It just compares expected checksum from rpm database with actual state in the system. That said, rpm supports package signing, so that it can catch a package w

It just compares expected checksum from rpm database with actual state in the system. That said, rpm supports package signing, so that it can catch a package which was tampered with and prevent it's installation.