With current CVS, I keep getting

*** glibc detected *** rpm: double free or corruption (out): 0x09192040 ***

when installing a package built with rpm 4.4.5 without gpg signature.

I haven't really tracked it down yet, but there seems to be a code path that 
triggers an sha1 checksum to be freed twice -- changing 
dig->sig=_free(dig->sig); in rpmpgp.c pgpSetSig() to dig->sig=NULL; makes it 
work (but is quite certainly not the right thing to do, it just helps 
locating the problem).