[Rpm-maint] [rpm-software-management/rpm] Change temp file suffix from ; tid to .tid~ for shell safety (PR #4160)

[Farid Zakaria]

Hi!

At Meta, I noticed we were seeing:
```
    zsh: command not found: 699f9aa7
```

After some debugging, it looks like RPM's file state machine uses a transaction ID as a temporary suffix when atomically installing files: write to file<tid>, then rename to file. The suffix format was ";%08x" (e.g., ";699f9aa7").

If an RPM install is interrupted (e.g., SIGKILL due to a timeout or OOM), these temp files are left behind. When they exist in shell completion directories like /usr/share/zsh/site-functions/, the semicolon in the filename is interpreted as a command separator by zsh, causing errors as mentioned above.

## Changes
* Change the suffix from ";%08x" to ".%08x~" (e.g., ".699f9aa7~"). 

## Reproducer

    # Build a package with many files
    cat > /tmp/manyfiles.spec << 'SPEC'
    Name:    manyfiles
    Version: 1.0
    Release: 1
    Summary: Test package
    License: MIT
    BuildArch: noarch
    %description
    Test
    %install
    mkdir -p %{buildroot}/usr/share/manyfiles
    for i in $(seq 1 10000); do
        dd if=/dev/urandom bs=1024 count=1 2>/dev/null | base64 > \
            %{buildroot}/usr/share/manyfiles/file_$(printf '%%05d' $i).txt
    done
    %files
    /usr/share/manyfiles/
    SPEC
    rpmbuild -bb /tmp/manyfiles.spec

    # Install into a test root and SIGKILL during install
    mkdir -p /tmp/rpmtest
    rpm --root /tmp/rpmtest --dbpath /tmp/rpmtest/var/lib/rpm --initdb
    rpm --root /tmp/rpmtest --dbpath /tmp/rpmtest/var/lib/rpm \
        -Uvh --noscripts --nodeps ~/rpmbuild/RPMS/noarch/manyfiles-1.0-1.noarch.rpm &
    PID=$!
    # Poll until files start appearing, then kill
    while [ "$(find /tmp/rpmtest/usr/share/manyfiles/ -type f 2>/dev/null | wc -l)" -lt 100 ]; do
        sleep 0.01
    done
    kill -9 $PID; wait $PID 2>/dev/null

    # Before this fix: leftover files like file_00001.txt;69bd8a7a
    # After this fix:  leftover files like file_00001.txt.69bd8a7a~
    find /tmp/rpmtest -name '*;*' | head
    
    
   CC @davide125 @teknoraver 
You can view, comment on, or merge this pull request online at:

  https://github.com/rpm-software-management/rpm/pull/4160

-- Commit Summary --

  * Change temp file suffix from ;tid to .tid~ for shell safety

-- File Changes --

    M lib/fsm.cc (2)

-- Patch Links --

https://github.com/rpm-software-management/rpm/pull/4160.patch
https://github.com/rpm-software-management/rpm/pull/4160.diff

-- 
Reply to this email directly or view it on GitHub:
https://github.com/rpm-software-management/rpm/pull/4160
You are receiving this because you are subscribed to this thread.

Message ID: <rpm-software-management/rpm/pull/4160 at github.com>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.rpm.org/pipermail/rpm-maint/attachments/20260320/995fdc24/attachment.htm>