Ref T10547. This has been around for a while but I was never able to reproduce it. I caught a repro case in the cluster recently and I think this is the right fix.

We tell Subversion to run ssh-connect instead of ssh so we can provide options and credentials, by using SVN_SSH in the environment. Subversion will sometimes kill the SSH tunnel subprocess aggressively with SIGTERM -- as of writing, you can search for SIGTERM in make_tunnel() here:

http://svn.apache.org/repos/asf/subversion/trunk/subversion/libsvn_ra_svn/client.c

By default, when a PHP process gets SIGTERM it just exits immediately, without running destructors or shutdown functions. Since destructors/shutdown functions don't run, TempFile doesn't get a chance to remove the file.

I don't have a clear picture of when Subversion sends SIGTERM to the child process. I can't really get this to trigger locally via svn, although I was able to get it to trigger explicitly. So I'm only about 95% sure this fixes it, but it seems likely.

Locally, I couldn't get this to reproduce "normally" even knowing the cause (maybe Subversion doesn't do the SIGTERM stuff on OSX?) but I was able to get it to reproduce reliabily by adding posix_kill(getmypid(), SIGTERM); to the body of the script.

With that added, running the script with PHABRICATOR_CREDENTIAL=PHID-CDTL-... in the environment reliably left straggler temporary files.

Adding declare() and a signal handler fixed this: the script now runs the TempFile destructor and longer leaves the stragglers around.