changelog: Add entry for signed built-in sysexts

danzatt · danzatt · commit 177e87c4a0bb · 2025-11-07T11:58:05.000Z
Signed-off-by: Daniel Zatovic &lt;daniel.zatovic@gmail.com&gt;
diff --git a/changelog/changes/2025-11-05-signed-built-in-sysexts.md b/changelog/changes/2025-11-05-signed-built-in-sysexts.md
@@ -0,0 +1 @@
+- Built-in system extensions (e.g., docker-flatcar, containerd-flatcar) are now cryptographically signed using dm-verity roothash signatures. This enables stricter sysext policies via systemd-sysext and provides a foundation for verifying user-provided extensions in future releases. The format changed from squashfs to erofs-based Discoverable Disk Images (DDI). ([scripts#3162](https://github.com/flatcar/scripts/pull/3162))

Original file line number	Diff line number	Diff line change
`@@ -0,0 +1 @@`
	`1`	`+- Built-in system extensions (e.g., docker-flatcar, containerd-flatcar) are now cryptographically signed using dm-verity roothash signatures. This enables stricter sysext policies via systemd-sysext and provides a foundation for verifying user-provided extensions in future releases. The format changed from squashfs to erofs-based Discoverable Disk Images (DDI). ([scripts#3162](https://github.com/flatcar/scripts/pull/3162))`