Feedback on this post is welcomed on Discuss!

We are pleased to announce the patch release of opam 2.1.5.

This opam release consists of backported bug & security fixes:

• Security issue: fix opam installing packages without checking their checksum when the local cache is corrupted in some case (#5538), you can find more information there.
• Variables are now expanded in build-env (as for setenv) (#5352)
• Correctly handle empty environment variable additions (#5350)
• Skip empty environment variable additions (#5350)
• Fix passing archive-mirrors field from init config file to config (#5315)
• git, hg: Use the full SHA1 revision instead of just the 8 first characters (#5342)

---

Opam installation instructions (unchanged):

1. From binaries: run

   bash -c "sh <(curl -fsSL https://opam.ocaml.org/install.sh) --version 2.1.5"

   or download manually from the Github "Releases" page to your PATH. In this case, don't forget to run opam init --reinit -ni to enable sandboxing if you had version 2.0.0~rc manually installed or to update you sandbox script.

2. From source, using opam:

   opam update; opam install opam-devel

   (then copy the opam binary to your PATH as explained, and don't forget to run opam init --reinit -ni to enable sandboxing if you had version 2.0.0~rc manually installed or to update your sandbox script)

3. From source, manually: see the instructions in the README.

We hope you enjoy this new minor version, and remain open to bug reports and suggestions.