man: clarify that /etc/verity.d only parses certificates with the .crt extension

Exposed in the dracut testsuite while adding tests for sysexts:

```
[    2.972948] localhost (sd-merge)[510]: Validation of dm-verity signature failed via the kernel, trying userspace validation instead: Required key not available
[    2.972993] localhost (sd-merge)[510]: Skipping file '/etc/verity.d/dracut.pem', suffix is not '.crt'.
[    2.973045] localhost (sd-merge)[510]: No userspace dm-verity certificates found.
```

diff --git a/man/kernel-command-line.xml b/man/kernel-command-line.xml
index 0ad3c9c772f3e5e4f1641fd8a0d2986774a22c60..83544b3606464af6634b4e0eae29ace7efb12d8e 100644 (file)
--- a/man/kernel-command-line.xml
+++ b/man/kernel-command-line.xml
@@ -711,8 +711,8 @@
         <term><varname>systemd.allow_userspace_verity=</varname></term>
 
         <listitem><para>Takes a boolean argument. Controls whether disk images that are Verity protected may
-        be authenticated in userspace signature checks via <filename>/etc/verity.d/</filename> (and related
-        directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
+        be authenticated in userspace signature checks via <filename>/etc/verity.d/*.crt</filename> (and
+        related directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
         on.</para>
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>

diff --git a/man/systemd-mountfsd.service.xml b/man/systemd-mountfsd.service.xml
index 7cc607c4c5c481272e138d6944cb8135aafacc6e..2e623a272814035f92b0e9f4489432252c56b28c 100644 (file)
--- a/man/systemd-mountfsd.service.xml
+++ b/man/systemd-mountfsd.service.xml
@@ -45,7 +45,7 @@
       <filename>/usr/lib/</filename> it is assumed to be trusted.</para></listitem>
 
       <listitem><para>If the disk image contains a Verity enabled disk image, along with a signature
-      partition with a key in the kernel keyring or in <filename>/etc/verity.d/</filename> (and related
+      partition with a key in the kernel keyring or in <filename>/etc/verity.d/*.crt</filename> (and related
       directories) the disk image is considered trusted.</para></listitem>
     </orderedlist>