Seafoam Labs Drops Shelly ALPM v3.1.1, Polishes Off Its Native Arch Package Builder
The patch-level update lands just twenty-four hours after the project shipped its most ambitious release yet. Seafoam Labs pushed Shelly ALPM v3.1.1 on August 26, 2026, and the one-day turnaround tells you exactly how active the development branch really is. The real story isn't the patch itself. It's the native in-process package builder that shipped yesterday, and how quickly the team moved to stabilize it.
Shelly has been a visual alternative to pacman for a while now. It talks to libalpm directly, ships a native GTK4 desktop interface, offers a CLI, and runs cleanly over Wayland. Built in Zig 0.16.0 and Vala, it sits at just over 1,100 GitHub stars and carries a GPL-3.0 license. But the v3.1.0 release on August 25 finally gave Arch users a legitimate reason to take a closer look.
The Builder Actually Works Now
The headline from yesterday wasn't a UI refresh or a performance tweak. It was a fully native package builder that parses PKGBUILD files directly, skips blind shell sourcing, and walks through the complete lifecycle: verify(), prepare(), pkgver(), build(), check(), and package(). It produces standard Arch packages with .PKGINFO, .MTREE, and .BUILDINFO files, handles single and split builds, and even resolves missing AUR dependencies when you pass --sync-deps.
That dependency resolution is where the architecture starts to pull ahead of what makepkg has been offering for years. Instead of letting PKGBUILDs execute as unreviewed shell scripts, Shelly parses them first, shows you what's about to run, and locks the review with an integrity digest before touching anything. Every file gets hashed and re-checked right before execution, so if a tampered archive slips through, the build refuses to continue. You can opt into Linux Landlock sandboxing to keep untrusted build steps locked away from your home directory, and the new guided PGP key flow actually displays the fingerprint before importing anything. Atomic downloads, checksum verification, and atomic package publication round out the security model.
The whole thing gets its own TOML-based config file called shellybuild.conf, which handles architecture flags, ccache/distcc settings, signing defaults, and Landlock paths. Malformed or unknown keys fail hard before the PKGBUILD even runs. Not bad for a side project.
The CachyOS package recommendation is telling in its own right. Seafoam Labs has been quietly aligning with performance-focused Arch forks, which usually means pre-installation bundles and upstream bug reports hitting earlier than public roadmaps suggest. Back to the patch notes, though: Monday's v3.1.1 update is a tight list of fixes rather than a feature dump.
What’s New in v3.1.1
The patch landed at the hands of maintainer ZoeyErinBauer. Pull request #1795 adds a makesrcinfo command that generates .SRCINFO files directly from a reviewed PKGBUILD without ever touching the build lifecycle. Run it as shelly build --makesrcinfo --reviewed PKGBUILD, and you get makepkg-compatible metadata ready for CI pipelines or manual package review. Proxy environment variable support was added alongside it, letting the HTTP client respect HTTP_PROXY and HTTPS_PROXY flags for users stuck behind corporate firewalls or restrictive home networks.
Beyond the CLI additions, PR #1797 finally fixes the Flatpak backend's "no search results" state that was silently dropping packages (#1767). Brazilian Portuguese translations got a refresh in #1791, and there's a handful of builder tweaks that ZoeyErinBauer didn't break out individually. The patch is small. The iteration speed isn't.
Keep in mind that Shelly is carving out a real niche in an ecosystem that's historically treated graphical tools as afterthoughts. The native builder is the biggest step yet toward making Arch management feel like it belongs in 2026 instead of 2006. It's not a drop-in replacement for makepkg yet, though. Split-package builds still occasionally trip over edge cases, and the AUR remains unforgiving to unvetted source code. The developer notes that the builder lives inside Shelly's native package-management library rather than wrapping makepkg, which says more about the long game than any benchmark could.
If you want to try it, CachyOS ships a packaged version through sudo pacman -S shelly, and the AUR has yay -S shelly or paru -S shelly ready to go. Source builds work if you'd rather run from the GitHub repository. The next planned features on the roadmap are repository modification support, an offline update path similar to pacman-offline, and per-user layout customization.
Head here for the release notes and download links on GitHub.
