As threatened here
     https://lists.dulug.duke.edu/pipermail/rpm-devel/2007-May/ 
002677.html
I've marked RPMv3 header+payload signing code and defaulted to not  
compile.

The next issue will be to secure the header+payload MD5 digest by  
including
in the signed metadata header, not as a detached element in a signature
header.

There are no simple and transparent ways to achieve adding a digest  
to the
header without zero'ing (or otherwise initializing) the data in the  
header before checking
the digest.

The 16b in a header immutable region trailer are the likeliest  
candidate, with initialization
to the immutable region header before verifying the header+payload  
digest, is the
obvious implementation imho.

But I'll listen to other suggestions, if any.

73 de Jeff