RPM install/update creates files and then disappears?

[Bond Masuda]

On 10/11/2015 11:38 PM, Jan Zelený wrote:
> On 9. 10. 2015 at 03:54:51, Bond Masuda wrote:
>> hello,
>>
>> i'm working on a file monitoring system and I'm noticing files like the
>> following example being created and then disappearing:
>>
>> /usr/share/zoneinfo/right/Europe/Zurich;56177f7a
>> /usr/share/zoneinfo/right/Europe/Bratislava;56177f7a
>> /usr/share/zoneinfo/right/Europe/Prague;56177f7a
>> /usr/share/zoneinfo/right/Europe/Belgrade;56177f7a
>> /usr/share/zoneinfo/right/Europe/Ljubljana;56177f7a
>> /usr/share/zoneinfo/right/Europe/Podgorica;56177f7a
>> /usr/share/zoneinfo/right/Europe/Sarajevo;56177f7a
>> /usr/share/zoneinfo/right/Europe/Skopje;56177f7a
>> /usr/share/zoneinfo/right/Europe/Zagreb;56177f7a
>> /usr/share/zoneinfo/right/Europe/Belfast;56177f7a
>> /usr/share/zoneinfo/right/Europe/Guernsey;56177f7a
>> /usr/share/zoneinfo/right/Europe/Isle_of_Man;56177f7a
>> /usr/share/zoneinfo/right/Europe/Jersey;56177f7a
>> /usr/share/zoneinfo/right/Europe/London;56177f7a
>> /usr/share/zoneinfo/right/GB;56177f7a
>> /usr/share/zoneinfo/right/GB-Eire;56177f7a
>> /usr/share/zoneinfo/right/Etc/UTC;56177f7a
>> /usr/share/zoneinfo/right/Etc/Universal;56177f7a
>> /usr/share/zoneinfo/right/Etc/Zulu;56177f7a
>> /usr/share/zoneinfo/right/UTC;56177f7a
>>
>> The sample above happened during a tzdata package update. Does rpm
>> create these files and then moves them to destination (over the old file
>> during an update)? Or, does it move the old file to files in the format
>> above and then deletes them when the new file install is completed?  If
>> so, how does it determine the "suffix" string, like ";56177f7a" in the
>> above samples? Is it randomly generated? What's the nature of this
>> suffix string? Is it always 8 characters wide? it seems to allow for
>> alphanumeric characters, but does that include capital letters? Are any
>> other characters allowed in the suffix string?
>>
>> If I can understand this better, I can write rules to categorize them as
>> being part of some RPM activity. Just need to understand what they are,
>> and what kind of patterns I can look for.
>>
>> Thanks,
>> Bond
>
> Hi Bond,
> this has nothing to do with rpm itself, it's the package which is creating
> these files in its %post script. You should direct your question at the
> maintainer of that package in your distro.
>
> Thanks
> Jan
>

Hi Jan,

Is this a very common practice by package maintainers? Because I'm 
seeing the same behavior on many other RPM packages, like bwm-ng, 
openldap, selinux-policy, glibc, glibc-common, for example. This is on 
CentOS 6.7. This is not unique to the tzdata packages that I mention as 
an example in my OP. Here are a few more samples, and I can provide 
plenty more:

/etc/openldap/ldap.conf;560b8a5f
/lib64/liblber-2.4.so.2;560b8a5f
/lib64/liblber-2.4.so.2.10.3;560b8a5f
/lib64/libldap-2.4.so.2;560b8a5f
/lib64/libldap-2.4.so.2.10.3;560b8a5f
/lib64/libldap_r-2.4.so.2;560b8a5f
/lib64/libldap_r-2.4.so.2.10.3;560b8a5f
/lib64/libldif-2.4.so.2;560b8a5f
/lib64/libldif-2.4.so.2.10.3;560b8a5f
/usr/libexec/openldap/create-certdb.sh;560b8a5f
/usr/share/doc/openldap-2.4.40/ANNOUNCEMENT;560b8a5f
/usr/share/doc/openldap-2.4.40/CHANGES;560b8a5f
/usr/share/doc/openldap-2.4.40/COPYRIGHT;560b8a5f
/usr/share/doc/openldap-2.4.40/LICENSE;560b8a5f
/usr/share/doc/openldap-2.4.40/README;560b8a5f
/usr/share/man/man5/ldap.conf.5.gz;560b8a5f
/usr/share/man/man5/ldif.5.gz;560b8a5f

Are you absolutely sure this is not from RPM? perhaps a lower level api 
that RPM uses that creates these files?
Bond