If two publish jobs run concurrently (which they arguably shouldn’t),
they’d step on each other toes and remove Packages.tmp file the other
job’s just created.
The API has locking for concurrent publish/drop operations on the same
prefix, but command-line operations bypass that lock. Also, not having
a predictable temporary filename is generally good from a security
standpoint, given that cryptographic signing is involved.
Work around the issue by creating a per-job temporary file.
Signed-off-by: Andrej Shadura <andrew.shadura@collabora.co.uk>
Andrej Shadura
ef65e2539a