8936: update blob-signing-ttl related documentation.

diff --git a/doc/install/install-keepstore.html.textile.liquid b/doc/install/install-keepstore.html.textile.liquid
index 13dfaf6725d40e089759ec62058fcd63ff83c33b..0f36c5d35acbfffcbb417b30c6faf352076b06d4 100644 (file)
--- a/doc/install/install-keepstore.html.textile.liquid
+++ b/doc/install/install-keepstore.html.textile.liquid
@@ -41,7 +41,7 @@ Usage of ./keepstore:
   -azure-storage-account-name="": Azure storage account name used for subsequent --azure-storage-container-volume arguments.
   -azure-storage-container-volume=[]: Use the given container as a storage volume. Can be given multiple times.
   -azure-storage-replication=3: Replication level to report to clients when data is stored in an Azure container.
-  -blob-signature-ttl=1209600: Lifetime of blob permission signatures. See services/api/config/application.default.yml.
+  -blob-signature-ttl=1209600: Lifetime of blob permission signatures. This will become a part of the signing key, and will cause clients to retry or fail if changed while they are in progress. See services/api/config/application.default.yml.
   -blob-signing-key-file="": File containing the secret key for generating and verifying blob permission signatures.
   -data-manager-token-file="": File with the API token used by the Data Manager. All DELETE requests or GET /index requests must carry this token.
   -enforce-permissions=false: Enforce permission signatures on requests.

diff --git a/services/api/config/application.default.yml b/services/api/config/application.default.yml
index 66916836c23fb9538281400ad84b1f1f672247e2..8a1c6447d83a32e2e458d319bfd2af93fd461523 100644 (file)
--- a/services/api/config/application.default.yml
+++ b/services/api/config/application.default.yml
@@ -148,7 +148,9 @@ common:
   ###
 
   # Lifetime (in seconds) of blob permission signatures generated by
-  # the API server. This determines how long a client can take (after
+  # the API server. This will become a part of the blob signing key,
+  # and will cause clients to retry or fail if changed while they are
+  # in progres.This determines how long a client can take (after
   # retrieving a collection record) to retrieve the collection data
   # from Keep. If the client needs more time than that (assuming the
   # collection still has the same content and the relevant user/token

diff --git a/services/keepstore/keepstore.go b/services/keepstore/keepstore.go
index 40e62c5c50146aa6a89f0bcf6566eb194b943b73..cf15dffd368925ce68a3d5f69350c388306d87d0 100644 (file)
--- a/services/keepstore/keepstore.go
+++ b/services/keepstore/keepstore.go
@@ -189,7 +189,8 @@ func main() {
                &permissionTTLSec,
                "blob-signature-ttl",
                int(time.Duration(2*7*24*time.Hour).Seconds()),
-               "Lifetime of blob permission signatures. "+
+               "Lifetime of blob permission signatures. This will become a part of the signing key, "+
+                       "and will cause clients to retry or fail if changed while they are in progress. "+
                        "See services/api/config/application.default.yml.")
        flag.BoolVar(
                &flagSerializeIO,