Stefan Monnier <monnier@iro.umontreal.ca> writes:

>> +# Use && after the cd commands, not ;, to ensure the build fails
>> +# immediately if the directory $(ARCHIVE_TMP)/packages does not exist.
>> +# For process-archive this is crucial; otherwise batch-make-archive in
>> +# archive-contents.el will interpret directories in the current
>> +# directory as unreleased packages, and recursively delete them,
>> +# including .git.  Prior to using &&, running "make process-archive"
>> +# could silently delete all local git history!
>
> Actually, I think the problem is in the code which does the deletion: it
> should only do the delete files it positively knows should be deleted,
> rather than deleting any files which seem to be out of place.

Agreed that the deletion code is questionable, though I guess it's
operating under the assumption that it's within a throwaway directory
and is erring on the side of not publishing something not intended for
publication.

I think using && after the cd is just good practice, and I wanted to
push at least a partial fix for this right away since it bit me today.

> Once we change the handling of :core in elpa/admin/archive-contents.el
> so that it sets up symlinks rather than performing copies, we should at
> least be able to make the deletion less dangerous, e.g. by only deleting
> symlinks and empty directories (so even if the deletion was erroneous,
> no actual file contents was destroyed along the way).
>
> Fabián, any news on this?

Arthur pointed out in another thread that this code is at least
partially there already (I haven't heard from Fabián about its status).
The attached patch seems to work with a locally-generated archive, but
it introduces the first external to make use of :core.  Should I push it
and see what happens?

Thomas