Why does libzypp store to be downloaded RPM's first in tmppath

[Thaodan]

Hey,

We noticed that libzypp stores downloaded rpm's first in /var/tmp
before moving them to the packagesdir.
Why does it do that?

[bzeller]

Because after downloading zypp needs to make sure that the checksum and the signature is correct and that the rpm was signed with a known key. Only then it is transferred into the trusted cache.

Not a bug.

[mlandres]

And the moving is usually cheap. If tmp and cache are on the same disk, it's just a hardlink.