how rpm destroyed my private key

[Elan Ruusamäe]

and it did it again!

scenario:

package version1 installed,
i have file secret_key.php in filesystem, which is not (yet) packaged.

i create package version2, which has:
%attr(640,root,http) %config(noreplace) %verify(not md5 mtime size) 
%{_webappdir}/secret_key.php
secret_key.php is 0 byte file in package.

now i upgrade package version1->version2, the file is just replaced with 
empty file. no .rpmsave, no .rpmnew, no nothing. it just nuked the damn 
file.
i have repackage enabled, and the secret_key.php is not present even 
repackage file.
i have to go to extract the file from bacula backup!

-- 
glen