z "$1"; then
-			sudo patch -f -p 4 -d /usr/share/mingw-w64/include < src/libcharon/plugins/kernel_wfp/mingw-w64-4.8.1.diff
-		fi
+		CC="$CCACHE x86_64-w64-mingw32-gcc"
 		;;
 	win32)
 		CONFIG="--host=i686-w64-mingw32 $CONFIG"
-		# currently only works on 12.04, so use mingw-w64-dev instead of mingw-w64-i686-dev
-		DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-dev $DEPS"
-		CC="i686-w64-mingw32-gcc"
+		DEPS="gcc-mingw-w64-i686 binutils-mingw-w64-i686 mingw-w64-i686-dev $DEPS"
+		CC="$CCACHE i686-w64-mingw32-gcc"
 		;;
 	esac
 	;;
@@ -291,6 +285,7 @@ sonarcloud)
 		-Dsonar.projectKey=strongswan \
 		-Dsonar.projectVersion=$(git describe)+${TRAVIS_BUILD_NUMBER} \
 		-Dsonar.sources=. \
+		-Dsonar.cfamily.threads=2 \
 		-Dsonar.cfamily.build-wrapper-output=bw-output || exit $?
 	;;
 *)
diff --git a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
index 45fba242b..6946e4576 100644
--- a/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
+++ b/src/libstrongswan/plugins/gcrypt/gcrypt_plugin.c
@@ -43,10 +43,12 @@ struct private_gcrypt_plugin_t {
 	gcrypt_plugin_t public;
 };
 
+#if GCRYPT_VERSION_NUMBER < 0x010600
 /**
  * Define gcrypt multi-threading callbacks as gcry_threads_pthread
  */
 GCRY_THREAD_OPTION_PTHREAD_IMPL;
+#endif
 
 METHOD(plugin_t, get_name, char*,
 	private_gcrypt_plugin_t *this)
@@ -163,7 +165,9 @@ plugin_t *gcrypt_plugin_create()
 {
 	private_gcrypt_plugin_t *this;
 
+#if GCRYPT_VERSION_NUMBER < 0x010600
 	gcry_control(GCRYCTL_SET_THREAD_CBS, &gcry_threads_pthread);
+#endif
 
 	if (!gcry_check_version(GCRYPT_VERSION))
 	{