Skip to content

[P1] Full-rebuild ownership check can allow deletion of the source project #9

Open

Description

@UnsignedArduino

With build_dir: ".", an ordinary build creates .redun-cache.db beside the config—even if the build then fails because the target is missing. A subsequent --full-rebuild treats that database as proof that the directory is disposable and recursively deletes the config, source files, and everything else in it.

Relevant code: main.py, lines 37–44 and database creation during build, lines 117–120.

Reproduction in an isolated temporary directory:

  1. Put a valid config and a source file in the directory; set build_dir: ".".
  2. Run a normal build with the configured target absent. The build fails, but leaves .redun-cache.db.
  3. Run with --full-rebuild. The ownership check now passes and deletes the directory.

The review probe confirmed that even the failed first build created the marker, and that the cleanup subsequently removed both the original config and source.

Expected behavior: reject unsafe build-directory ownership before creating the cache marker, or otherwise ensure cleanup cannot remove source/config/unrelated files. The presence of a database alone is insufficient evidence of ownership.

Found while reviewing PR #7, toolchain at ce12c48.

Activity

  1. changed the title [-][P1] Full-rebuild ownership check can allow deletion of the source project[/-] [+]Full-rebuild ownership check can allow deletion of the source project[/+] on Nov 4, 2026
  2. changed the title [-]Full-rebuild ownership check can allow deletion of the source project[/-] [+][P1] Full-rebuild ownership check can allow deletion of the source project [found by chatgpt codex][/+] on Nov 4, 2026
  3. changed the title [-][P1] Full-rebuild ownership check can allow deletion of the source project [found by chatgpt codex][/-] [+][P1] Full-rebuild ownership check can allow deletion of the source project[/+] on Nov 4, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't workingfound by chatgptIssue was originally found by ChatGPT Codex. Only used for tracking.p1

    Projects

    No projects

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions