In general, it's an error for more than 1 copy of the same package (name-version-release triplet) to exist in an RPM database... yet there's a triple installation (3 copies of the same package, name-version-release) of gpg-pubkey on my 8.0 system. There's no corresponding SRPM listed in the rpm header and the package contains no files. It's clear from it's name what it's function is, but I am under the impression that this system should only have 1 copy... perhaps a different version should exist for a beta GPG key, etc. As for how to reproduce, I am not certain. I know I've connected to RHN quite a few times. Someday I'll try a re-install of 8.0 and see if I get 3 copies from the get-go.
more data: # rpm -q gpg-pubkey gpg-pubkey-db42a60e-37ea5438 gpg-pubkey-db42a60e-37ea5438 gpg-pubkey-db42a60e-37ea5438 # rpm -ql gpg-pubkey (contains no files) (contains no files) (contains no files) # rpm -q --qf '%{SOURCERPM}\n' gpg-pubkey (none) (none) (none) # rpm -qi gpg-pubkey | grep Install Install date: Fri 30 May 2003 08:41:35 AM MDT Build Host: localhost Install date: Thu 19 Jun 2003 10:10:38 AM MDT Build Host: localhost Install date: Thu 19 Jun 2003 10:10:40 AM MDT Build Host: localhost ... has no signature _on_ the package (duh) because it was build locally.
up2date usually is what imports the key.
Fix is to do the following rpm -e --allmatches gpg-pubkey rpm --import /usr/share/doc/rpm-4*/RPM-GPG-KEY How multiple puplic keys got imported is a whole different problem.