Re: TMPDIR vs TMPPREFIX again

[Bart Schaefer <schaefer@xxxxxxxxxxxxxxxx>]

On Fri, Aug 14, 2026 at 8:32 AM Mark J. Reed <markjreed@xxxxxxxxx> wrote:
>
> Except by the time any system initialization file is executing, TMPPREFIX has already been set by zsh itself.

That's not really an argument, system initialization doesn't have to
use Mikael's set-it-if-unset formula, e.g. it could
   TMPPREFIX=$TMPDIR/${(M)TMPPREFIX%/zsh}
or even
  [[ $TMPPREFIX = $TMPDIR* ]] || TMPPREFIX=...

That aside ...

> Given the ubiquity of TMPDIR (it's used at least on BSD, Linux, and macOS) it seems like Zsh should honor it if set.

It does seem plausible to use environment TMPDIR to initialize
TMPPREFIX, but does it raise vulnerability concerns?  (I guess no more
so than importing TMPPREFIX itself?)

> I mean, if it just used the C library's `mkdtemp` instead of using a hard-coded path, it would get TMPDIR support for free..

That's not quite right; mkdtemp would have to be called like
(pseudo-code) mkdtemp(sprintf("%sXXXXXX",getenv("TMPDIR"))) -- it
doesn't automatically incorporate it.

Also mkdtemp creates a directory with a unique name, whereas TMPPREFIX
is (currently) a prefix of unique file name within a fixed directory.
Perhaps the latter "guarantee" might be used somewhere.