Add userpref for the packet signature policy default

[thebentern]

Adds USERPREFS_CONFIG_SECURITY_PACKET_SIGNATURE_POLICY, a build-time default for the existing config.security.packet_signature_policy (COMPATIBLE / BALANCED / STRICT).

Until now that policy could only be set after flashing, via a client — so a fleet or event build had no way to ship nodes already on BALANCED or STRICT. This applies it in installDefaultConfig() next to the other config userprefs, following the same pattern as USERPREFS_CONFIG_DEVICE_ROLE.

Notes:

• Fresh-install default only; the owner can still change it afterward.
• Guarded on MESHTASTIC_EXCLUDE_PKI / MESHTASTIC_EXCLUDE_XEDDSA so a build that compiles the checks out stays on COMPATIBLE rather than reporting a policy nothing enforces — same stance AdminModule::handleSetConfig already takes for remote sets.
• The value is the meshtastic_* enum constant, which bin/platformio-custom.py passes through unquoted; anything that isn't a valid enum constant fails at compile time rather than silently shipping.

Verified with a native build that actually bakes the pref in (BALANCED): test_packet_signing and test_default pass, 73/73.

Summary by CodeRabbit

• New Features
  • Added a configurable packet signature policy setting.
  • The default configuration now applies the selected signature policy when supported.
  • Updated the configuration template with the balanced signature policy option.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 565f6920-c013-4d71-957c-9ee389b6994c

📥 Commits

Reviewing files that changed from the base of the PR and between f90c134 and eabe053.

📒 Files selected for processing (2)

• src/mesh/NodeDB.cpp
• userPrefs.jsonc

---

📝 Walkthrough

Walkthrough

Adds a user-preference template entry for packet signature policy and conditionally applies that preference during default configuration installation when signature policy support is enabled.

Changes

Packet signature policy configuration

Layer / File(s)	Summary
Default policy initialization userPrefs.jsonc, src/mesh/NodeDB.cpp	Adds a balanced packet signature policy preference and initializes config.security.packet_signature_policy from it for supported builds.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Possibly related issues

• meshtastic/Meshtastic-Android#6176 — Concerns firmware initialization and user-preference support for the same packet signature policy.
• meshtastic/web#1260 — Adds Web UI controls for the firmware packet signature policy setting.
• meshtastic/device-ui#340 — Covers configuration and behavior of the packet signature policy.

Possibly related PRs

• meshtastic/firmware#11134 — Also changes packet signature policy defaults under build and configuration conditions.

Suggested reviewers: caveman99, jp-bennett

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: adding a build-time default for packet signature policy.
Description check	✅ Passed	The description covers the change, guardrails, and testing, though it omits the template's explicit attestation checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch policy-pref

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

⚡ Try this PR in the Web Flasher

Note

Building this pull request… the flash button, badges and supported-board
list will appear here automatically once CI finishes.