Shelly ALPM v3.1.0 ships native PKGBUILD builder, removes makepkg from the AUR workflow
Seafoam Labs has published Shelly ALPM v3.1.0, adding a native in-process package builder that eliminates makepkg from the default AUR workflow. The release lands just 27 days after the project shipped a complete v3.0 rewrite, which swapped the entire C#/.NET codebase for Zig and GTK4.
The headline feature is the shelly build command. Unlike the previous v2 behavior where Shelly could discover AUR packages and resolve dependencies but still offloaded compilation to makepkg, v3.1 owns the build step end-to-end. The team explicitly says this is "not a wrapper around makepkg." Output is a standard Arch package with makepkg-compatible .PKGINFO, .BUILDINFO, .MTREE, and .INSTALL entries.
Keep in mind that this comes hot on the heels of the v3 overhaul. The v3.0 release dropped on July 29, 2026, removing hundreds of C# source files and replacing them with native bindings to libalpm, GTK4, libarchive, and GPG. The goal was to drop the .NET runtime entirely. Now, two weeks later, the team is asking AUR users to trust their own builder instead of the tool Arch has relied on since roughly 2007.
The builder lifecycle
The new builder follows a nine-step lifecycle. It parses the PKGBUILD without executing top-level shell code, then displays the file, related scripts, and security findings for review. If dynamic evaluation reveals new files, it pauses for a second look. Once approved, it locks the contents with an integrity digest. Sources download and verify, lifecycle functions run, metadata assembles, and artifacts publish.
Full PKGBUILD support includes verify(), prepare(), pkgver(), build(), check(), and package() functions. It handles split packages, dynamic names resolved via Bash logic, architecture-specific sources, and helper functions like msg and warning. Configuration moved from makepkg.conf to shellybuild.conf. The config is data-only TOML, avoiding the shell-sourcing pitfalls of the original. It merges from /etc/shellybuild.conf, the XDG directory, and ~/.config/shelly/shellybuild.conf.
Security claims
The release notes are aggressive about security. Shelly's builder adds mandatory audit logs, integrity hashing before execution, and atomic publication with rollback on failure. A key differentiator is Landlock sandboxing, though it's opt-in. When enabled, untrusted lifecycle steps run inside a Landlock filesystem sandbox that restricts access to the build directory and toolchain paths. The home directory stays off-limits.
Source handling rejects absolute paths, directory traversal, and unsafe symlinks. Git sources refresh mirrors before materialization. The build process always re-executes the PKGBUILD as non-root with NO_NEW_PRIVS. PGP key handling guides users through fingerprint verification and imports rather than silent key grabs.
For what it's worth, these are features the Arch community has asked for from upstream makepkg for years. Whether Shelly can convince the average user to switch over depends entirely on whether the builder handles edge cases without breaking.
Known limitations
Not everything works yet. Landlock is disabled by default. /tmp and /proc remain visible inside the sandbox. Isolated root builds are reserved for future development. The source pipeline supports local files, file://, HTTP/HTTPS, and Git with branches, tags, and signed objects. Other makepkg VCS protocols and arbitrary DLAGENTS are not supported. Source-package creation, SRCPKGDEST, and repackaging are missing.
External makepkg or clean-chroot workflows do not read shellybuild.conf. The shelly build standalone command does not auto-install the result; you still need the normal AUR install workflow to publish to pacman.
Other changes
The release brings run0 privilege elevation as a supported backend. Shell completion improves for bare actions and combined shortcodes. HTTP support adds gzip and deflate responses, with fixes for TLS initialization and stalled-response timeouts. The AppImage backend got improved update detection, symlink handling, and metadata cleanup. The C# AppImage database migration bridge is gone. Translations updated include German, French, Hungarian, Polish, and Russian.
How to get it
If you're running CachyOS, install directly via sudo pacman -S shelly. AUR users can grab it with yay -S shelly or paru -S shelly. Self-building requires Zig 0.16.0 and Vala. The full changelog lives on the Seafoam Labs site. You can report issues or browse the code on GitHub.
Head here to the v3.1.0 release on GitHub
