1 files changed, 2 insertions, 0 deletions

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 982c722..4fa88db 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -13,6 +13,8 @@ Changed
 -------
 
 - Check if the GPG public key file was successfully placed in the work directory before trying to use it.
+- Open the file descriptors for code signing certificates and GPG public key as read only. Nothing from the within the
+  ``pacstrap`` invoked chroot should ever be allowed to write outside of it.
 
 Removed
 -------