Suppose a rpm package contains multiple two signatures S1 and S2. AC1) If both S1 and S2 are valid and signature algorithms are known and allowed, signature verification passes. AC2) If S1 is valid and signature algorithm is known and allowed but S2 signature algorithm is uknown or not allowed, signature verification passes. AC3) If S2 is valid and signature algorithm is known and allowed but S1 signature algorithm is uknown or not allowed, signature verification passes. AC4) If S1 is not valid but signature algorithm is known and allowed and S2 signature algorithm is uknown or not allowed, signature verification fails. AC5) If S2 is not valid but signature algorithm is known and allowed and S1 signature algorithm is uknown or not allowed, signature verification fails. AC6) If both S1 and S2 signature algorithms are unknown uknown or not allowed, signature verification fails.

Cause: Signatures with unknown or disabled algorithms reported error to rpm when the key is not imported. Consequence: RPM was failing to validate signatures on RPM packages with some failed signatures. Fix: When we encounter unknown algorithm we do not have a key for, we report that the signature is not trusted. Result: The crypto policies can be used to disable one of the algorithms we use for signing RPMs.