This module sets up a host to perform binary signing. It supports signing on both OS X and Linux, using the same codebase. Signing is performed using a different user and username from building.
This module uses a number of organization-specific secrets. See modules/toplevel/manifests/server/signing.pp.
This module has a number of dedicated configuration parameters, as well. See modules/config/manifests/base.pp.