Description of problem: dnf has two implementations of rpm checksumming. One stemming from yum written in Python, embedded in dnf. Another in librepo which is authoritative for the normal download+install+delete flow.

Version-Release number of selected component (if applicable):

How reproducible: every time

# Direct install:

Steps to Reproduce:

1. dnf install bash --installroot=/var/tmp/direct.root --releasever=33


Expected/Actual results:

dnf downloads packages, verifies using librepo's lr_checksum_compare, and when these match, installs them.


# Cached install:
Steps to Reproduce:

1. dnf install bash --installroot=/var/tmp/cached.root  --releasever=33 --downloadonly
2. dnf install bash --installroot=/var/tmp/cached.root  --releasever=33 --cacheonly

Expected results:

Step 1 will download and verify the files, adding xattr to cache checksum
Step 2 will read checksum from xattr if present, falling back to lr_checksum_compare.

Actual results:

dnf uses dnf.yum.misc.checksum() in Package.verifyLocalPkg() which doesn't use the xattr cache. This works, but is slower, and is broken with CoW (see next bit)

Additional info:
Today this is a slight perf regression, and doesn't cause any visible failures. The long term issue is that there are two pieces of code that verify checksums and they're different. In the context of https://github.com/rpm-software-management/librepo/pull/222 this means failure because the updated code in librepo isn't being used in the lesss common path.