[Feature Request] Show all files with diffing

[pricklythorn]

Is your feature request related to a problem? Please describe.

When updating a package, the diff only shows .gitignore and PKGBUILD, most notably .SRCINFO is excluded. That is a meaningful attack surface, many people will only check the PKGBUILD for malicious things, a malicious dependency could be silently placed in .SRCINFO with the PKGBUILD staying clean, or a malicious source link. It also extends to other files the PKGBUILD may use during building.

Describe the solution you'd like

That all files are diffed (by default at least).

Describe alternatives you've considered

.SRCINFO could be regenerated from the PKGBUILD at build time and verified against the provided one, that does not solve the problem of other files though.

Additional context

None.

[Jguer]

yay does not use .SRCINFO to download deps unless in local builds, which should be reviewed by the user. makepkg uses PKGBUILD information for downloading the sources. Can you demo the attack vector we're trying to prevent here?

[pricklythorn]

I probably should've worded the issue better, apologies. Does yay not diff .SRCINFO because it is regenerated from PKGBUILD? Because if so, then that attack surface doesn't exist. And could you please elaborate on what you mean by local builds.