Harden DNF config

This uses a postinstall script for DNF5 and a configuration file
otherwise.

package-managers/Makefile

@@ -94,6 +94,8 @@ endif
 install-dnf5: install-rpm
 	install -D -m 0644 qubes-post-update.actions \
 		$(DESTDIR)$(SYSCONFDIR)/dnf/libdnf5-plugins/actions.d/qubes-post-update.actions
+	install -D -m 0644 dnf-harden.conf \
+		$(DESTDIR)$(SYSCONFDIR)/dnf/libdnf5.conf.d/10-qubes.conf
 
 install-yum: install-rpm
 	install -d $(DESTDIR)$(LIBDIR)/yum-plugins

package-managers/dnf-harden.conf

@@ -0,0 +1,3 @@
+[main]
+deltarpm=0
+zchunk=0

rpm_spec/core-agent.spec.in

@@ -582,6 +582,13 @@ if [ -L /usr/local ]; then
     mount /usr/local || :
 fi
 
+%if 0%{?fedora} < 41
+if [ ! -f /etc/qubes-dnf-hardened ]; then
+    dnf config-manager --setopt=zchunk=0 --setopt=deltarpm=0 --save &&
+    touch /etc/qubes-dnf-hardened
+fi
+%endif
+
 # workaround for Fedora's systemd package bug
 # https://bugzilla.redhat.com/1559286
 if [ -d /var/lib/private ]; then
@@ -963,6 +970,7 @@ rm -f %{name}-%{version}
 %config(noreplace) /etc/yum.repos.d/qubes-r4.repo
 %if 0%{?fedora} >= 41
 /etc/dnf/libdnf5-plugins/actions.d/qubes-post-update.actions
+/etc/dnf/libdnf5.conf.d/10-qubes.conf
 %else
 %if 0%{?rhel} == 7
 /etc/yum/pluginconf.d/yum-qubes-hooks.conf