{"record":{"id":"32ed12c41545fdec","repo":"crowdsecurity/crowdsec","slug":"s-is-tainted-use-force-to-remove-32ed12","errorCode":null,"errorMessage":"%s is tainted, use '--force' to remove","messagePattern":"(.+?) is tainted, use '--force' to remove","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/hubops/purge.go","lineNumber":32,"sourceCode":"type PurgeCommand struct {\n\tItem  *cwhub.Item\n\tForce bool\n}\n\nfunc NewPurgeCommand(item *cwhub.Item, force bool) *PurgeCommand {\n\treturn &PurgeCommand{Item: item, Force: force}\n}\n\nfunc (c *PurgeCommand) Prepare(plan *ActionPlan) (bool, error) {\n\ti := c.Item\n\n\tif i.State.IsLocal() {\n\t\t// not downloaded, by definition\n\t\treturn false, nil\n\t}\n\n\tif i.State.Tainted && !c.Force {\n\t\treturn false, fmt.Errorf(\"%s is tainted, use '--force' to remove\", i.Name)\n\t}\n\n\tsubsToRemove, err := i.SafeToRemoveDeps()\n\tif err != nil {\n\t\treturn false, err\n\t}\n\n\tfor _, sub := range subsToRemove {\n\t\tif err := plan.AddCommand(NewPurgeCommand(sub, c.Force)); err != nil {\n\t\t\treturn false, err\n\t\t}\n\t}\n\n\tif !i.State.IsDownloaded() {\n\t\treturn false, nil\n\t}\n\n\treturn true, nil","sourceCodeStart":14,"sourceCodeEnd":50,"githubUrl":"https://github.com/crowdsecurity/crowdsec/blob/909b5157986a2b2c2163300fdaef5ed01289f7d2/pkg/hubops/purge.go#L14-L50","documentation":"PurgeCommand.Prepare refuses to purge a hub item whose local files have been modified (tainted) since download, unless the purge is explicitly forced. This is a safety guard: purging deletes the downloaded source files, so silently destroying user-modified content would lose work. The error names the item and points at the '--force' escape hatch.","triggerScenarios":"Calling cscli hub purge (or PurgeCommand via the hubops action plan) on an item whose Item.State.Tainted is true while PurgeCommand.Force is false. Local items (never downloaded) skip this check.","commonSituations":"The user hand-edited a downloaded parser/scenario/appsec-rule under the hub dir; a partial or interrupted hub upgrade marked the item tainted; a symlink or manual overwrite tripped the integrity check; running 'purge all' scripts non-interactively.","solutions":["If the local modifications can be discarded, re-run with the --force flag (PurgeCommand.Force=true) to purge anyway","Back up the modified file, then purge with --force and re-install/upgrade to get a pristine copy","Run 'cscli hub update'/'upgrade' to restore the item to an untainted state instead of purging"],"exampleFix":"// before\nerr := plan.AddCommand(NewPurgeCommand(item, false))\n// after\n// item is tainted; discard local modifications intentionally\nerr := plan.AddCommand(NewPurgeCommand(item, true))","handlingStrategy":"validation","validationCode":"if item.State.Tainted && !force {\n\t// surface a warning or prompt the user before constructing the purge command\n\treturn fmt.Errorf(\"%s is tainted; pass force=true to discard local changes\", item.Name)\n}\nplan.AddCommand(hubops.NewPurgeCommand(item, force))","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never hand-edit files inside the hub download directory; use overrides/local items instead","Check 'cscli hub list -o raw' tainted column before scripted purge/upgrade operations","Always pass --force deliberately, never as a habit in scripts"],"tags":["cli","hub","tainted-item","safety-guard"],"backgroundTag":"missing-required-flag","analyzedSha":"909b5157986a2b2c2163300fdaef5ed01289f7d2","analyzedAt":"2026-09-06T12:27:26.012Z","contentChangedAt":"2026-09-06T12:27:26.012Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}