I think there are two cases of interest:
1) a file or signature in the rpm is corrupted, the signature doesn't have a matching
cert installed, etc...
in this case, if the plugin is present, when you attempt to install the rpm the verity
enable ioctl will explicitly fail, and presumably so will the rpm install. You can see
most of the details for this sort of case here in the rpm plugin code:
https://github.com/rpm-software-management/rpm/blob/master/plugins/fsveri....
2) after installation, a file from an fs-verity enabled rpm gets one or more blocks
corrupted
The first read of a corrupted block from disk (the good uncorrupted page might survive in
page cache for a while) will result in EIO for read-like system calls and SIGBUS if the
file is mapped (executables, mmap).