I and a small group of Arch Linux users have concerns regarding the `installed` field of the .BUILDINFO file generated by makepkg. Obviously this field is very useful for reproducing builds and tracking down packaging issues, but we find the fact that it stores that information by default and without any warning concerning. Privacy is one obvious issue, as is the potential security issue of listing the versions of all packages, including services that may be internet-facing. Of course Arch is intended to be kept up to date at all times, but this unfortunately doesn't always happen, likewise the issue *if known about* can be easily solved by building in a chroot or container or by simply editing the file, however it's not at all obvious without having dissected packages before that this information is being stored in the first place.

We would very much like to see this feature made opt-in with a command line flag, or even simply having makepkg print a notice that states that all packages installed on the system running makepkg are recorded in the built package. We don't believe such changes would have a negative impact on experienced users who are already well aware of this behavior and make use of it regularly, they would only serve to prevent any issues from arising due to being uninformed about this feature.