system breach

[gareth]

On Fri 2006-12-29 (17:25), Thomas Nystr?m wrote:
> I just checked one of my servers and also found a /tmp/download
> directory with the same files that you had.
> 
> I then compared the timestamp of /tmp/download with the timestamp
> of the directories in /var/db/pkg: Same.
> 
> My conclusion is that during a portupgrade these files were written
> there, directly or indirectly by portupgrade or the port itself.

oh. ok. well even though that's weird behaviour from a package it's
more plausible since i haven't found anything else suspicious. are
the timestamps exactly the same? i have 4 packages that're 20 minutes
different. which of yours are the same? or was that for all files.
(since i'd like to try an reproduce it).