diff --git a/exec-git.js b/exec-git.js
deleted file mode 100644
index 0019457..0000000
--- a/exec-git.js
+++ /dev/null
@@ -1,66 +0,0 @@
-var Promise = require('rsvp').Promise;
-var exec = require('child_process').exec;
-var os = require('os');
-
-function Pool(count) {
-  this.count = count;
-  this.queue = [];
-  this.promises = new Array(count);
-}
-
-/* Run the function immediately. */
-function run(pool, idx, executionFunction) {
-  var p = Promise.resolve()
-    .then(executionFunction)
-    .then(function() {
-      delete pool.promises[idx];
-      var next = pool.queue.pop();
-      if (next)
-        pool.execute(next);
-    });
-  pool.promises[idx] = p;
-  return p;
-}
-
-/* Defer function to run once all running and queued functions have run. */
-function enqueue(pool, executeFunction) {
-  return new Promise(function(resolve) {
-    pool.queue.push(function() {
-      return Promise.resolve().then(executeFunction).then(resolve);
-    });
-  });
-}
-
-/* Take a function to execute within pool, and return promise delivering the functions
- * result immediately once it is run. */
-Pool.prototype.execute = function(executionFunction) {
-  var idx = -1;
-
-  for (var i=0; i<this.count; i++)
-    if (!this.promises[i])
-      idx = i;
-
-  if (idx !== -1)
-    return run(this, idx, executionFunction);
-  else
-    return enqueue(this, executionFunction);
-};
-
-if (process.platform === 'win32') {
-  var gitPool = new Pool(Math.min(os.cpus().length, 2));
-  module.exports = function(command, execOpt, callback) {
-    return gitPool.execute(function() {
-      return new Promise(function(resolve){
-        exec('git ' + command, execOpt, function(err, stdout, stderr){
-          callback(err, stdout, stderr);
-          resolve();
-        });
-      });
-    });
-  };
-}
-else {
-  module.exports = function(command, execOpt, callback) {
-    exec('git ' + command, execOpt, callback);
-  };
-}
diff --git a/github.js b/github.js
index 4b4cf48..e610ba8 100644
--- a/github.js
+++ b/github.js
@@ -30,8 +30,6 @@ try {
 }
 catch(e) {}
 
-var execGit = require('./exec-git');
-
 function createRemoteStrings(auth, hostname) {
   var authString = auth.username ? (encodeURIComponent(auth.username) + ':' + encodeURIComponent(auth.password) + '@') : '';
   hostname = hostname || 'github.com';
@@ -117,32 +115,15 @@ var GithubLocation = function(options, ui) {
 
   this.ui = ui;
 
-  this.execOpt = {
-    cwd: options.tmpDir,
-    timeout: options.timeout * 1000,
-    killSignal: 'SIGKILL',
-    maxBuffer: this.max_repo_size || 2 * 1024 * 1024,
-    env: extend({}, process.env)
-  };
-
   this.defaultRequestOptions = {
     strictSSL: 'strictSSL' in options ? options.strictSSL : true
   };
 
-  if (!this.defaultRequestOptions.strictSSL) {
-    this.execOpt.env.GIT_SSL_NO_VERIFY = '1'
-  }
-
-  var self = this, envMap = {
-    ca: 'GIT_SSL_CAINFO',
-    cert: 'GIT_SSL_CERT',
-    key: 'GIT_SSL_KEY'
-  };
+  var self = this;
 
   ['ca', 'cert', 'key'].forEach(function(key) {
     if (key in options) {
       var path = expandTilde(options[key]);
-      self.execOpt.env[envMap[key]] = path;
       self.defaultRequestOptions[key] = fs.readFileSync(path, 'ascii');
     }
   });
@@ -383,45 +364,45 @@ GithubLocation.prototype = {
   // { versions: { versionhash } }
   // { notfound: true }
   lookup: function(repo) {
-    var execOpt = this.execOpt;
-    var remoteString = this.remoteString;
-    return new Promise(function(resolve, reject) {
-      execGit('ls-remote ' + remoteString.replace(/(['"()])/g, '\\\$1') + repo + '.git refs/tags/* refs/heads/*', execOpt, function(err, stdout, stderr) {
-        if (err) {
-          if (err.toString().indexOf('not found') == -1) {
-            // dont show plain text passwords in error
-            var error = new Error(stderr.toString().replace(remoteString, ''));
-            error.hideStack = true;
-            error.retriable = true;
-            reject(error);
-          }
-          else
-            resolve({ notfound: true });
-        }
+    var remoteString = this.apiRemoteString;
+    var authSuffix = this.authSuffix;
+
+    var promises = ['heads', 'tags'].map(function(scope) {
+      return asp(request)(extend({
+        uri: remoteString + 'repos/' + repo + '/git/refs/' + scope + authSuffix,
+        headers: {
+          'User-Agent': 'jspm',
+          'Accept': 'application/vnd.github.v3.raw'
+        },
+      }, this.defaultRequestOptions
+      )).then(function(res) {
+        var rateLimitResponse = checkRateLimit.call(this, res.headers);
+        if (rateLimitResponse)
+          return rateLimitResponse;
+        return res;
+      })
+    });
 
-        versions = {};
-        var refs = stdout.split('\n');
-        for (var i = 0; i < refs.length; i++) {
-          if (!refs[i])
-            continue;
+    return Promise.all(promises).then(function(values) {
+      var versions = {};
 
-          var hash = refs[i].substr(0, refs[i].indexOf('\t'));
-          var refName = refs[i].substr(hash.length + 1);
+      values.forEach(function(res) {
+        JSON.parse(res.body).forEach(function(entry) {
+          var hash = entry.object.sha;
+          var refName = entry.ref;
           var version;
           var versionObj = { hash: hash, meta: {} };
 
-          if (refName.substr(0, 11) == 'refs/heads/') {
-            version = refName.substr(11);
+          if (refName.startsWith('refs/heads/')) {
+            version = refName.substr('refs/heads/'.length);
             versionObj.stable = false;
-          }
-
-          else if (refName.substr(0, 10) == 'refs/tags/') {
-            if (refName.substr(refName.length - 3, 3) == '^{}')
-              version = refName.substr(10, refName.length - 13);
+          } else if (refName.startsWith('refs/tags/')) {
+            if (refName.endsWith('^{}'))
+              version = refName.substr('refs/tags/'.length, refName.length - 13); // TODO: what is this "13"?
             else
-              version = refName.substr(10);
+              version = refName.substr('refs/tags/'.length);
 
-            if (version.substr(0, 1) == 'v' && semver.valid(version.substr(1))) {
+            if (version.startsWith('v') && semver.valid(version.substr(1))) {
               version = version.substr(1);
               // note when we remove a "v" which versions we need to add it back to
               // to work out the tag version again
@@ -430,10 +411,12 @@ GithubLocation.prototype = {
           }
 
           versions[version] = versionObj;
-        }
+        })
+      })
 
-        resolve({ versions: versions });
-      });
+      return { versions: versions };
+    }).catch(function(reason) {
+      return { notfound: true };
     });
   },
 
@@ -546,7 +529,6 @@ GithubLocation.prototype = {
     if (meta.vPrefix)
       version = 'v' + version;
 
-    var execOpt = this.execOpt;
     var max_repo_size = this.max_repo_size;
     var remoteString = this.remoteString;
     var authSuffix = this.authSuffix;
@@ -565,7 +547,7 @@ GithubLocation.prototype = {
         if (release.type == 'tar') {
           (inPipe = zlib.createGunzip())
           .pipe(tar.Extract({
-            path: outDir, 
+            path: outDir,
             strip: 0,
             filter: function() {
               return !this.type.match(/^.*Link$/);
@@ -780,7 +762,7 @@ GithubLocation.prototype = {
               // src.zip comes after file.zip
               return asset.name.indexOf('src') == -1 ? -1 : 1;
             })[0];
-            
+
             if (!firstAsset)
               return false;
 
diff --git a/test/pool.js b/test/pool.js
deleted file mode 100644
index e5aa3f5..0000000
--- a/test/pool.js
+++ /dev/null
@@ -1,35 +0,0 @@
-var Pool = require('../pool');
-var exec = require('child_process').exec;
-
-test('Controls concurrency', function(done) {
-  var pool = new Pool(5);
-
-  var count = 0;
-  var counts = [];
-  function f() {
-    return new Promise(function(resolve) {
-      count++;
-      counts.push(count);
-      exec('sleep 0.01', function() {
-        count--;
-        resolve();
-      });
-    });
-  }
-  var calls = [];
-  for (var i=0; i<100; i++)
-    calls[i] = pool.execute(f);
-
-  Promise.all(calls)
-  .then(function() {
-    var i;
-    // burn in, number running == number executed
-    for (i=0; i<5; i++)
-      assert.equal(counts[i],i + 1);
-    // maxed out, number running == pool max
-    for (i=4; i<100; i++)
-      assert.equal(counts[i], 5);
-  })
-  .then(done)
-  .catch(done);
-});