RPM install/update creates files and then disappears?

[Bond Masuda]

hello,

i'm working on a file monitoring system and I'm noticing files like the 
following example being created and then disappearing:

/usr/share/zoneinfo/right/Europe/Zurich;56177f7a
/usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
/usr/share/zoneinfo/right/Europe/Prague;56177f7a
/usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
/usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
/usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
/usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
/usr/share/zoneinfo/right/Europe/Skopje;56177f7a
/usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
/usr/share/zoneinfo/right/Europe/Belfast;56177f7a
/usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
/usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
/usr/share/zoneinfo/right/Europe/Jersey;56177f7a
/usr/share/zoneinfo/right/Europe/London;56177f7a
/usr/share/zoneinfo/right/GB;56177f7a
/usr/share/zoneinfo/right/GB-Eire;56177f7a
/usr/share/zoneinfo/right/Etc/UTC;56177f7a
/usr/share/zoneinfo/right/Etc/Universal;56177f7a
/usr/share/zoneinfo/right/Etc/Zulu;56177f7a
/usr/share/zoneinfo/right/UTC;56177f7a

The sample above happened during a tzdata package update. Does rpm 
create these files and then moves them to destination (over the old file 
during an update)? Or, does it move the old file to files in the format 
above and then deletes them when the new file install is completed?  If 
so, how does it determine the "suffix" string, like ";56177f7a" in the 
above samples? Is it randomly generated? What's the nature of this 
suffix string? Is it always 8 characters wide? it seems to allow for 
alphanumeric characters, but does that include capital letters? Are any 
other characters allowed in the suffix string?

If I can understand this better, I can write rules to categorize them as 
being part of some RPM activity. Just need to understand what they are, 
and what kind of patterns I can look for.

Thanks,
Bond