Unfortunately, simply changing the UI to refer to "SIGMD5" does not help the user understand how it relates to any part of the build.

A Google search on "SIGMD5" is not sufficiently helpful to explain to a user how to verify, or that "SIGMD5" is even an rpm-related term.

Additionally, the rpm manual does not provide any information about SIGMD5, so even if a user knew it was rpm-related, and knew to look at the rpm manual, they'd find no information on how to make use of the field.

The recommended verification on #190 of rpm -Kv foo.rpm is also not found in the rpm manual. -K is completely undocumented in rpm's manual. -K is documented in the man page for rpmkeys, but the -v option is not.

Even if these options were well-documented in the rpm and rpmkeys man pages, it's not clear that this SIGMD5 refers to the rpm feature.

All things considered, this is a slight improvement. However, I still think it'd be helpful to have the term SIGMD5 be a hyperlink to verification instructions, or have hover/tooltip text to do the same.

Can someone please file a bug against upstream rpm? They really need to have -K documented more clearly. This is core functionality.

Here are some places that document the process of verifying rpms:

• https://www.centos.org/docs/5/html/Deployment_Guide-en-US/s1-check-rpm-sig.html
• https://docs.fedoraproject.org/ro/Fedora_Draft_Documentation/0.1/html/RPM_Guide/ch11s04s05.html

We don't really have documentation tool tips elsewhere in the koji web ui, but I guess it's no big deal to add one, as long as we keep it simple.

Aesthetically, I would rather not have the row title be a hotlink, so hover text is better.

add a hovering tooltip: 'The MD5 digest of the combined header and payload contents. You can query it by rpmkeys -Kv foo.rpm'.
Is this one clear and simple enough?

Yes, that sounds like it is very clear and helpful.

I agree.

Commit c4d027cf fixes this pull-request