Feedback on this post is welcomed on Discuss!

We are pleased to announce the patch release of [opam 2.1.5]((https://github.com/ocaml/opam/releases/tag/2.1.5).

This opam release consists of backported bug & security fixes:

  • Security issue: fix opam installing packages without checking their checksum when the local cache is corrupted in some case (#5538), you can find more information there.
  • Variables are now expanded in build-env (as for setenv) (#5352)
  • Correctly handle empty environment variable additions (#5350)
  • Skip empty environment variable additions (#5350)
  • Fix passing archive-mirrors field from init config file to config (#5315)
  • git, hg: Use the full SHA1 revision instead of just the 8 first characters (#5342)


Opam installation instructions (unchanged):

  1. From binaries: run

    bash -c "sh <(curl -fsSL https://raw.githubusercontent.com/ocaml/opam/master/shell/install.sh) --version 2.1.5"

    or download manually from the Github "Releases" page to your PATH. In this case, don't forget to run opam init --reinit -ni to enable sandboxing if you had version 2.0.0~rc manually installed or to update you sandbox script.

  2. From source, using opam:

    opam update; opam install opam-devel

    (then copy the opam binary to your PATH as explained, and don't forget to run opam init --reinit -ni to enable sandboxing if you had version 2.0.0~rc manually installed or to update your sandbox script)

  3. From source, manually: see the instructions in the README.

We hope you enjoy this new minor version, and remain open to bug reports and suggestions.