how I list unsigned packages of my Fedora system

edit

Try this:

# list all packages
packages=$(rpm -qa | LC_ALL=C sort)
# How to check for a signature (see http://lists.rpm.org/pipermail/rpm-list/2011-December/001048.html)
s=`grep Signature /usr/lib/rpm/rpmpopt* | head -1 | tr -s ' ' | cut -d' ' -f3`
# remove the trailing slash from the signature query format
signature=${s%?}
for p in $packages; do if test -n "$(rpm -q --qf $signature $p | grep none)"; then echo $p; fi; done
# result:
# gpg-pubkey-080ad8c4-50a0c564
# gpg-pubkey-fb4b18e6-50b96bfd
# ...

I get the following signature query on Fedora 20:

echo $signature 
%|DSAHEADER?{%{DSAHEADER:pgpsig}}:{%|RSAHEADER?{%{RSAHEADER:pgpsig}}:{%|SIGGPG?{%{SIGGPG:pgpsig}}:{%|SIGPGP?{%{SIGPGP:pgpsig}}:{(none)}|}|}|}|\n

The RPM's themselves are signed. You can check those with rpm -K foo.rpm.

Once they're installed, you can check that a given rpm's files are good with rpm -V package' orrpm -Va` for all of them. If the '5' column exists for a file, its checksum has failed. You might exclude 'c' (config) files from this check.

But that doesn't directly solve your question since rpm doesn't have round-trip verification - you can't tell RPM to rebuild your rpm file from the installed files and compare binaries - it's more of a one-way process.

If I were in your shoes, I'd run: yum --releasever=20 distro-sync (or whichever release you're on) and then do package-cleanup --orphans to see if you have any straggling packages left that were not in the repo.