signatures: --sign-every

Changes left unsigned are vouched for by the node's next signature:
--sign-every 1s (default) signs the latest within a second, all signs
every change, none only those that must be.

Auth plan M5.

1 files changed, 9 insertions, 0 deletions

diff --git a/src/config/mod.rs b/src/config/mod.rs
index f0e5dc5..0da7ed7 100644
--- a/src/config/mod.rs
+++ b/src/config/mod.rs
@@ -124,6 +124,13 @@ pub(crate) const OPTIONS: &[OptionSpec] = &[
         "HTTP API users (from htpasswd or user-header) who may write protocol data under /store/_continuum (remake records, members, forget records), e.g. to repair a stuck remake, in a swarm without a user registry. Such writes act on the whole swarm and are logged. Epoch metadata and the swarm ID are never writable. With a registry its capabilities decide instead (docs/access.md), but for a registry nobody may manage users of any more: then these may do everything on this node, to set it right.",
     ),
     option(
+        "sign-every",
+        Kind::Text,
+        "all|none|DURATION",
+        Some("1s"),
+        "Which of its changes this node signs with its node key besides those touching protocol data, paths listed in _continuum/access/signed, or written with ?signed=true: all of them; none (one left unsigned is vouched for by the node's next signed change); or its latest change, if unsigned, this often, so every change is vouched for within it (docs/api.md, Signed changes).",
+    ),
+    option(
         "token-lifetime",
         Kind::Duration,
         "DURATION",
@@ -566,6 +573,8 @@ pub(crate) struct Settings {
     pub(crate) bootstrap_users: Vec<String>,
     #[serde(default)]
     pub(crate) cors_origins: Vec<String>,
+    #[serde(default)]
+    pub(crate) sign_every: crate::document::signatures::SignEvery,
     #[serde(
         default = "default_token_lifetime",
         with = "crate::units::duration_option"