Inline signature for static-delta superblock

[fdanis-oss]

If we use static-delta with all parts inlined into the single file, the superblock that precedes everything else is not signed.
While the commits contained in the single static-delta file are signed so we can check them and operate on trusted data, the superblock isn't signed in any way, so it end up operating on untrusted data to:

1. actually find where the trusted data is, and
2. check whether the update is fit for the current device by looking at the collection id stored in the metadata

An idea to sign the superblock is to generate a signature of all its data (serialized), except the signature, then add the signature to the superblock itself as an additional metadata field.

Verifying the superblock would then involve the following steps:

1. fetch data from the superblock
2. serialize the fetched data except the signature to reconstruct a pseudo-superblock
3. check the computed serialization of the pseud-superblock against the original signature

The GVariant parsing code would still operate on untrusted data, but at least we can verify that the extracted contents are trusted.

Signing the whole bundle would avoid operating on untrusted data but would also require to copy the whole bundle away from external storage to protect from malicious storage devices trying to play TOCTOU tricks on us (for instance, an update shipped on a bundle on a usb key that malicously changes the contents after the first read used to verify the contents).

Do you have any suggestion about what would be the best way to address this issue?

Thanks!