#!/bin/bash
#
# Executed weekly via cron, out of dak's crontab.

set -e
set -o pipefail
export SCRIPTVARS=/srv/security-master.debian.org/dak/config/debian-security/vars
. $SCRIPTVARS

LOCKFILE="$lockdir/unchecked.lock"

################################################################################

# Weekly generation of release files, then pushing mirrors.
# Used as we have a "Valid-until" field in our release files of 10 days. In case
# we dont have a security update in that time...
cd $configdir

cleanup() {
    rm -f "$LOCKFILE"
}

if ! lockfile -r100 "$LOCKFILE"; then
    echo "Could not lock $LOCKFILE. Assuming resigning is not needed."
    exit 0
fi
trap cleanup EXIT

# Update Release for main archive
dak generate-releases -a security >/dev/null

# Update Release for buildd archive and publish it
dak generate-releases -a build-queues >/dev/null
${scriptsdir}/update-buildd-archive ${base}/build-queues ${incoming}/debian-security-buildd

cleanup
trap - EXIT

/srv/security-master.debian.org/dak/config/debian-security/make-mirror.sh >/dev/null
sudo -u archvsync -H /home/archvsync/signal_security


################################################################################