Add shim-$arch-signed-template support

for getting the MOK-manager and fall-back binary to be signed by Debians
singing service instead of using an ephemeral key.

Closes: #922228

1 files changed, 21 insertions, 0 deletions

diff --git a/debian/control b/debian/control
index 58538d5d..bbf0abbc 100644
--- a/debian/control
+++ b/debian/control
@@ -18,3 +18,24 @@ Description: boot loader to chain-load signed boot loaders under Secure Boot
  against a built-in signature database.  Its purpose is to allow a small,
  infrequently-changing binary to be signed by the UEFI CA, while allowing
  an OS distributor to revision their main bootloader independently of the CA.
+
+Package: shim-amd64-signed-template
+Architecture: amd64
+Depends: ${misc:Depends},
+Description: boot loader to chain-load signed boot loaders (signing template)
+ This package contains template files for shim-amd64-signed.
+ This is only needed for Secure Boot singing.
+
+Package: shim-i386-signed-template
+Architecture: i386
+Depends: ${misc:Depends},
+Description: boot loader to chain-load signed boot loaders (signing template)
+ This package contains template files for shim-i386-signed.
+ This is only needed for Secure Boot singing.
+
+Package: shim-arm64-signed-template
+Architecture: arm64
+Depends: ${misc:Depends},
+Description: boot loader to chain-load signed boot loaders (signing template)
+ This package contains template files for shim-arm64-signed.
+ This is only needed for Secure Boot singing.