RPM install/update creates files and then disappears?

[Jan Zelený]

On 12. 10. 2015 at 03:59:42, Bond Masuda wrote:
> On 10/11/2015 11:38 PM, Jan Zelený wrote:
> > On 9. 10. 2015 at 03:54:51, Bond Masuda wrote:
> >> hello,
> >> 
> >> i'm working on a file monitoring system and I'm noticing files like the
> >> following example being created and then disappearing:
> >> 
> >> /usr/share/zoneinfo/right/Europe/Zurich;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Prague;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Skopje;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Belfast;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
> >> /usr/share/zoneinfo/right/Europe/Jersey;56177f7a
> >> /usr/share/zoneinfo/right/Europe/London;56177f7a
> >> /usr/share/zoneinfo/right/GB;56177f7a
> >> /usr/share/zoneinfo/right/GB-Eire;56177f7a
> >> /usr/share/zoneinfo/right/Etc/UTC;56177f7a
> >> /usr/share/zoneinfo/right/Etc/Universal;56177f7a
> >> /usr/share/zoneinfo/right/Etc/Zulu;56177f7a
> >> /usr/share/zoneinfo/right/UTC;56177f7a
> >> 
> >> The sample above happened during a tzdata package update. Does rpm
> >> create these files and then moves them to destination (over the old file
> >> during an update)? Or, does it move the old file to files in the format
> >> above and then deletes them when the new file install is completed?  If
> >> so, how does it determine the "suffix" string, like ";56177f7a" in the
> >> above samples? Is it randomly generated? What's the nature of this
> >> suffix string? Is it always 8 characters wide? it seems to allow for
> >> alphanumeric characters, but does that include capital letters? Are any
> >> other characters allowed in the suffix string?
> >> 
> >> If I can understand this better, I can write rules to categorize them as
> >> being part of some RPM activity. Just need to understand what they are,
> >> and what kind of patterns I can look for.
> >> 
> >> Thanks,
> >> Bond
> > 
> > Hi Bond,
> > this has nothing to do with rpm itself, it's the package which is creating
> > these files in its %post script. You should direct your question at the
> > maintainer of that package in your distro.
> > 
> > Thanks
> > Jan
> 
> Hi Jan,
> 
> Is this a very common practice by package maintainers? Because I'm
> seeing the same behavior on many other RPM packages, like bwm-ng,
> openldap, selinux-policy, glibc, glibc-common, for example. This is on
> CentOS 6.7. This is not unique to the tzdata packages that I mention as
> an example in my OP. Here are a few more samples, and I can provide
> plenty more:
> 
> /etc/openldap/ldap.conf;560b8a5f
> /lib64/liblber-2.4.so.2;560b8a5f
> /lib64/liblber-2.4.so.2.10.3;560b8a5f
> /lib64/libldap-2.4.so.2;560b8a5f
> /lib64/libldap-2.4.so.2.10.3;560b8a5f
> /lib64/libldap_r-2.4.so.2;560b8a5f
> /lib64/libldap_r-2.4.so.2.10.3;560b8a5f
> /lib64/libldif-2.4.so.2;560b8a5f
> /lib64/libldif-2.4.so.2.10.3;560b8a5f
> /usr/libexec/openldap/create-certdb.sh;560b8a5f
> /usr/share/doc/openldap-2.4.40/ANNOUNCEMENT;560b8a5f
> /usr/share/doc/openldap-2.4.40/CHANGES;560b8a5f
> /usr/share/doc/openldap-2.4.40/COPYRIGHT;560b8a5f
> /usr/share/doc/openldap-2.4.40/LICENSE;560b8a5f
> /usr/share/doc/openldap-2.4.40/README;560b8a5f
> /usr/share/man/man5/ldap.conf.5.gz;560b8a5f
> /usr/share/man/man5/ldif.5.gz;560b8a5f
> 
> Are you absolutely sure this is not from RPM? perhaps a lower level api
> that RPM uses that creates these files?
> Bond

Ok with these new examples I am not sure ... you might have been right in your 
original email about them being like a mid-update temp files in which case I 
can't help you any more, I don't have in-depth expertise in the rpm itself.

Sorry for the noise
Jan