Shelly ALPM 3.1.8 ships a stability patch on its native Zig rewrite of pacman
A small but meaningful fix keeps the project's from-scratch package engine running in the binaries people actually install.
Shelly ALPM v3.1.8 went live today, and it is a small release only in the strictest sense. The maintainer dropped it directly on top of the feature-heavy 3.1.7 version, and there is one real reason to care: 3.1.7 shipped a broken binary.
Here is the shape of things. Shelly is a modern Arch package manager written in Zig, and its 3.1.7 release introduced RLPM, a from-scratch reimplementation of Arch's libalpm engine. The prebuilt 3.1.7 binary had a linking problem that left a symbol called sqlite3_open_v2 unresolved at runtime, which broke the very feature people were excited about.
So 3.1.8 is the patch. It resolves that undefined symbol and makes the native engine actually runnable in the shipped binaries.
Why this engine matters
Beneath every Arch install sits pacman, and beneath that sits libalpm, the C library that reads repositories, resolves dependencies, verifies signatures, and writes packages to disk. For over a decade, almost every front-end for Arch has been a shell wrapped around that one library. You get a nicer interface. The engine is still pacman's engine.
Shelly wants to change that. Built on a GTK4 front-end, it offers both a desktop app and a command-line tool, and it can talk to libalpm directly or now to its own RLPM engine, written in native Zig.
The work comes from Seafoam Labs, the same lab behind distros like Devario and Starfish. It has roughly 1.2k GitHub stars, runs under GPL-3.0-only, and as of 2026 it is the default graphical package manager for CachyOS.
That adoption is what put Shelly on the map. It went from a niche experiment to one of the most-watched new tools in the Arch ecosystem in a matter of months.
The profile has outpaced the coverage, honestly. A June 2026 article on itsfoss.com claimed, incorrectly, that CachyOS created Shelly and called it "Rust-based." The project is written in Zig. The article had to be publicly corrected, which is a decent indicator of how fast this tool has climbed.
RLPM is the real story
The 3.1.8 fix points straight at Shelly's biggest architectural bet. RLPM uses SQLite to read repository databases in memory, and the 3.1.7 binary had a symbol-resolution problem that left sqlite3_open_v2 dangling. Run the prebuilt 3.1.7 binary, and RLPM-backed operations were effectively dead.
RLPM reimplements libalpm from scratch with no dependency on the C library at all. The default build still ships both engines, and you flip between them with a single config setting.
The ideas baked into RLPM are worth looking at. It reads pacman databases as SQLite directly in memory, so nothing gets written to disk. Archive verification runs before anything commits, using a sealed in-memory file to block time-of-check-to-time-of-use substitution. Filesystem inspection stays confined with a root-relative resolution flag, and package hooks run in a network namespace by default.
Seafoam Labs is also upfront about the gaps. RLPM does not yet match libalpm in every way, and there is a public compatibility ledger tracking what is missing or only partially covered.
Reception has friction
On r/cachyos, users call it "AWESOME" and a clean upgrade over Octopi, with one veteran advising people to just stick with Shelly as their primary package manager. Others are less convinced. A thread on r/archlinux pushed back hard on the "reimagined package management" framing and asked the honest question: why switch from pacman at all? That is a fair point, since Shelly still leans on libalpm by default.
The AUR comments show real-world pain too. One long-time user removed Shelly after seven weeks of crashes. The maintainer came back candidly, saying the team was rewriting the whole app in Zig and asking for crash logs. That is a public acknowledgment that the 3.0 to 3.1 transition had not been smooth.
The release itself
ZoeyErinBauer published 3.1.8 hours before this story went out. Six pull requests merged between 3.1.7 and 3.1.8. Five are routine: version bumps, icon-fetching tweaks, AUR build-flag updates, PKGBUILD fixes. The sixth, PR #2069, is the one that matters, and it targets the undefined sqlite3_open_v2 symbol that had broken the earlier binary.
What you can do with it
If you are on CachyOS, installing is a single command. Otherwise you can pull the AUR package through yay or paru, or build from source if you have zig 0.16.0, vala, and libalpm lying around.
The app now ships as split packages, with separate builds for the CLI, the Flatpak backend, and notifications. You can also compile an RLPM-only binary with a single build flag if you want to leave libalpm behind entirely.
Upstream has repository modification, offline updates, and layout customization on the roadmap. Those point toward a pacman-less future, assuming the project gets there.
It is a rather ambitious project for how new it is, though the GTK4 front-end and the dual-engine approach give it real legs. The incomplete libalpm parity still hurts, and the early crash reports are a reminder that native rewrites take time. A stability patch that actually fixes the headline feature instead of just bumping a version number is a decent sign that the team is paying attention.
Head here to the GitHub release for the full notes and the merged pull requests.
