I just installed the updated rpm-3.0.2-6.0, and did a --rebuilddb (although strictly not necessary). It turns out that the files under /var/lib/rpm are recreated with the current umask of root, i.e. 600. (I anyway run root with umask 077) This should not be the case. THese files should always get 644.
Indeed the files in /var/lib/rpm get written with root's umask, so in the case of a 077 umask, all of the files are getting written RW for root only. Not sure whether this is a problem or not, but have forwarded it to a developer for further action.
Unset umask before rebuilding the database. There's no way that rpm can identify that /var/lib/rpm/* should be mode 0644 or mode 0600.