From ef65e2539a69917394bd58bf5ec211fde386f7c7 Mon Sep 17 00:00:00 2001 From: Andrej Shadura Date: Tue, 23 Jun 2026 10:31:10 +0200 Subject: [PATCH] deb publish: Create unique temporary files each time MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit If two publish jobs run concurrently (which they arguably shouldn’t), they’d step on each other toes and remove Packages.tmp file the other job’s just created. The API has locking for concurrent publish/drop operations on the same prefix, but command-line operations bypass that lock. Also, not having a predictable temporary filename is generally good from a security standpoint, given that cryptographic signing is involved. Work around the issue by creating a per-job temporary file. Signed-off-by: Andrej Shadura --- deb/publish.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/deb/publish.go b/deb/publish.go index 8ae71df94..5d8de366d 100644 --- a/deb/publish.go +++ b/deb/publish.go @@ -893,7 +893,7 @@ func (p *PublishedRepo) Publish(packagePool aptly.PackagePool, publishedStorageP var suffix string if p.rePublishing { - suffix = ".tmp" + suffix = ".tmp." + uuid.NewString() } if progress != nil {