RPM install/update creates files and then disappears?

[Jan Zelený]

On 9. 10. 2015 at 03:54:51, Bond Masuda wrote:
> hello,
> 
> i'm working on a file monitoring system and I'm noticing files like the
> following example being created and then disappearing:
> 
> /usr/share/zoneinfo/right/Europe/Zurich;56177f7a
> /usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
> /usr/share/zoneinfo/right/Europe/Prague;56177f7a
> /usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
> /usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
> /usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
> /usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
> /usr/share/zoneinfo/right/Europe/Skopje;56177f7a
> /usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
> /usr/share/zoneinfo/right/Europe/Belfast;56177f7a
> /usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
> /usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
> /usr/share/zoneinfo/right/Europe/Jersey;56177f7a
> /usr/share/zoneinfo/right/Europe/London;56177f7a
> /usr/share/zoneinfo/right/GB;56177f7a
> /usr/share/zoneinfo/right/GB-Eire;56177f7a
> /usr/share/zoneinfo/right/Etc/UTC;56177f7a
> /usr/share/zoneinfo/right/Etc/Universal;56177f7a
> /usr/share/zoneinfo/right/Etc/Zulu;56177f7a
> /usr/share/zoneinfo/right/UTC;56177f7a
> 
> The sample above happened during a tzdata package update. Does rpm
> create these files and then moves them to destination (over the old file
> during an update)? Or, does it move the old file to files in the format
> above and then deletes them when the new file install is completed?  If
> so, how does it determine the "suffix" string, like ";56177f7a" in the
> above samples? Is it randomly generated? What's the nature of this
> suffix string? Is it always 8 characters wide? it seems to allow for
> alphanumeric characters, but does that include capital letters? Are any
> other characters allowed in the suffix string?
> 
> If I can understand this better, I can write rules to categorize them as
> being part of some RPM activity. Just need to understand what they are,
> and what kind of patterns I can look for.
> 
> Thanks,
> Bond


Hi Bond,
this has nothing to do with rpm itself, it's the package which is creating 
these files in its %post script. You should direct your question at the 
maintainer of that package in your distro.

Thanks
Jan