mkarchiso: open the ARCHISO_GNUPG_FD, ARCHISO_TLS_FD and ARCHISO_TLSCA_FD file descriptors only for reading

Nothing should ever be written to these files, so let's make sure it cannot happen.

1 files changed, 2 insertions, 0 deletions

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index 982c722..4fa88db 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -13,6 +13,8 @@ Changed
 -------
 
 - Check if the GPG public key file was successfully placed in the work directory before trying to use it.
+- Open the file descriptors for code signing certificates and GPG public key as read only. Nothing from the within the
+  ``pacstrap`` invoked chroot should ever be allowed to write outside of it.
 
 Removed
 -------