The "freshen" (rpm -F/--freshen) operation did not consider the architecture of a system when selecting update candidates, which caused either misleading error messages or packages being updated to a different architecture inappropriately on multilib systems. RPM now requires an exact architecture match between packages on multilib systems to perform the freshen operation. (BZ#479608, BZ#553108)

RPM previously forced the umask of a process to "022" at library initialization, which could cause unwanted behavior for API users, especially in python, where importing the rpm module would silently change the umask. The umask is now only changed for the duration of a transaction and restored to its previous value afterwards. (BZ#565843)

Package signing could result in a misleading passphrase-related error message when the passphrase was correct but other issues (such as an expired key) prevented signing. Since RPM relies on GnuPG to perform package-signing, it has no knowledge of such details and cannot report them. However, to avoid this situation, any error messages from GnuPG are now passed to RPM users where they were previously silenced unless verbose mode was used when signing packages. (BZ#607222)

Using custom signing parameters such as a different digest algorithm, it was possible to successfully sign a package that RPM could not validate due to differencies in supported algorithms between GnuPG and NSS. RPM now gives an error message when unsupported parameters are used in package signing. (BZ#608599)

Package (re)signing could lead to multiple bad signatures being added to a package, rather than being replaced appropriately, because of flawed heuristics used in determining the signature type. Pre-existing and newly created signatures are now compared in detail to precisely determine the need to replace or skip signatures. (BZ#608608, BZ#681013)

Attempting to build packages that contained fonts when the fontconfig package was not installed sometimes led to the build failing with a "getOutputFrom(): Broken pipe" error because of flaws in the dependency generation system. The "font provides" helper script now always flushes stdin to prevent this from occurring. Additionally, the error message has been made more informative to make catching such issues easier in the future. (BZ#609117)

Attempting to verify packages with "%verifyscript" caused the script to run twice and fail to reflect a failure in response to an RPM exit code. These were simple logic errors, which have been fixed in this update. (BZ#668629)

When both the primary and secondary architecture versions of a package were installed and then updated or erased, RPM failed to erase all files of the previous installation because erasure order was incorrect in cases where order was not dictated by other dependencies. Erasure ordering between primary and secondary architecture packages is now handled correctly in this situation. (BZ#680261)

debuginfo generation could fail to handle cross-directory hard links between binaries in some rare situations, causing corresponding .debug files to be missing in the generated package. This update ensures cross-directory hard linked files in packages are always handled correctly during debuginfo generation. (BZ#618428)

debuginfo generation has been enhanced to generate pre-calculated index files for the GNU Project Debugger (gdb). These indexes improve gdb startup times. (BZ#652787)