analyzing rpm -Kv output

Question

I am getting this output from rpm -Kv on one of my experimental packages:

clime@coprbox ~/v4tests $ rpm -Kv signed10.rpm
signed10.rpm:
    Header V3 RSA/SHA1 Signature, key ID f67e1676: NOKEY
    Header SHA1 digest: OK (6289e7d8d0a73be107945df48cefb762a5036eb1)
    V3 RSA/SHA1 Signature, key ID f67e1676: BAD
    MD5 digest: OK (3c8cafddad94a1e75adf52c59203cd3a)

Now, there are two lines that mention "signature":

    Header V3 RSA/SHA1 Signature, key ID f67e1676: NOKEY

    V3 RSA/SHA1 Signature, key ID f67e1676: BAD

What is the meaning of the first line and what is the meaning of the second?

Answer 1

From: http://www.rpm.org/max-rpm/s1-rpm-checksig-using-rpm-k.html

The md5 message indicates that a checksum contained in the package file and calculated when the package was built, matches a checksum calculated by RPM during verification. Because the two checksums match, it is unlikely that the package has been modified.

So there is one signature, but (in your case) two digest (checksums).

The meaning of first line is that the gpg is not imported.

The second line say that the signature is invalid.

Answer 2

I have found out that there actually are two signatures in any rpm file - one signs header-only and the second signs header+payload data. There are also two digests tho, as you say - one is md5 on header+payload and the second one (sha1) is on header-only.