At the moment makepkg gives no direct support for checking and verifying sources downloaded in a different way than the source array.
It is rather unfortunate; because it means that in many packages the -o options does not actually download the sources and there is no checksum to those files.

My idea is:
- the source array should list also source directories,
- the PKGBUILD author might add a source() function that create and populate those directories.
- the -g options should make an hash of the directory too,
- makepkg should verify the hash when needed.


I can patch makepkg if there is interest.
How I would implement:
- if the source function exists inside the PKGBUILD it is called during the download_sources() makepkg function,
- the -g option calculates the hash of a directory hashing all the files concatenated + a list of the file names; so that new files; content changes and eventual renaming will change the hash (this will be added in the generate_checksum() makepkg function),
- check_checksum() makepkg function would do the same and verify.

What do you think?