Fix clean target find/-prune precedence bug

The clean target's find command intended -prune to apply to the whole
-o chain of excluded submodule paths, but -prune only binds to the
immediately preceding -path, so only the last path (wycheproof) was
actually protected from recursion. Earlier
submodules (cloudflare-quiche, pkcs11-provider, etc.) were still
descended into, letting make clean delete vendored symlinks inside
them. Move -prune outside the parenthesized path list so it applies
whenever any excluded path matches.

Assisted-by: Claude:claude-sonnet-5
Fixes: 70741ee62a50 "Configurations/unix-Makefile.tmpl: make cleanup faster"
Reviewed-by: Nikola Pajkovsky <nikolap@openssl.org>
Reviewed-by: Bob Beck <beck@openssl.org>
Reviewed-by: Milan Broz <mbroz@openssl.org>
Reviewed-by: Eugene Syromiatnikov <esyr@openssl.org>
MergeDate: Tue Jul 21 09:21:37 2026
(Merged from https://github.com/openssl/openssl/pull/32006)

diff --git a/Configurations/unix-Makefile.tmpl b/Configurations/unix-Makefile.tmpl
index 6c51e34f7a56d738935ce33343072e560bdae2f6..3f9d04b6d02f458b28d4b514145471f94153f83e 100644 (file)
--- a/Configurations/unix-Makefile.tmpl
+++ b/Configurations/unix-Makefile.tmpl
@@ -660,8 +660,8 @@ clean: libclean ## Clean the workspace, keep the configuration
                   -o -path './python-ecdsa' \
                   -o -path './tlsfuzzer' \
                   -o -path './tlslite-ng' \
-                  -o -path './wycheproof' \
-                  -prune \) \
+                  -o -path './wycheproof' \) \
+               -prune \
                -o \! -type d \
                   \( -name '*{- platform->depext() -}' \
                      -o -name '*{- platform->objext() -}' \