From f2ea75b64afe2af2ee5e5a1604db162a248f8ab3 Mon Sep 17 00:00:00 2001
From: Antonio Alvarez Feijoo <antonio.feijoo@suse.com>
Date: Thu, 23 Apr 2026 15:39:29 +0200
Subject: [PATCH] man: clarify that /etc/verity.d only parses certificates with
 the .crt extension

Exposed in the dracut testsuite while adding tests for sysexts:

```
[    2.972948] localhost (sd-merge)[510]: Validation of dm-verity signature failed via the kernel, trying userspace validation instead: Required key not available
[    2.972993] localhost (sd-merge)[510]: Skipping file '/etc/verity.d/dracut.pem', suffix is not '.crt'.
[    2.973045] localhost (sd-merge)[510]: No userspace dm-verity certificates found.
```

(cherry picked from commit dfa5aa07b5637cb9a9f46d7908c964217940a073)
(cherry picked from commit 4a53004a5c5ce55abd6c6cbfbd565ba3689a4ccf)
(cherry picked from commit 4cabbe515eb2f1e86f28687f8e8f3ced077c43a8)
---
 man/kernel-command-line.xml      | 4 ++--
 man/systemd-mountfsd.service.xml | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/man/kernel-command-line.xml b/man/kernel-command-line.xml
index 6a80f157599..eed73ab7f15 100644
--- a/man/kernel-command-line.xml
+++ b/man/kernel-command-line.xml
@@ -710,8 +710,8 @@
         <term><varname>systemd.allow_userspace_verity=</varname></term>
 
         <listitem><para>Takes a boolean argument. Controls whether disk images that are Verity protected may
-        be authenticated in userspace signature checks via <filename>/etc/verity.d/</filename> (and related
-        directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
+        be authenticated in userspace signature checks via <filename>/etc/verity.d/*.crt</filename> (and
+        related directories) public key drop-ins, or whether in-kernel signature checking only. Defaults to
         on.</para>
 
         <xi:include href="version-info.xml" xpointer="v256"/></listitem>
diff --git a/man/systemd-mountfsd.service.xml b/man/systemd-mountfsd.service.xml
index 81d02d3d4f8..b8a70a091b8 100644
--- a/man/systemd-mountfsd.service.xml
+++ b/man/systemd-mountfsd.service.xml
@@ -45,7 +45,7 @@
       <filename>/usr/lib/</filename> it is assumed to be trusted.</para></listitem>
 
       <listitem><para>If the disk image contains a Verity enabled disk image, along with a signature
-      partition with a key in the kernel keyring or in <filename>/etc/verity.d/</filename> (and related
+      partition with a key in the kernel keyring or in <filename>/etc/verity.d/*.crt</filename> (and related
       directories) the disk image is considered trusted.</para></listitem>
     </orderedlist>