Shelly, a standalone package manager for Arch Linux, has released version 3.1 with a major expansion of its AUR capabilities: it can now build Arch packages directly from PKGBUILDs without using makepkg.
For those unfamiliar, Shelly is not yet another wrapper around Pacman. It is its own package manager, built around libalpm, the same underlying package-management library used by Pacman itself. Shelly handles package transactions, dependency resolution, repository packages, and AUR workflows on its own, and it is available through both a command-line interface and a GTK application.
Until now, one important part of the AUR workflow still depended on an external Arch tool. Shelly could discover AUR packages, resolve dependencies, let users review them, and handle installation, but the actual execution of a PKGBUILD was passed to makepkg. That changes with Shelly 3.1.
The new release introduces a native package builder as part of Shelly’s package-management library. Shelly now manages the complete build process itself, from reviewing the PKGBUILD to producing the finished pacman-compatible package archive.
The new functionality is exposed through the shelly build command. Running it inside a directory containing a PKGBUILD is enough to start a build: shelly build. Additionally, users can also point Shelly at a PKGBUILD elsewhere: shelly build /path/to/PKGBUILD.
And if dependencies are missing, the new --sync-deps option lets Shelly resolve and install them before starting the build: shelly build --sync-deps /path/to/PKGBUILD.
Internally, Shelly now handles the normal PKGBUILD lifecycle itself. It parses build instructions, reviews relevant files, downloads and verifies sources, runs build stages such as prepare(), build(), check(), and package(), generates required metadata, creates the package archive, and can optionally sign it. The resulting packages remain standard Arch Linux packages.
The builder also supports split packages, architecture-specific dependencies and sources, Git sources, checksums, package signatures, dynamic package versions, renamed sources, and many of the other PKGBUILD features commonly encountered in the AUR.
One useful part of the new implementation is that Shelly reviews a PKGBUILD before executing package-controlled code. The package manager shows the PKGBUILD and related files to the user and can flag suspicious commands, unsafe local sources, lookalike characters, and commands that would execute during the build process.
Shelly 3.1 also adds optional Landlock-based filesystem sandboxing for PKGBUILD execution. When enabled, package build scripts can access the build directory and required system paths while being prevented from freely accessing other parts of the user’s home directory. The feature is optional and disabled by default.
Dependency handling is another area that sees improvements. With --sync-deps, Shelly’s package manager now resolves missing dependencies rather than handing them off to Pacman. This means Shelly can install packages from the regular Arch repositories and locate and build dependencies available only from the AUR.
Beyond the new package builder, the release introduces run0 as another supported privilege-elevation backend and includes improvements to transaction reporting, shell completion, package cache recovery, hooks, HTTP handling, TLS initialization, and AppImage support.
For additional details, see the Shelly 3.1 changelog.
