rpm has been calling getpass() twice to get the password for a non-anonymous ftp installs since between Red Hat 6.0 and 6.1 (rpm 3.0 and 3.0.3). This change comes as a direct consequence of changing the way the password is gotten to using xstrdup, as the expansion of the macro gives two calls of getpass(). Patch against HEAD to instead just call getpass() instead attached.
Created attachment 3460 [details] take care of asking for double passwords during ftp install of rpms
(red face) Fixed in rpm-{4.1,4.0.1,3.0.7} cvs. Thanks very much for finding.