From 394d8e6a6f6fe41663795d739c7e9e7804392a32 Mon Sep 17 00:00:00 2001
From: Valerio Setti <vsetti@baylibre.com>
Date: Wed, 10 Jun 2026 16:44:36 +0200
Subject: [PATCH] changelog: add note for PKCS7 rejecting weak hash algorithms

Signed-off-by: Valerio Setti <vsetti@baylibre.com>
---
 ChangeLog.d/pkcs7-reject-weak-hashes.txt | 3 +++
 1 file changed, 3 insertions(+)
 create mode 100644 ChangeLog.d/pkcs7-reject-weak-hashes.txt

diff --git a/ChangeLog.d/pkcs7-reject-weak-hashes.txt b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
new file mode 100644
index 0000000000..61cc03affe
--- /dev/null
+++ b/ChangeLog.d/pkcs7-reject-weak-hashes.txt
@@ -0,0 +1,3 @@
+Security
+   * PKCS7 now rejects weak hash algorithms (RIPEMD160, MD5, SHA-1) on signature
+     verification.