diff --git a/ChangeLog.md b/ChangeLog.md
--- a/ChangeLog.md
+++ b/ChangeLog.md
@@ -1,5 +1,29 @@
 # Changelog for pantry
 
+
+## v0.1.1.0
+
+**Changes since 0.1.0.0**
+
+Bug fixes:
+
+* Fix to allow dependencies on specific versions of local git repositories. See
+  [#4862](https://github.com/commercialhaskell/stack/pull/4862)
+
+Behavior changes:
+
+* By default, do not perform expiry checks in Hackage Security. See
+
+  [#4928](https://github.com/commercialhaskell/stack/issues/4928).
+
+Other changes:
+
+* Rename `pantry-tmp` package back to `pantry`, now that we have gained
+  maintainership (which had been used by someone else for a candidate-only test
+  that made it look like the name was free but prevented uploading a real
+  package).
+
+
 ## 0.1.0.0
 
 * Initial release
diff --git a/attic/hpack-0.1.2.3.tar.gz b/attic/hpack-0.1.2.3.tar.gz
new file mode 100644
Binary files /dev/null and b/attic/hpack-0.1.2.3.tar.gz differ
diff --git a/attic/symlink-to-dir.tar.gz b/attic/symlink-to-dir.tar.gz
new file mode 100644
Binary files /dev/null and b/attic/symlink-to-dir.tar.gz differ
diff --git a/pantry.cabal b/pantry.cabal
--- a/pantry.cabal
+++ b/pantry.cabal
@@ -1,13 +1,13 @@
 cabal-version: 1.12
 
--- This file has been generated from package.yaml by hpack version 0.31.1.
+-- This file has been generated from package.yaml by hpack version 0.31.2.
 --
 -- see: https://github.com/sol/hpack
 --
--- hash: 90b9c809b0a38e3b8a7e330f7e0f3bc7a84c3e21412e271ff389c9b37eece3b8
+-- hash: 09f5f6cbd6fef7c61407c5d1f828315ec41ec73d457183290183b50fa361bd56
 
 name:           pantry
-version:        0.1.0.0
+version:        0.1.1.0
 synopsis:       Content addressable Haskell package management
 description:    Please see the README on Github at <https://github.com/commercialhaskell/stack/blob/master/subs/pantry/README.md>
 category:       Development
@@ -22,7 +22,9 @@
 extra-source-files:
     README.md
     ChangeLog.md
+    attic/hpack-0.1.2.3.tar.gz
     attic/package-0.1.2.3.tar.gz
+    attic/symlink-to-dir.tar.gz
 
 source-repository head
   type: git
@@ -77,7 +79,7 @@
     , hackage-security
     , hashable
     , hpack
-    , http-client
+    , http-client >=0.5.13.1 && <0.7
     , http-client-tls
     , http-conduit
     , http-download
@@ -177,7 +179,7 @@
     , hedgehog
     , hpack
     , hspec
-    , http-client
+    , http-client >=0.5.13.1 && <0.7
     , http-client-tls
     , http-conduit
     , http-download
diff --git a/src/Pantry/Repo.hs b/src/Pantry/Repo.hs
--- a/src/Pantry/Repo.hs
+++ b/src/Pantry/Repo.hs
@@ -18,6 +18,8 @@
 import Path.IO (resolveFile')
 import RIO.FilePath ((</>))
 import RIO.Directory (doesDirectoryExist)
+import RIO.ByteString (isInfixOf)
+import RIO.ByteString.Lazy (toStrict)
 import qualified RIO.Map as Map
 import RIO.Process
 import Database.Persist (Entity (..))
@@ -25,6 +27,20 @@
 import System.Console.ANSI (hSupportsANSIWithoutEmulation)
 import System.IsWindows (osIsWindows)
 
+data TarType = Gnu | Bsd
+
+getTarType :: (HasProcessContext env, HasLogFunc env) => RIO env TarType
+getTarType = do
+  (stdoutBS, _) <- proc "tar" ["--version"] readProcess_
+  let bs = toStrict stdoutBS
+  if "GNU" `isInfixOf` bs
+  then pure Gnu
+  else if "bsdtar" `isInfixOf` bs
+       then pure Bsd
+       else do
+         logError $ "Either GNU Tar or BSD tar is required on the PATH."
+         throwString "Proper tar executable not found in the environment"
+
 fetchReposRaw
   :: (HasPantryConfig env, HasLogFunc env, HasProcessContext env)
   => [(Repo, RawPackageMetadata)]
@@ -121,6 +137,39 @@
        . Map.delete "GIT_OBJECT_DIRECTORY" -- possible optimization: set this to something Pantry controls
        . Map.delete "GIT_ALTERNATE_OBJECT_DIRECTORIES"
 
+-- Include submodules files into the archive: use `git submodule
+-- foreach` to execute `git archive` in each submodule and generate
+-- tar archive. With bsd tar, the generated archive is extracted to a
+-- temporary folder and the files in them are added to the tarball
+-- referenced by the variable tarball in the haskell code. This is
+-- done in GNU tar with -A option.
+archiveSubmodules :: (HasLogFunc env, HasProcessContext env) => FilePath -> RIO env ()
+archiveSubmodules tarball = do
+  tarType <- getTarType
+  let forceLocal =
+          if osIsWindows
+          then " --force-local "
+          else mempty
+  case tarType of
+    Gnu -> runGitCommand
+         [ "submodule", "foreach", "--recursive"
+         , "git -c core.autocrlf=false archive --prefix=$displaypath/ -o bar.tar HEAD; "
+           <> "tar" <> forceLocal <> " -Af " <> tarball <> " bar.tar"
+         ]
+    Bsd ->
+       runGitCommand
+          [ "submodule"
+          , "foreach"
+          , "--recursive"
+          , "git -c core.autocrlf=false archive --prefix=$displaypath/ -o bar.tar HEAD;" <>
+            " rm -rf temp; mkdir temp; mv bar.tar temp/; tar " <>
+            " -C temp -xf temp/bar.tar; " <>
+            "rm temp/bar.tar; tar " <>
+            " -C temp -rf " <>
+            tarball <>
+            " . ;"
+          ]
+
 -- | Run an hg command
 runHgCommand
   :: (HasLogFunc env, HasProcessContext env)
@@ -129,24 +178,19 @@
 runHgCommand args = void $ proc "hg" args readProcess_
 
 -- | Create a tarball containing files from a repository
-createRepoArchive
-  :: forall env. (HasLogFunc env, HasProcessContext env)
+createRepoArchive ::
+     forall env. (HasLogFunc env, HasProcessContext env)
   => Repo
   -> FilePath -- ^ Output tar archive filename
   -> RIO env ()
 createRepoArchive repo tarball = do
-  withRepo repo $ case repoType repo of
-    RepoGit -> do
-       runGitCommand ["-c", "core.autocrlf=false", "archive", "-o", tarball, "HEAD"]
-       -- also include submodules files: use `git submodule foreach` to
-       -- execute `git archive` in each submodule and to append the
-       -- generated archive to the main one with `tar -A`
-       runGitCommand
-         [ "submodule", "foreach", "--recursive"
-         , "git -c core.autocrlf=false archive --prefix=$displaypath/ -o bar.tar HEAD"
-           <> " && if [ -f bar.tar ]; then tar --force-local -Af " <> tarball <> " bar.tar ; fi"
-         ]
-    RepoHg  -> runHgCommand ["archive", tarball, "-X", ".hg_archival.txt"]
+  withRepo repo $
+    case repoType repo of
+      RepoGit -> do
+        runGitCommand
+          ["-c", "core.autocrlf=false", "archive", "-o", tarball, "HEAD"]
+        archiveSubmodules tarball
+      RepoHg -> runHgCommand ["archive", tarball, "-X", ".hg_archival.txt"]
 
 
 -- | Clone the repository and execute the action with the working
@@ -159,12 +203,13 @@
   -> RIO env a
   -> RIO env a
 withRepo repo@(Repo url commit repoType' _subdir) action =
-  withSystemTempDirectory "with-repo" $
-  \tmpdir -> withWorkingDir tmpdir $ do
-    let suffix = "cloned"
-        dir = tmpdir </> suffix
-
-    let (runCommand, resetArgs, submoduleArgs) =
+  withSystemTempDirectory "with-repo" $ \tmpDir -> do
+    -- Note we do not immediately change directories into the new temporary directory,
+    -- but instead wait until we have finished cloning the repo. This is because the
+    -- repo URL may be a relative path on the local filesystem, and we should interpret
+    -- it as relative to the current directory, not the temporary directory.
+    let dir = tmpDir </> "cloned"
+        (runCommand, resetArgs, submoduleArgs) =
           case repoType' of
             RepoGit ->
               ( runGitCommand
@@ -176,23 +221,21 @@
               , ["update", "-C", T.unpack commit]
               , Nothing
               )
+        fixANSIForWindows =
+          -- On Windows 10, an upstream issue with the `git clone` command means that
+          -- command clears, but does not then restore, the
+          -- ENABLE_VIRTUAL_TERMINAL_PROCESSING flag for native terminals. The
+          -- folowing hack re-enables the lost ANSI-capability.
+          when osIsWindows $ void $ liftIO $ hSupportsANSIWithoutEmulation stdout
 
     logInfo $ "Cloning " <> display commit <> " from " <> display url
-    runCommand ("clone" : [T.unpack url, suffix])
-    -- On Windows 10, an upstream issue with the `git clone` command means that
-    -- command clears, but does not then restore, the
-    -- ENABLE_VIRTUAL_TERMINAL_PROCESSING flag for native terminals. The
-    -- folowing hack re-enables the lost ANSI-capability.
-    when osIsWindows $ void $ liftIO $ hSupportsANSIWithoutEmulation stdout
+    runCommand ["clone", T.unpack url, dir]
+    fixANSIForWindows
     created <- doesDirectoryExist dir
     unless created $ throwIO $ FailedToCloneRepo repo
 
     withWorkingDir dir $ do
       runCommand resetArgs
       traverse_ runCommand submoduleArgs
-      -- On Windows 10, an upstream issue with the `git submodule` command means
-      -- that command clears, but does not then restore, the
-      -- ENABLE_VIRTUAL_TERMINAL_PROCESSING flag for native terminals. The
-      -- folowing hack re-enables the lost ANSI-capability.
-      when osIsWindows $ void $ liftIO $ hSupportsANSIWithoutEmulation stdout
+      fixANSIForWindows
       action
diff --git a/src/Pantry/SQLite.hs b/src/Pantry/SQLite.hs
--- a/src/Pantry/SQLite.hs
+++ b/src/Pantry/SQLite.hs
@@ -57,6 +57,7 @@
 
     sqinfo isMigration
            = set extraPragmas ["PRAGMA busy_timeout=2000;"]
+           $ set walEnabled False
 
            -- When doing a migration, we want to disable foreign key
            -- checking, since the order in which tables are created by
diff --git a/src/Pantry/Types.hs b/src/Pantry/Types.hs
--- a/src/Pantry/Types.hs
+++ b/src/Pantry/Types.hs
@@ -541,7 +541,7 @@
     Object o <- o' ..: "hackage-security"
     hscKeyIds <- o ..: "keyids"
     hscKeyThreshold <- o ..: "key-threshold"
-    hscIgnoreExpiry <- o ..:? "ignore-expiry" ..!= False
+    hscIgnoreExpiry <- o ..:? "ignore-expiry" ..!= True
     pure HackageSecurityConfig {..}
 
 
