Skip to content
Seafoam Labs

All versions since v2.3.3.4

All versions

v2.3.3.4

The following changes have been made:

New Setup screen will give dialogue confirmation for AUR . AppImage cleanup of bad desktop entries on sync from updates. AppImage improved path handling for custom paths and logic flows. Flatpak updating filter patterns. Read and add hook dirs from pacman.conf to libalpm.

Thank you for the first contribution @moutazhaq

v2.4.0.0

Shelly-ALPM v2.4.0.0 Release Notes

This release centers on a major CLI refactor, maturing AppImage/Flatpak support, and a new layer of PKGBUILD security analysis.

On the safety side, Shelly now actively inspects install scriptlets for dynamic code execution and post_install risks — the new PostInstallValidator scans resolved scriptlets for risky network/code-fetching tools (npm, npx, bun, pip, curl, wget, etc.) and flags dynamic command construction that can’t be statically reviewed, including command substitution ($(...), backticks), eval, ${!var} indirection, and decode-into-shell pipelines (e.g. base64 -d | sh). It even performs lightweight de-obfuscation (collapsing tricks like b''u''n, cur\l, and n"p"m) so deliberately hidden tool names are caught and escalated to Critical as a sign of malicious intent. Complementing this, the new HomographValidator defends against homograph/IDN spoofing in attacker-controlled fields (package names, dependencies, URLs, and AUR metadata) by detecting zero-width/bidi/control characters, mixed-script tokens (e.g. Latin mixed with Cyrillic/Greek), fullwidth/compatibility forms, and confusable “skeletons” that map look-alike Unicode onto ASCII (e.g. Cyrillic а → a). Findings surface through the same PkgbuildReviewDialog security-status path so users can review them before installing.

Rounding out the CLI work, this release ships a pacman-style shortcode interface: a compact -<Type><Action><modifiers> syntax that translates familiar single-letter operations into Shelly’s full command surface, making the CLI feel native to anyone coming from pacman/yay.

🔑 Shortcode Examples

The first argument may be a shortcode of the form -<Type><Action>[modifiers], where the Type selects a domain (S = system/repo, A = AUR, F = Flatpak, I = AppImage, C = config, K = keyring, U = utility) and the Action/modifiers map to a verb and flags:

Terminal window
shelly -SIu firefox     # install firefox -u   (sync install, with upgrade)
shelly -SQad            # query -a -d          (query available, fetch details of exact match)
shelly -SRcr pkg        # remove pkg -c -r     (cascade + config removal) : The equivalent of `sudo pacman -Rns pkg`
shelly -AS ripgrep      # aur search zen-browser-bin
shelly -AI yay-bin      # aur install zen-browser-bin
shelly -FR org.app.Id   # flatpak uninstall org.app.Id
shelly -KV ABCD1234     # keyring recv ABCD1234
shelly -UC              # cache-clean

Invalid combinations are rejected with helpful errors (e.g. an unknown action lists valid actions for that type, and an unknown modifier lists the allowed modifiers), and in shortcode mode --ui-mode is used in place of -U.

✨ Highlights

  • New CLI Release with a substantial refactor and modernized command surface (#1059, #1103).
  • AppImage support maturing: updates now shown in the UI, eventing improvements, and fixes to desktop-entry handling (#1053, #1058, #1075, #1087, #1092).
  • Security additions: PKGBUILD review now shows security status, flags dynamic/post_install code execution, and detects potential homograph spoofing (#1099, #1100).
  • doas support added as an alternative privilege-elevation backend (#1078).

🚀 Features

  • Add doas support (#1078)
  • Add manual language selection in settings (#1056) — thanks @nyx1d
  • Add docs command, with printed command options and default cascade enabled (#1084, #1097)
  • Add Zsh completions for the Shelly CLI (#1090)
  • Show AppImage updates in the UI (#1058)
  • Add new version column to AUR update view (#1047)
  • Add maintainer and last-updated columns to AUR search output (#1071)
  • Add security status to PkgbuildReviewDialog (#1099)
  • Add HomographValidator to flag homograph spoofing in PKGBUILDs (#1100)

🛠 Improvements & Refactors

  • CLI refactor (#1059) and new CLI release (#1103)
  • Refactor CredentialManager and add ProcessExecutor service (#1066)
  • Convert PerformDownload to async and refactor call sites (#1079)
  • Skip provider selection when only one distinct option is available (#1070)
  • Replace --elevated flag in UpgradeAll with a UserIdentity-based approach (#1093, #1094)
  • Refactor question handling to remove obsolete ALPM-specific protocols (#1091)
  • Update file-size display to Megabytes and refactor progress-bar logic (#1082)
  • Simplify query (#1076) and remove the explore alias from query (#1085)
  • AppImage eventing and CLI output updates from the manager (#1087, #1092)
  • Flatpak output and UI element updates (#1049, #1080)
  • General small UI adjustments (#1046)
  • Remove unused config options and delete unused/unwanted code (#1081, #1086)

🐞 Bug Fixes

  • Fix AppImages creating an additional desktop entry (#1053)
  • Fix Flatpak upgrade bug and remote selection (#1054)
  • Fix Flatpak scrolling issue (#1061)
  • Various AppImage fixes (#1075)

🌐 Localization

  • Update de-DE.po (#1089) — thanks @Henry2o1o

📦 Maintenance / Versioning

  • Merge Dev into master and master back-merge (#1040, #1041)
  • Update UI elements in Flatpak (#1049)
  • Bump version to 2.3.3.5 across all projects and PKGBUILD files (#1101)
  • Bump version to 2.4.0.0 across all projects and PKGBUILD files (#1102)

Contributors to Shelly-ALPM v2.4.0.0

  • @caroberrie — #1040, #1041, #1046, #1049, #1053, #1054, #1058, #1061, #1075, #1080, #1081, #1086, #1087, #1092
  • @ZoeyErinBauer — #1059, #1070, #1071, #1076, #1078, #1079, #1082, #1090, #1091, #1093, #1094, #1100, #1101, #1102, #1103
  • @azdanov — #1066, #1084, #1085, #1097, #1099
  • @Terrabade — #1047
  • @nyx1d — #1056 (first contribution 🎉)
  • @Henry2o1o — #1089

👋 New Contributors

  • @nyx1d made their first contribution in #1056

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.3.3.4...v2.4.0.0

v2.4.0.1

Bug Fix

  • –no-confirm now works as intended on upgrade all

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.0.0...v2.4.0.1

v2.4.0.2

Bug Fixes

  • Oopsie we forgot to update the tray service

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.0.1...v2.4.0.2

v2.4.0.3

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.0.2...v2.4.0.3

v2.4.0.4

What’s Changed

  • Correct Version selection pop up
  • Fix install + upgrade UI path

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.0.3...v2.4.0.4

v2.4.1.0

Shelly-ALPM v2.4.1.0 Release Notes

This release builds directly on the 2.4.0 line, hardening how Shelly talks to the network and to the system, deepening dependency resolution, and continuing the CLI refactor that began in 2.4.0.0. It also bundles a large batch of community translations and a steady stream of UI polish across the AppImage, Flatpak, and grid views.

🌐 Networking — Happy Eyeballs

Shelly’s HTTP stack now uses a Happy Eyeballs-style connection strategy in OptimizedClient. Instead of waiting on a single resolved address, Shelly resolves every address for a host, prefers IPv4 first so a missing IPv6 route can never block a working connection, and races the candidates with a fast 3-second per-address fallback. Critically, it waits for the first connection to succeed rather than the first to complete, so a quick “network is unreachable” failure on one path no longer aborts a request that a slower path would have served. Address-connection fallback in OptimizedClient was further tuned for reliability on mixed IPv4/IPv6 hosts.

🔒 Security — More risky tools, smarter privileges

The PostInstallValidator scriptlet scanner was expanded well beyond the original list. It now recognizes risky network- and code-fetching tooling across a wide range of ecosystems — JavaScript/Node (npm, npx, yarn, pnpm, bun, deno), Python (pip, pipx, uv, poetry, conda/mamba), Ruby, Rust, Go, PHP, Perl, Haskell, Lua, Nim, OCaml, Elixir/Erlang, C/C++ (conan, vcpkg), JVM build tools, .NET, Swift, Julia, R — alongside downloaders (curl, wget, aria2c, lftp, rsync, scp/sftp), container/orchestration tools (docker, podman, kubectl, helm, snap, flatpak), and version managers (nvm, pyenv, asdf, and friends). These findings continue to surface through the existing PKGBUILD security-review path so you can review them before installing.

On the privilege side, command execution in the privileged and unprivileged services was reworked, with Polkit detection added throughout ProcessExecutor, XdgPaths, and AurPackageManager. Package searches and lookups now run as unprivileged operations wherever possible, and a dedicated Polkit policy was added for privileged Shelly CLI execution (with refined icon and prompt messaging).

📦 Package management — Providers & group queries

Shelly can now resolve virtual dependencies via providers, presenting a provider selection when more than one package satisfies a dependency. The query command gained a --group / -g option for searching package groups (it defaults to searching available packages), making it easier to discover and inspect grouped packages from the CLI.

🐚 CLI refactor continues

Console creation across the CLI now flows through a single ShellyConsoleFactory, and RunShellyCommand and related execution paths in ProcessExecutor were refactored for clarity and consistency. PKGBUILD parsing learned to surface local source files, and Shelly now correctly reports when pacman hooks have run during an operation.

🖥️ UI, AppImage & Flatpak

  • New grid layouts for the update and manage views, with reworked grid-selection logic.
  • An alternate install view and an animated intro page.
  • Continued Flatpak UI improvements and better handling of Flatpak progress callbacks.
  • AppImage fixes, including corrected Forgejo-hosted AppImage updates.
  • Fixed the updates count not appearing in the UI.
  • Desktop cache ownership fix and refined lockout-service behavior.
  • Removed the obsolete fingerprint warning and related UI elements.

🌍 Translations

This release ships a large localization update: refreshed Japanese, French (fr_FR), Turkish (tr_TR), German (de_DE) translations, a new Italian translation, and additional automated localization passes.

What’s Changed

Contributors

A huge thank you to everyone who contributed to this release — 10 unique contributors, 2 of them brand new to the project:

  • @ZoeyErinBauer
  • @caroberrie
  • @azdanov
  • @utuhiro78
  • @Landeli7
  • @Renari 🆕
  • @celonfix
  • @juliazero
  • @Mattyan89 🆕
  • @Henry2o1o

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.0.4...v2.4.1.0

v2.4.1.1

Shelly-ALPM 2.4.1.1 Release Notes

New Features

  • Added a --standard option to the search command for querying standard packages. Shortcode: -ASs.
  • Rebuilt the tray service and notification logic, rewritten in Vala reducing memory usage of the tray service.
  • Added JSON output support for update-related CLI commands and the AppImage search command, making Shelly easier to script and integrate with other tools.
  • Added support for preferring prebuilt -bin package variants over building from source when available.
  • Added filtering of installed AUR packages by explicit vs. dependency status.
  • Added a new StatWindow for viewing package statistics.
  • Added support for installing packages directly from the Flathub website’s install button.
  • Added the ability to select and highlight package names and descriptions in search results.
  • Added support for default-click actions on notifications.
  • Added starfish a visual depend viewer to install page. Turned on in advanced.

Improvements

  • Refactored the Flatpak namespace structure for better modularity and maintainability.
  • Extracted and refactored PackageSearch into Shelly.Utilities for cleaner code organization.
  • Refactored the PKGBUILD review dialog.
  • Parallelized package and recommendation fetches in the Recommend window and Package Install window for faster load times.
  • General package manager cleanup across the codebase.
  • Added support for handling multiple package artifacts in AUR packages.

Bug Fixes

  • Fixed text getting cut off at the end of the AUR PKGBUILD preview.
  • Fixed a crash in the Starfish integration caused by improper disposal of the graph widget.
  • Fixed AppImage installation logic to correctly use the destination path for Exec.
  • Fixed incorrect numbering in the provider selection menu.
  • Removed unnecessary quotation escaping in shell arguments.
  • Fixed the DigitalOcean action reference in the release workflow.
  • Fixed the Persian translation for the check function message.

Translations

  • Added Farsi (Persian) translation.
  • Updated Japanese translation.
  • Updated Portuguese (Brazil) translation.
  • General localization updates across supported languages.

New Contributors

Welcome and thank you to our newest contributors:

  • @behdanisohrab
  • @psonker-ghub
  • @Stirreg
  • @zc0rp10

Contributors

Thanks to everyone who contributed to this release: @ZoeyErinBauer, @azdanov, @caroberrie, @VinnyQF, @behdanisohrab, @psonker-ghub, @NateKing204, @Stirreg, @juliazero, @zc0rp10, @utuhiro78

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.1.0...2.4.1.1

v2.4.1.2

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.1.1...v2.4.1.2

v2.4.1.3

What’s Changed

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.1.2...v2.4.1.3

v2.4.1.4

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.1.3...v2.4.1.4

Shelly V3.0.0

Shelly-ALPM v3.0.0 — A New Era for Shelly

imdawdage

Shelly v3 is here, and this is easily our biggest release yet! Rather than adding another layer to the existing application, we went back to the foundation and rebuilt almost every major part of Shelly. The package-management core, command-line interface, keyring tool, and GTK4 desktop app have all moved from the v2 C#/.NET codebase to Zig.

The rewrite gives Shelly a much cleaner base to build on, removes the managed .NET runtime from the main application, and makes the connection between Shelly and native Arch Linux libraries far simpler. The familiar shelly and shelly-ui commands are still there, but nearly everything powering them is new.

⚡ Why Zig matters

This is where the v3 rewrite really shines. Zig is a great fit for a package manager because Shelly already works closely with native Linux libraries such as libalpm, GTK4, libarchive, and GPG. Shelly v3 can call those libraries directly through native bindings instead of moving data through a managed runtime and a large interop layer.

In practical terms, the move to Zig gives Shelly:

  • Fast, ahead-of-time compiled native executables with no managed .NET runtime or garbage collector to start and manage.
  • More predictable memory and resource lifetimes through explicit allocators and ownership.
  • Better compile-time checking at the C library boundary, including generated libalpm bindings.
  • Less runtime machinery between the UI, CLI, and package-management code. That gives Shelly a strong foundation for quicker startup and lower resource use, with proper benchmark work still to come.
  • One native build and test workflow for the CLI, UI, keyring helper, package manager, and optional Flatpak backend.
  • Release-safe builds for the desktop application and size-optimized builds for command-line tools.

The rewrite also let us remove hundreds of old C# source files and retire the previous .NET projects instead of dragging two implementations forward. Making the projects much simpler while providing similar feature sets. It is a huge cleanup and an even bigger step toward making Shelly easier to improve release after release.

🖥️ A completely rebuilt GTK4 experience

The desktop app has been rebuilt in Zig on GTK4, and it feels like a new generation of Shelly. Pages, dialogs, background operations, and communication with the CLI now sit on a cleaner structure, giving the interface plenty of room to grow.

  • Updated the new first-run welcome screen that helps users choose AUR, Flatpak, and AppImage support. Shelly can even install the optional requirements when a feature is enabled.
  • Reworked package browsing with list and grid layouts, sortable columns, better selection behavior, source labels, installed-state filtering, and more complete package details.
  • Improved AUR details, optional dependency selection, PKGBUILD previews, review prompts, and visible makepkg output.
  • Rebuilt update planning and transaction progress so the UI can show the full operation output without locking up during longer tasks.
  • Refined Flatpak management experience with new navigation and new page for installing from bundles and refs.
  • AppImage installation made safer installs are less likely to leave ghost entries behind.
  • Moved maintenance actions into a dedicated Utilities page, including database synchronization, stale lock repair, permission repair, package cache cleanup, and orphan cleanup.
  • Added autosaving settings, configurable sidebar or top-bar navigation, default-page selection, and useful keyboard shortcuts.
  • Improved tray startup and shutdown behavior, single-instance window raising, icons, spacing, theme colors, and a long list of smaller GTK details that make Shelly feel more polished.

🐚 A fully native CLI

The shelly CLI has also been rebuilt from the ground up in Zig. It keeps the readable long-form commands and pacman-like shortcodes, while one native command catalog now powers help, documentation, and shell completions.

  • Running shelly <search terms> can now search standard repositories and the AUR, then send the selected result straight into the normal install flow.
  • Combined update checks and upgrades coordinate standard packages, AUR packages, AppImages, and Flatpaks. An unavailable optional backend no longer has to prevent the independent sources from continuing.
  • Added a package backup export and import using a readable TOML format.
  • Added and expanded commands for package marking, downgrade selection, Arch news, keyring management, configuration, package cache cleanup, pacnew/pacsave handling, stale database lock repair, and permissionrepair.
  • Added Bash completion generation alongside Fish and Zsh, making the new CLI nicer to use right away in more shells.
  • Improved confirmations and transaction previews, including explicit review before system upgrades and before AUR builds.
  • Kept structured JSON output for supported commands and added a framed output mode used by the GTK UI.

🛡️ Smarter package management and stronger reliability

  • Brought ALPM repository configuration, database synchronization, package queries, dependency resolution, installs, removals, upgrades, and downgrades into the new native package-management library.
  • Added parallel repository database synchronization, mirror retry handling, package database signature verification, and clearer signature failures.
  • Preserved the Happy Eyeballs-style network behavior from late v2 and tightened it with response-body validation, redirect handling, mirror fallback, and more reliable timeout behavior.
  • Improved handling for ignored packages and groups, repository usage flags, custom and single-server repositories, installed package reasons, optional dependencies, split packages, and packages already available in system repositories.
  • Ported PKGBUILD parsing and the post-install and homograph checks used during AUR review.
  • AUR upgrades can now review all changed PKGBUILDs before the transaction begins, rather than interrupting the upgrade one package at a time.
  • Fixed cases where optional dependencies could be removed even though another installed package still needed them.
  • Fixed AUR build hangs, incorrect AUR versions, missing built packages, AppImage ghost entries, stale update plans, and several UI state and selection issues.

📦 Flatpak is now truly optional

One of the most exciting structural improvements in v3 is the new optional Flatpak backend. Flatpak support is now shipped as the separate shelly-flatpak-backend package. The base Shelly CLI package does not link to libflatpak, GLib/GIO, or OSTree for Flatpak operations, and it does not load the backend while running non-Flatpak commands.

The backend communicates through a versioned native ABI with a strict message schema and explicit ownership rules. Shelly checks the ABI before use, rejects an incompatible backend cleanly, and keeps ALPM, AUR, AppImage, help, version, and completion commands available when Flatpak support is not installed.

This split keeps the base install lean for people who do not use Flatpak, while letting anyone add full Flatpak support later without rebuilding or reinstalling Shelly. It is a cleaner design for both kinds of users.

🔄 Upgrade notes

  • Existing configuration files are overlaid on the new native defaults, so normal settings should carry forward. Unknown old fields are ignored.
  • Flatpak users should install both flatpak and shelly-flatpak-backend. Shelly will explain what is missing if a Flatpak command is used without them.
  • The standalone keyring executable is now shelly-key instead of shelly-keys. The supported shelly keyring ... commands should be preferred in scripts.
  • The CLI was substantially rebuilt. Existing automation should be checked against shelly --help, especially if it depended on exact human-readable output. Use --json where a command supports it.
  • Clean-chroot AUR builds are still available from the CLI, but the chroot toggle has temporarily been removed from the graphical AUR page while that workflow is being hardened.

🌍 Translations

The rebuilt UI is arriving with refreshed translation catalogs for Bulgarian, Catalan, Chinese (Simplified), French, German, Greek, Hungarian, Italian, Japanese, Persian, Polish, Portuguese (Brazil and Portugal), Russian, Spanish, and Turkish. Notification translations received updates too, helping more people enjoy v3 in their preferred language from day one.

❤️ Thank you, contributors!

Shelly v3 would not have happened without the extreme dedication, hard work, and occasional wrestling of this enormous rewrite into shape.

Core Contributors:

  • @ZoeyErinBauer
  • @caroberrie
  • @azdanov

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v2.4.1.4...v3.0.0

v3.0.1

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.0+9...v3.0.1

v3.0.1+1

What’s Changed

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.1...v3.0.1+1

v3.0.2

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.1+1...v3.0.2

v3.0.3

What’s Changed

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.2...v3.0.3

v3.0.4

What’s New in Shelly 3.0.4

Features & Improvements

  • New Shelly search experience (#1681)
  • Start of TUI (#1645)
  • Add AUR link to the AUR detail view (#1626)
  • Improve AppImage integration (#1661)
  • Update Polkit warning (#1657)
  • Update tray indexing (#1638)
  • Update UI D-Bus call (#1627)
  • Inject pkgname from array for split packages (#1634)
  • Report missing PKGBUILD source files consistently (#1673)
  • Remove the legacy Vala tray implementation (#1670)
  • Add man page generation and installation for the Shelly CLI (#1677)

Flatpak

  • Add end-of-life detection and rebase support (#1650)
  • Resolve branch from remote metadata (#1648)
  • Show verified status for Flatpak apps (#1651)
  • New remove dialog (#1680)

Bug Fixes

  • Fix status label (#1631)
  • Fix problem installing sabnzbd from the AUR (#1668)
  • Fix welcome screen layout (#1672)
  • Fix tray icon and reaping of spawned processes (#1676)

Shell Completions

  • Fix Zsh autocompletion for install and remove (#1647)
  • Improve Bash and Fish argument completions (#1678)
  • Add command shortcodes for Bash and Fish completions (#1679)

Testing

  • Add test for the install script (#1635)

Translations

  • Updated Spanish (#1629), Japanese (#1643), Russian (#1658), Polish (#1665), German (#1667), and Basque translations (#1623)
  • Refreshed translation files (#1660)

Contributors

@caroberrie @azdanov @ZoeyErinBauer @adem4ik @utuhiro78 @juliazero @bingenm @Henry2o1o

New Contributors

  • @Marks20125 made their first contribution (#1629)
  • @mariuskreutzer made their first contribution (#1647)

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.3...v3.0.4

v3.0.5

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.4...v3.0.5

v3.0.6

What’s Changed

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.0.5...v3.0.6

v3.1.0

Shelly-ALPM v3.1.0 — Building Arch Packages, the Shelly Way

Shelly v3.1 is here, and its headline feature is something we have wanted since before the Zig rewrite began: Shelly can now build Arch Linux packages itself.

Until now, Shelly handled AUR discovery, dependency resolution, package review, and installation while handing the actual PKGBUILD execution to makepkg. In v3.1, that final handoff is gone from the default AUR workflow. Shelly now owns the complete build pipeline, from reviewing a PKGBUILD to publishing a signed, pacman-compatible package archive.

This is not a wrapper around makepkg. The new builder is part of Shelly’s native package-management library and can be used directly through the new shelly build command.

🏗️ Meet shelly build

Point shelly build at a PKGBUILD and Shelly will turn it into an installable Arch package:

Terminal window
# Build ./PKGBUILD
shelly build


# Build a PKGBUILD somewhere else
shelly build /path/to/PKGBUILD


# Install missing dependencies and then build
shelly build --sync-deps /path/to/PKGBUILD

Shelly follows the familiar PKGBUILD lifecycle while managing the entire process internally:

  1. Parse the PKGBUILD without immediately executing its top-level shell code.
  2. Display the PKGBUILD, related files, and security findings for review.
  3. Lock the approved contents with an integrity digest.
  4. Safely evaluate dynamic metadata and re-review any newly discovered files.
  5. Download and verify sources.
  6. Run verify(), prepare(), pkgver(), build(), and check() when present.
  7. Run package() or the appropriate split-package function.
  8. Generate package metadata, assemble the archive, and optionally sign it.
  9. Publish the finished artifacts and clean temporary work directories.

The result is still a normal Arch package. Shelly writes makepkg-compatible .PKGINFO, .BUILDINFO, .MTREE, .INSTALL, and .CHANGELOG entries and produces archives that pacman and other Arch tools understand.

📦 Full PKGBUILD support

The builder is designed around Arch’s existing PKGBUILD format rather than introducing a Shelly-specific recipe format.

It supports:

  • Standard verify(), prepare(), pkgver(), build(), check(), and package() functions.
  • Single packages and split packages, including package-specific metadata overrides.
  • Dynamic package names and package arrays resolved by top-level Bash logic.
  • Architecture-specific sources, checksums, dependencies, and metadata.
  • The usual $startdir, $srcdir, $pkgdir, $CARCH, and $CHOST build variables.
  • PKGBUILD helper functions and makepkg-style msg, msg2, plain, warning, and error output helpers.
  • Local files, HTTP and HTTPS downloads, file:// sources, and Git repositories.
  • Renamed sources using the name::url syntax.
  • Git branches, tags, commits, and signed Git objects.
  • noextract=() handling and automatic extraction of supported archives.
  • MD5, SHA-1, SHA-224, SHA-256, SHA-384, SHA-512, and BLAKE2 checksums.
  • Detached .sig, .sign, and .asc signatures, including compressed signatures.
  • validpgpkeys=() fingerprint enforcement.
  • Dynamic pkgver() results and package metadata changed inside package() functions.
  • Package architecture validation and correct any package output.
  • Split-package selection using the advanced, repeatable --package <name> option.
  • Configurable build flags, LTO flags, make flags, ccache, and distcc.
  • Detached signing of completed package archives.

Shelly also provides virtual root-ownership handling during package(). Common commands such as chown root, chgrp root, and install -o root -g root work without changing ownership on the host. The archive writer records the correct root ownership in the package itself. Device-node creation and unsupported privileged metadata operations are rejected.

🛡️ Beyond makepkg and improving trust

makepkg is the official Arch package-building tool. Shelly’s builder keeps the parts package maintainers expect while adding protections and package-manager integration that makepkg does not provide on its own.

Review before execution

Shelly does not begin by blindly sourcing the PKGBUILD. It parses the file first and presents it for review before allowing package-controlled code to run.

The review includes:

  • The complete PKGBUILD.
  • Local source files.
  • Install scripts and changelogs.
  • Binary-file warnings.
  • Suspicious post-install commands.
  • Homograph and lookalike-character warnings.
  • Unsafe local-source references.
  • Top-level command substitutions that will execute during the build.

If dynamic PKGBUILD evaluation discovers additional sources, install scripts, or split-package members, Shelly stops and asks for a supplemental review.

Review integrity protection

Approving a file is not enough if that file can be changed before it executes. Shelly hashes the PKGBUILD and every related reviewed file, then checks those contents again immediately before execution.

The same digest is carried across privilege elevation when --sync-deps is used. If the PKGBUILD, install script, changelog, or local source changes after approval, the build is rejected.

Packaging also uses the exact reviewed bytes for install scripts and changelogs instead of reopening those files later.

Optional Landlock confinement

Shelly can place every untrusted PKGBUILD lifecycle step inside a Linux Landlock filesystem sandbox.

When enabled, the build functions can access the build directory and normal system toolchain paths, but they cannot freely browse or modify the user’s home directory. Extra read-only or writable paths can be granted for tool caches such as Cargo, Gradle, npm, or ccache.

The sandbox applies to:

  • Dynamic PKGBUILD evaluation
  • verify()
  • prepare()
  • pkgver()
  • build()
  • check()
  • package() and split-package functions

Source downloads, package assembly, logging, and GPG signing stay outside the sandbox, so the user’s GPG keyring never needs to be exposed to package-controlled code.

Landlock is opt-in. When enabled on a system without Landlock support, Shelly fails before executing the first build step instead of silently running the build without protection.

AUR-aware dependency installation

--sync-deps resolves dependencies through Shelly’s package manager rather than simply passing them to pacman.

That means it can:

  • Detect dependencies already satisfied by installed packages or provides=().
  • Install missing repository dependencies.
  • Locate and build dependencies that are only available from the AUR.
  • Resolve dependencies for every requested split-package member.
  • Include checkdepends only when tests are enabled.
  • Keep runtime dependencies installed.
  • Remove newly installed build-only and check-only dependencies afterward.
  • Perform that cleanup after both successful and failed builds.

By comparison, makepkg’s documented --syncdeps delegates missing dependencies to pacman, while --rmdeps removes them only following a successful build. It does not independently build missing AUR dependencies. See the official makepkg documentation.

The elevated Shelly process only coordinates dependency transactions. The PKGBUILD itself is always executed again as the original non-root user, with NO_NEW_PRIVS applied to the builder and inherited by its children.

Guided PGP key handling

When a PKGBUILD pins source-signing keys through validpgpkeys=(), Shelly checks the invoking user’s keyring before downloading and building.

If a required key is missing, Shelly shows the complete fingerprint and asks whether it should be imported using shelly keyring recv --user. After import, the key is checked again before the build continues.

Detached signatures and signed Git objects must match the pinned primary fingerprint. Bad, revoked, missing, or unexpected keys fail the build.

Safer source handling

Shelly’s source pipeline adds several defensive boundaries:

  • Every non-VCS source must have integrity checks.
  • Cached downloads are written to temporary files and atomically committed.
  • A cached HTTP source that fails its checksum is discarded, downloaded again, and rechecked.
  • Git sources use reusable mirrors that are refreshed before local materialization.
  • All sources are acquired and verified before any archive is extracted.
  • Archive extraction rejects absolute paths, directory traversal, unsafe symlink destinations, and oversized entries.
  • Source trees are assembled in staging directories and only moved into place after preparation succeeds.

Atomic package publication

Completed archives are written under randomized temporary names. Shelly publishes them with an atomic rename only after archive creation and optional signing succeed.

If any member of a split-package build fails, already published artifacts from that build are removed. Signatures are rolled back with their corresponding packages, avoiding partial split-package results and orphaned .sig files.

Structured progress and mandatory logs

Every build is a structured Shelly operation. Output can be streamed into the normal CLI or the GTK transaction interface, with phase changes, package names, errors, progress percentages, cancellation, review questions, and completed artifact paths preserved as distinct events.

Every build also receives a log before source processing begins. Logs:

  • Record phase boundaries.
  • Label stdout and stderr separately.
  • End with success, failed, or cancelled.
  • Are retained for every outcome.
  • Fail the build if Shelly cannot create or continue writing the log.

Logging in makepkg is optional through --log; Shelly makes the audit trail part of the build contract. See makepkg(8).

🎛️ shelly build options

  • --reviewed, -r — skips the interactive review prompt when the caller has already reviewed the package. Integrity hashing and change detection remain active.
  • --sync-deps, -s — installs missing repository and AUR dependencies, runs the build as the invoking user, and removes build-only dependencies afterward.
  • --check, -c — runs check() and includes checkdepends.
  • --no-check — skips check() and does not install checkdepends.
  • --sign — creates a detached OpenPGP signature beside every package archive.
  • --nosign — disables signing even when it is enabled in configuration.
  • --key <fingerprint> — selects the GPG key used to sign the finished package.
  • --noverify — skips the PKGBUILD’s custom verify() function. It does not disable built-in checksum or source-signature verification.
  • --package <name> — builds only the selected split-package member. It may be repeated to select several members.
  • --isolated, -i — reserved for the future isolated-root builder and currently nonfunctional.

The usual Shelly global options, including noninteractive and UI operation modes, continue to apply.

⚙️ Introducing shellybuild.conf

The new builder has its own configuration file, shellybuild.conf. It replaces makepkg.conf for Shelly’s in-process builder only.

Shelly merges:

  1. /etc/shellybuild.conf
  2. $XDG_CONFIG_HOME/shelly/shellybuild.conf
  3. ~/.config/shelly/shellybuild.conf when XDG_CONFIG_HOME is unavailable

The system file installed by Shelly is a commented template, so upgrading does not silently replace the builder’s compiled defaults. It is also registered as a pacman backup file so local administrator changes are preserved.

Configuration covers:

  • Target architecture and host triplet.
  • C, C++, preprocessor, linker, LTO, and make flags.
  • Default check() behavior.
  • ccache and distcc.
  • Packager identity and package archive format.
  • Package options and strip flags.
  • Signing defaults and signing key.
  • Separate build, package, source-cache, and log destinations.
  • Landlock enablement and additional read or write paths.

Unlike makepkg.conf, which is sourced as shell code, shellybuild.conf is data-only TOML. Unknown keys, unsupported options, malformed values, unsafe extensions, and relative destination paths fail before the PKGBUILD runs. See the official description of sourced makepkg configuration in makepkg.conf(5).

PKGBUILD options=() entries still override configured package options using the familiar option and !option form.

🐚 A better AUR workflow everywhere

The standalone command and Shelly’s regular AUR installs use the same builder. Improvements made to shelly build therefore also apply when installing or upgrading AUR packages from the CLI or GTK application.

This release also improves compatibility with real-world PKGBUILDs:

  • Added dynamic scalar and indexed-array evaluation.
  • Fixed dynamically generated split-package members.
  • Improved architecture-specific metadata and package selection.
  • Added support for top-level Bash expansion and source command substitution.
  • Fixed local source names containing spaces.
  • Improved Linux kernel and NVIDIA DKMS package builds.
  • Added source-signing key support needed by packages such as Spotify.
  • Improved handling for source-less packages, bare Git sources, package metadata overrides, and makepkg message functions.
  • Made PKGBUILD review contents selectable and copyable in the GTK interface.
  • Improved failure reporting so the failing package and lifecycle stage are easier to identify.

✨ More v3.1 improvements

Beyond the builder, v3.1 includes another substantial round of reliability and usability work:

  • Added run0 as a supported privilege-elevation backend.
  • Improved shell completion for bare actions and combined shortcodes.
  • Fixed terminal table wrapping and rendering artifacts.
  • Made optional-dependency prompts identify the package they belong to.
  • Improved transaction completion and failure output.
  • Allowed combined updates to continue when an optional backend is disabled or unavailable.
  • Improved ALPM errors, package cache recovery, hooks, and human-readable transaction logging.
  • Added gzip and deflate HTTP response support and fixed TLS initialization and stalled response-body timeouts.
  • Improved AppImage update detection, static URL validation, symlink handling, metadata cleanup, icons, and update editing.
  • Removed the remaining C# AppImage database migration bridge.
  • Updated German, French, Hungarian, Polish, Russian, and other translations.

🔄 Upgrade notes

  • shelly build creates packages but does not install its standalone output. Shelly’s normal AUR install workflow handles both building and installation.
  • Landlock confinement is disabled by default and must be enabled in shellybuild.conf.
  • The sandbox restricts filesystem access, not networking. /tmp remains shared and /proc remains visible.
  • Clean or isolated root builds are still being developed. The current --isolated option must not be relied on.
  • The current source pipeline supports local files, file://, HTTP, HTTPS, and Git. Other makepkg VCS protocols and arbitrary DLAGENTS are not yet supported.
  • Source-package creation, SRCPKGDEST, repackaging, integrity generation, and arbitrary shell configuration are not currently provided by shelly build.
  • Shelly’s content-changing tidy phase currently implements binary and library stripping. Some additional makepkg package options are recognized for compatibility but are not yet fully modeled.
  • External makepkg and clean-chroot workflows do not read shellybuild.conf.

❤️ Thank you, contributors!

Shelly v3.1 represents months of work across the package builder, PKGBUILD parser, AUR manager, CLI, GTK interface, AppImage support, networking, translations, and transaction system.

A huge thank you to everyone who helped build and test this release:

  • @ZoeyErinBauer
  • @caroberrie
  • @azdanov
  • @VinnyQF
  • @Henry2o1o
  • @hotline1337
  • @adem4ik
  • @ethanhawkes-gif
  • @Impostor0729
  • @juliazero
  • @Scott-Nx
  • @roxfr

Full Changelog: v3.0.6…v3.1.0

Release pull request: #1793

v3.1.1

What’s Changed

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.1.0...v3.1.1

v3.1.2

What’s Changed

New Contributors

Full Changelog: https://github.com/Seafoam-Labs/Shelly-ALPM/compare/v3.1.1...v3.1.2

Shelly-ALPM v3.1.3 — A Little Housekeeping, a Lot of Building

Shelly v3.1.3 gives your AUR cache a cleanup button, your AppImages their own environment settings, and the package builder another round of fixes for the PKGBUILDs you use every day.

There is plenty happening on the desktop, too: Flathub links take you to the app you wanted, package conflict prompts explain what is being removed, and the parallel download setting now does what it says. Behind the scenes, isolated builds gain Shelly’s own provisioning helper and new tools for build automation.

🧹 Give your AUR cache some breathing room

Built AUR packages can add up. You can now preview and remove those archives with --aur-cache:

Terminal window
# See what would be removed
shelly purify standard --aur-cache --dry-run


# Review and confirm the cleanup
shelly purify standard --aur-cache

This removes all built AUR package archives and their matching signatures from Shelly’s cache. Your PKGBUILDs, checkout history, sources, and build directories stay in place. You can also combine it with --cache to clean the standard package cache in the same command.

Prefer to handle cleanup yourself after upgrades? There is a setting for that:

Terminal window
shelly config set DisableCacheClean true

It skips the cleanup prompt and deletion during shelly upgrade all and its aliases. Cleanup remains enabled by default, and standalone shelly upgrade standard keeps its existing behavior.

🎛️ Your AppImages, your environment

Each installed AppImage can now have its own environment variables, configurable from the UI or CLI:

Terminal window
shelly config appimage "MyApp" --set-env "MY_VARIABLE=my-value"
shelly config appimage "MyApp" --unset-env "MY_VARIABLE"

Replace MyApp with the exact installed AppImage name. Overrides apply when launching from the desktop or through shelly run, and they survive AppImage updates. The CLI also supports clearing or replacing the full set of overrides.

StaticURL update checks now follow redirects correctly, too.

🏗️ More PKGBUILDs feeling at home

This release fixes several cases where valid package recipes could trip up Shelly’s native builder:

  • Fixed shell here-string and command-substitution parsing that could leave build wrapper scripts with syntax errors.
  • Added a consistent SOURCE_DATE_EPOCH throughout PKGBUILD evaluation, build steps, and package metadata.
  • Improved dependency planning for conditional arrays, architecture-specific dependencies, and split packages.
  • Improved archive detection and extraction, including extensionless archives.
  • Added standalone gzip/Unix compress, bzip2, xz, and zstd decompression before prepare(), respecting source aliases and noextract.
  • Fixed empty optional file assignments such as install='' being rejected as unsafe paths.
  • Failed binary stripping now produces a warning and keeps the original file. This fixes builds such as pi that include binaries the host’s strip tool cannot process.
  • Fixed source verification with multiple PGP signatures to follow signature-status handling, plus keyserver argument ordering during key imports.

🛠️ Shellystrap and build automation

Isolated builds now use shellystrap, Shelly’s own libalpm-based helper, to provision fresh build roots. This replaces the pacstrap dependency and keeps provisioning inside private namespaces.

Required public source-signing keys can now travel from the invoking user’s keyring into the isolated build. Reviewed-file staging, dependency checks against freshly synchronized private repository databases, and cancellation cleanup across privilege elevation have also been improved.

For automated builders, this release adds:

  • shelly --version --json for version and capability discovery.
  • JSON build review and result output, with review-digest validation.
  • Configurable package output destinations.
  • shelly resolve to map exact repository or AUR package names to package bases.

Using isolated builds? You need unshare from util-linux alongside systemd-nspawn. For unattended builds, import required source-signing keys into the invoking user’s keyring beforehand; --no-confirm does not approve missing-key imports.

✨ A smoother desktop

  • Flathub links open the right app, even if Shelly is already running or still loading its catalog. Flatpak reference files and AppStream links are handled, too.
  • Flatpak details gain uninstall controls, installed and verified indicators, better remote selection, and clearer loading feedback.
  • Conflict prompts name the packages involved, including which installed package will be removed and what replaces it.
  • Tray checks can follow your schedule with a cron mode that waits for the configured weekly time before the first check. Weekly scheduling also no longer depends on the symbolic tray icon setting.
  • Fixed the installed AUR view failing to restore correctly after a reload.
  • Improved dependency download progress, long package-name display, and error messages across the CLI, TUI, and GTK interface.
  • Support setup now skips dependencies you already have installed.

⚡ Parallel means parallel

Repository database and package downloads now respect ParallelDownloadCount. The setting accepts 1–255, with a default of 100. Older configurations with invalid values fall back to the default.

🌍 Translations and thanks

Italian and Simplified Chinese translations have been updated. Thank you to everyone contributing translations, reporting troublesome packages, and helping test the fixes in this release!

Full Changelog: v3.1.2…234f1e0a

Release pull request: #1876

v3.1.4 A slice of builds

Shelly Pi 3.14 gives the native builder another round of fixes for real-world PKGBUILDs, adds a way to reclaim space from the AUR build cache, and makes package reviews easier to navigate.

There is plenty happening on the desktop, too: Flathub links open the app you wanted, package conflicts explain what will be removed, and package details are easier to read and copy. Behind the scenes, isolated builds gain Shelly’s own provisioning helper, stronger PGP support, and more reliable dependency handling.

🧹 Give your AUR cache some breathing room Built AUR packages can add up. You can now preview and remove cached build archives with –aur-cache, making it possible to recover disk space without manually digging through Shelly’s cache.

shelly purify standard –aur-cache

Standard purge behavior has also been corrected.

🏗️ A sturdier native builder The native builder now supports more complex PKGBUILDs and fixes failures involving SOURCE_DATE_EPOCH, install declarations, shell parsing, unsafe source paths, and sources that share the same filename.

Git sources are cloned from their original URLs, required files are detected more reliably, and regression tests cover the corrected behavior. Package-specific failures affecting Anydesk, Mandolin, Remora, and Pi have also been addressed.

🛠️ Shellystrap and isolated builds Isolated environments now use Shellystrap, Shelly’s own provisioning helper. Required PGP keys can be handed off to isolated builds, dependency handling has been improved, and systemd home-directory issues have been corrected.

🔍 Review upgrades your way AUR PKGBUILD reviews now support collapsed diffs, making large changes easier to navigate. Individual upgrades can also be reviewed separately before continuing.

Optional dependencies are handled more clearly, ignored packages remain visible in filtered lists, and conflict prompts identify which installed package will be removed.

✨ A smoother desktop experience Package columns now use ellipses instead of overflowing, while package-detail text can be selected and copied. Installation status updates display more reliably, and PGP key-import confirmations no longer crash the interface.

Flathub links open directly to the requested application, Flatpak pages show the correct installed and update versions, and dependency download progress is represented more accurately.

📦 AppImage, Flatpak, and tray improvements Each installed AppImage can now have its own environment variables, and StaticURL update checks correctly follow redirects.

Flatpak installation and update flows have been refined, including fixes for application selection and version display. The notification tray can now follow a cron schedule, and tray-service updates initiated from the CLI work correctly.

⚡ Downloads and package operations Parallel package and repository downloads now respect the configured setting. Package installation places –needed correctly, package status is updated more reliably, and command output uses clearer wording.

🌍 Translations This release updates the Simplified Chinese, Italian, Brazilian Portuguese, and Japanese translations. It also introduces Azerbaijani translations for the UI and notification components.

❤️ Thank you, contributors! Thank you to everyone who contributed fixes, translations, testing, and improvements to this release:

@VinnyQF, @caroberrie, @ZoeyErinBauer, @azdanov, @square-235, @Mattyan89, @StKob, @jamalkamaladdin, and @utuhiro78.

A special welcome to first-time contributors @square-235, @StKob, and @jamalkamaladdin!

v3.1.5 - A Better View, a Better Build

Release Notes

Shelly v3.1.5 brings an optional Atoll-powered AUR browser, a build-and-install command, and native tools for maintaining your own package repositories. The builder also gets another round of compatibility fixes, from dependency-only metapackages to packages with unusual permissions and source archives.

Everyday package management gets some attention, too: standard searches return matching packages again, AUR installs gain --needed, AppImages are easier to remove, and errors explain more of what went wrong.

🏝️ Explore the AUR with Atoll

Enable Atoll Powered AUR in Advanced settings to use the new AUR page. Browse a paginated package list, sort by votes or popularity, and choose Best Match, Name, Provides, or Words from the Search By dropdown. Package details include dependency information, with installed and out-of-date indicators in the list.

The option is off by default. Switching it on also points Shelly’s CLI AUR service at Atoll; switching it off restores the Arch AUR service.

Terminal AUR search results now include clickable package links when using the Arch AUR or Atoll. Other configured services keep plain-text package names, and failed AUR requests provide more useful diagnostics.

🏗️ Build it, then install it

shelly build now supports --install (-l). Combine it with --sync-deps to install missing build dependencies, build the package, and install the resulting archives:

Terminal window
shelly build --sync-deps --install
# Short form:
shelly build -s -l

Administrator credentials are requested up front, while the build runs as your regular user. Installation also works with isolated builds after the completed archives are exported.

The install shortcut is -l; -i remains the shortcut for --isolated.

🛠️ More PKGBUILDs, fewer build failures

This release improves several parts of the native builder:

  • Dependency-only metapackages, including recipes without a package() function, can now produce valid packages.
  • Empty or zero epochs no longer introduce a leading colon into package versions. AUR update comparisons also handle affected installed versions correctly, fixing repeated update offers.
  • Packages with restrictive directory permissions, such as snapd, can be assembled and cleaned up without leaving failed builds that block retries.
  • Global build dependencies are kept separate from split-package runtime dependencies, allowing conflicting outputs to be built together.
  • Source extraction handles hard links, forward hard-link chains, and literal backslashes in filenames more accurately. Array expansion and here-string parsing have also been improved.
  • Isolated builds run guest package hooks during provisioning, improve compatibility with restrictive umasks, and preserve virtual ownership for external packaging helpers.

These changes address build failures involving packages such as Heroic, GStreamer, libblockdev, CUPS, and FUSE, alongside improvements for automated builds.

⚙️ Take control of your build environment

Native builds now use a predictable system PATH, fixing failures caused by inheriting an unsuitable path from privilege elevation. Add custom toolchain directories through build.extra_path in shellybuild.conf.

The new build.env setting supplies literal environment variables to the unprivileged builder:

[build]
extra_path = ["/home/your-user/.cargo/bin"]
env = { JAVA_HOME = "/usr/lib/jvm/default" }

Elevated native builds also preserve the caller’s locale settings, with C.UTF-8 as the fallback for a missing or empty LANG.

Upgrade note: tools previously found only through your terminal’s PATH must now be listed in build.extra_path. Use absolute paths; shell variables and ~ are not expanded. For isolated builds, configured paths must exist inside the guest.

📦 Repository tools built into Shelly

The new shelly repo-db commands maintain pacman-compatible repository databases directly:

Terminal window
shelly repo-db add ./myrepo.db.tar.zst ./example-1.0-1-x86_64.pkg.tar.zst
shelly repo-db list ./myrepo.db.tar.zst
shelly repo-db remove ./myrepo.db.tar.zst example
shelly repo-db verify ./myrepo.db.tar.zst

Database updates maintain both package and file indexes. Options cover signing, downgrade prevention, waiting for database locks, and removing replaced package archives after publication.

🔍 Search and install improvements

  • shelly search standard and shelly -Ss search available repository packages by default again, including compound names such as phonon-qt6. Use --detail for one exact package’s metadata or --installed to search installed packages.
  • AUR installs now accept --needed to skip building and reinstalling matching installed versions, including individual split-package members. Dynamic versions and VCS packages may still require a build.
  • AUR installs verify that requested packages and AUR build dependencies are still listed by the configured service. Removed packages cannot be installed from a leftover checkout; when an exact repository match exists, Shelly suggests a standard install. Explicit local builds remain available.
  • Fixed repository Include parsing so server URLs and policies stay associated with the correct repository.
  • Expanded TLS support fixes secure-connection failures with repositories such as BlackArch.
  • Added Nerd Font progress-bar rendering for compatible terminal fonts. For this release, enable it by setting "ProgressBarStyle": "Nerdfont" directly in the CLI’s config.json; shelly config set does not yet accept the new value.

✨ Desktop and AppImage improvements

  • Install optional dependencies directly from package details, with clearer selection controls and installed-state indicators.
  • Package details load more smoothly, reducing content flicker while navigating.
  • Open local .flatpakref and .flatpak files with Shelly to start installation. Shelly now appears in the file manager’s Open With choices for these files.
  • Remove stale AppImage entries even when their files are missing, and correctly handle installations whose recorded name differs from the filename.
  • Improved AppImage desktop-entry detection and icon selection, including choosing higher-resolution icons.
  • Malformed JSON settings recover to defaults across the CLI, desktop, and tray, keeping a .corrupt copy when possible. Settings writes also better withstand interruption.
  • Clearer errors across package operations explain the failure and retain technical details for troubleshooting.

🌍 Translations and thanks

This release completes the European Portuguese translation and updates German, Italian, Polish, Russian, and Turkish translations.

Thank you to everyone who contributed code, translations, testing, and reports: @ZoeyErinBauer, @caroberrie, @azdanov, @VinnyQF, @NateKing204, @Henry2o1o, @Mattyan89, @adem4ik, @juliazero, @pdf, @Ricardo-Simoes, and @mehmetakifongun.

Full Changelog: v3.1.4…4a0d0348

Release pull request: #1972

3.1.6 Bug Fix Latest

Fixes Bug in UI using wrong CLI command to fetch information.

© 2026 Seafoam LabsShelly Chel