Use rpmcanon for dom0 updates

[DemiMarie]

The problem you're addressing (if any)

In the aftermath of QSB#67 it is clear that RPM is not infallible. We should reduce its attack surface as much as possible. Additionally, RPM imports data from package signature headers into the rpmdb, but those headers are not signed.

Describe the solution you'd like

I wrote rpmcanon (part of RPM-Oxide) for canonicalizing RPM packages. This can be used to mitigate much of the attack surface.

Where is the value to a user, and who might that user be?

All users will benefit from the reduced attack surface.

Describe alternatives you've considered

Additional context

QSB#67 was due to bugs in RPM. Using rpmcanon will hopefully mitigate future such bugs.

Relevant documentation you've consulted

Related, non-duplicate issues

[DemiMarie]

This has been shipped quite a while ago, closing.