Issue with creating a permission set - it adds every custom field in the system

Question

This happens even with a blank permission set - I created a new permission set called "blank" and retrieved it through the package.xml in Visual Studio code. When I open and look at the permission set in VSCode, it is over 2000 lines long, and seems to contain every custom field on every object in the org. The good news is that all of the extra fields fieldPermissions have false as editable and readable. I would like them not to be there at all, and it is a PIA to delete them every time I perform a metadata retrieve.
Anyone seen anything like this and/or have a solution?

Answer 1

Doing a sfdx force:source:retrieve -m PermissionSet:blank (here blank is the permission set i created) only yields me the permission set metadata with no field FLS or Object settings included.

This is the same behavior if I do a retrieve using mdapi as below

sfdx force:mdapi:retrieve -k ./src/package.xml -r ./src --wait=-1 --json

As documented here with v41.0 and above permissionset will include everything that is exposed while retrieving and deploying.

In your use case if you are getting 2000 lines with false permissions then it's not correct.

Try with the source:retrieve command