[Feature Request] Add .SRCINFO integrity check argument
Author: pricklythornCreated Jun 22, 2026Updated Aug 19, 2026
LabelsType: Feature RequestStatus: Discussion Open
Is your feature request related to a problem? Please describe.
Considering that .SRCINFO is not diffed, a malicious packager could insert malware into .SRCINFO, of which yay will trust.
Describe the solution you'd like
One of two methods:
- At build time, .SRCINFO could be regenerated with makepkg, and diffed against the provided .SRCINFO.
- Provided .SRCINFO is ignored and regenerated from PKGBUILD.
Describe alternatives you've considered
Including .SRCINFO in diffing, but that would require you to carefully examine both the PKGBUILD and .SRCINFO for if they match, which could be automated.
Additional context
None.
Source: Jguer/yay