crowdsecurity/crowdsec · error

%s is tainted, use '--force' to remove

Error message

%s is tainted, use '--force' to remove

What it means

PurgeCommand.Prepare refuses to purge a hub item whose local files have been modified (tainted) since download, unless the purge is explicitly forced. This is a safety guard: purging deletes the downloaded source files, so silently destroying user-modified content would lose work. The error names the item and points at the '--force' escape hatch.

Source

Thrown at pkg/hubops/purge.go:32

type PurgeCommand struct {
	Item  *cwhub.Item
	Force bool
}

func NewPurgeCommand(item *cwhub.Item, force bool) *PurgeCommand {
	return &PurgeCommand{Item: item, Force: force}
}

func (c *PurgeCommand) Prepare(plan *ActionPlan) (bool, error) {
	i := c.Item

	if i.State.IsLocal() {
		// not downloaded, by definition
		return false, nil
	}

	if i.State.Tainted && !c.Force {
		return false, fmt.Errorf("%s is tainted, use '--force' to remove", i.Name)
	}

	subsToRemove, err := i.SafeToRemoveDeps()
	if err != nil {
		return false, err
	}

	for _, sub := range subsToRemove {
		if err := plan.AddCommand(NewPurgeCommand(sub, c.Force)); err != nil {
			return false, err
		}
	}

	if !i.State.IsDownloaded() {
		return false, nil
	}

	return true, nil

View on GitHub (pinned to 909b515798)

Solutions

1. If the local modifications can be discarded, re-run with the --force flag (PurgeCommand.Force=true) to purge anyway
2. Back up the modified file, then purge with --force and re-install/upgrade to get a pristine copy
3. Run 'cscli hub update'/'upgrade' to restore the item to an untainted state instead of purging

Example fix

// before
err := plan.AddCommand(NewPurgeCommand(item, false))
// after
// item is tainted; discard local modifications intentionally
err := plan.AddCommand(NewPurgeCommand(item, true))

if item.State.Tainted && !force {
	// surface a warning or prompt the user before constructing the purge command
	return fmt.Errorf("%s is tainted; pass force=true to discard local changes", item.Name)
}
plan.AddCommand(hubops.NewPurgeCommand(item, force))

When it happens

Trigger: Calling cscli hub purge (or PurgeCommand via the hubops action plan) on an item whose Item.State.Tainted is true while PurgeCommand.Force is false. Local items (never downloaded) skip this check.

Common situations: The user hand-edited a downloaded parser/scenario/appsec-rule under the hub dir; a partial or interrupted hub upgrade marked the item tainted; a symlink or manual overwrite tripped the integrity check; running 'purge all' scripts non-interactively.

Understand the failure class

Background: "--flag is required" and "must specify" CLI errors: how missing-required-flag validation works and how to fix it — this error's family across 20 libraries.

Related errors

• %s is tainted, use '--force' to remove
• ErrUserCanceled
• while disabling %s: %w
• no appsec_config provided
• no hub configuration provided

AI-assisted analysis of crowdsecurity/crowdsec@909b515798 (2026-09-06). Data as JSON: /api/errors/32ed12c41545fdec. Report an issue: GitHub.