Document how to import additional sources into the security archive.

diff --git a/docs/debian-specific b/docs/debian-specific
index 49723985f44bf226dd3d771fb0fd29ea48cbcbf8..ff0ed3b48f23ec38516dd699af704c0e0f5cda8c 100644 (file)
--- a/docs/debian-specific
+++ b/docs/debian-specific
@@ -12,3 +12,12 @@ DEBIAN-SPECIFIC NOTES                                  -*- mode: Org -*-
 - dcmd mv -n bla.changes ../unchecked
 - /srv/security-master.debian.org/dak/config/debian-security/cron.unchecked
 - cronon
+** Built-Using
+Source packages referred to via Built-Using need to be included in the
+security archive:
+
+- Obtain & verify .dsc
+- dak import built-using updates/<component> <.dsc...>
+
+If the .dsc is signed by an old key no longer in the keyring, use
+--ignore-signature. Make extra sure the .dsc is correct.