guix: Make guix-clean less destructive
What the developer wrote
Authored by Hodlinator
guix: Make guix-clean less destructive
* Show preview and ask for confirmation before git clean unless used with "--force"
* Error out when trying to pass args such as "guix-clean --help"
What changed, and why it matters
This commit changes a Bitcoin Core build helper script so that before it deletes leftover files, it shows a preview and asks the user to confirm. It also adds a safety check so passing unexpected arguments (like --help) causes an error instead of being silently ignored. The change reduces the chance of accidentally deleting important files, but it is a usability/safety improvement rather than a fix for a software vulnerability that an attacker could exploit remotely.
No urgent action required. Treat as a routine safety/usability improvement. Reviewers may verify the prompt and argument handling behave correctly in non-interactive environments.
Security signals we found
Destructive operation now requires explicit confirmation
Unexpected arguments are rejected instead of silently ignored
Dry-run preview shown before file deletion
Evidence from the diff
The patch modifies contrib/guix/guix-clean. It introduces a FORCE flag, accepts only –force as an optional argument, errors on any other arguments, and runs git clean -nxdff (dry-run preview) followed by an interactive y/n prompt before executing the real git clean -xdff unless –force is supplied. This prevents unintended destructive clean operations caused by accidental invocation or unexpected argument handling.
Changed components
contrib/guix/guix-cleanInspect captured patch +18 / −0
diff --git a/contrib/guix/guix-clean b/contrib/guix/guix-clean
index 9af0a793..32258cd7 100755
--- a/contrib/guix/guix-clean
+++ b/contrib/guix/guix-clean
@@ -9,6 +9,14 @@ set -e -o pipefail
# shellcheck source=libexec/prelude.bash
source "$(dirname "${BASH_SOURCE[0]}")/libexec/prelude.bash"
+# Parse supported args
+FORCE=0
+if [[ $* == "--force" ]]; then
+ FORCE=1
+elif [ $# != 0 ]; then
+ echo "Script only takes optional --force arg."
+ exit 1
+fi
###################
## Sanity Checks ##
@@ -80,4 +88,14 @@ for precious_dirs_file in "${found_precious_dirs_files[@]}"; do
done < "$precious_dirs_file"
done
+if [[ $FORCE == 0 ]]; then
+ git clean -nxdff "${exclude_flags[@]}"
+
+ read -p "Proceed? (y/n) " -r
+ if [[ ! $REPLY =~ ^[Yy]$ ]]; then
+ echo "Aborted."
+ exit 1
+ fi
+fi
+
git clean -xdff "${exclude_flags[@]}"
Why this scored 18/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.