config/debian-security/cron.unchecked

@@ -50,6 +50,7 @@ if [ -n "$changes" ]; then
     doanything=true
     echo "$timestamp": ${changes:-"Nothing to do in disembargo"}  >> $reportdis
     dak process-upload -a -d "$disembargo" >> $reportdis
+    dak manage-external-signature-requests
 fi
 
 for queue in embargoed unembargoed; do

config/debian-security/dak.conf

@@ -170,3 +170,15 @@ Urgency
     critical;
   };
 };
+
+Include {
+  "/srv/security-master.debian.org/dak/config/debian/external-signatures.conf";
+};
+
+External-Signature-Requests {
+  Default-Suites {
+    "testing";
+  };
+  Export "/srv/security-master.debian.org/build-queues/project/external-signatures/requests.json";
+  ExportSigningKeys { "AD7B928FBB67C45A4A484560A275AE756013B497"; };
+};

config/debian/common

@@ -174,6 +174,7 @@ function do_unchecked () {
             dak process-upload -a -d "$unchecked"
             dak process-commands -d "$unchecked"
         } >> ${report}
+        dak manage-external-signature-requests
 
         sync_debbugs
         do_buildd

config/debian/dak.conf

@@ -307,3 +307,18 @@ Command::DM-Admin {
     "309911BEA966D0613053045711B4E5FF15B0FD82"; // mhy
   };
 };
+
+Include {
+  "/srv/ftp-master.debian.org/dak/config/debian/external-signatures.conf";
+};
+
+External-Signature-Requests {
+  Default-Suites {
+    "experimental";
+    "unstable";
+    // "testing-proposed-updates";
+    // "stretch-backports";
+  };
+  Export "/srv/ftp-master.debian.org/public/incoming.debian.org/web/debian-buildd/project/external-signatures/requests.json";
+  ExportSigningKeys { "69E6775AC793814879D7406D761F1FE865C742EC"; };
+};

config/debian/external-signatures.conf

+External-Signature-Requests {
+  Sources {
+    // fwupdate {
+    // };
+    // grub2 {
+    // };
+    linux {
+      Packages {
+        "linux-image-amd64-signed-template";
+        "linux-image-arm64-signed-template";
+        "linux-image-i386-signed-template";
+      };
+      Architectures {
+        "amd64"; "arm64"; "i386";
+      };
+    };
+    shim {
+      Packages {
+        "shim-amd64-signed-template";
+        "shim-arm64-signed-template";
+        "shim-i386-signed-template";
+      };
+      Architectures {
+        "amd64"; "arm64"; "i386";
+      };
+    };
+  };
+};