lainOS/sdwdate
lainOS/sdwdate
3
0
Fork 0
Code Issues Pull requests Projects Releases 6 Packages Wiki Activity Actions
6 releases 6 tags
  • sdwdate-1.0.0-1 1580da95ee

    sdwdate-1.0.0-1 Stable

    amnesia released this 2026-07-10 18:19:31 +02:00 | 7 commits to main since this release

    sdwdate (lainOS layer 02 port) ~ Changelog

    1.0.0-1 (2026-07-10) ~ Initial port

    First working LainOS Layer 02 / OpenRC port of Kicksecure's sdwdate.

    Ported from upstream (GPLv3):

    • Core Python daemon and sclockadj C helper (compiled with upstream's full hardened compiler flag set)
    • Default time-source pool configuration
    • url_to_unixtime per-source fetcher

    New, LainOS-native components (not vendored from Kicksecure):

    • sanitize_string / guimessages.translations ~ minimal reimplementations of two cosmetic Kicksecure helper packages
    • lainos-minimum-unixtime-show ~ reimplementation of the anti-replay-protection floor-timestamp mechanism (replaces Kicksecure's timesanitycheck package dependency)
    • lainos-onion-time-pre-script ~ no-op replacement for upstream's privleap/AppArmor-dependent Tor-restart-request signaling (not applicable on LainOS)
    • OpenRC init script, translated from upstream's systemd unit: need tor/after tor dependency ordering, setcap cap_sys_time+ep in place of AmbientCapabilities=CAP_SYS_TIME, required runtime directories created in start_pre()

    Deliberately not ported: AppArmor profiles, privleap integration, Qubes-specific conditionals, the Tor-restart-request file-watcher mechanism, and dev-only test scripts. See README for full rationale on each.

    Known gaps relative to upstream:

    • No seccomp/SystemCallFilter equivalent yet (OpenRC has no direct translation; a wrapper-based approach similar to protocol7-core's daemons would be needed)
    • Tor-restart-on-request is not implemented (daemon runs fine without it; only affects the specific edge case upstream's file-watcher mechanism handles)

    Verified working end-to-end (2026-07-10): real onion time sources contacted over Tor, Tor consensus sanity checks passing, correct median computation across sources, sclockadj correctly applying a real (small) gradual clock correction, all with a genuinely accurate result.

    Companion change (in lainos-utils): added lainos-sdwdate toggle script (enable/disable/status) to switch between chrony (default) and sdwdate, since sdwdate has no fallback if Tor is unreachable and the two should not run simultaneously.

    Bugs found and fixed during initial porting/testing

    For reference, the real issues found getting this daemon running for the first time, each confirmed via actual testing rather than assumed:

    1. /usr/bin/sdwdate (the interactive CLI wrapper) calls leaprun, a privleap command not present on LainOS ~ resolved by pointing the OpenRC service at the real daemon entry point (/usr/libexec/sdwdate/sdwdate) directly, matching what upstream's own systemd unit does (the wrapper script was never meant to be the service entry point).
    2. Python package files installed to Debian's dist-packages convention; Arch uses site-packages ~ fixed install paths in the PKGBUILD.
    3. sdwdate system user's home directory didn't match what the daemon's status-file logic expects (/run/sdwdate) ~ fixed via usermod/.install.
    4. /var/lib/sdwdate-forbidden-temp (a directory upstream's code creates unconditionally, originally to work around an AppArmor constraint that doesn't apply here) wasn't being created ~ added to the init script's start_pre().
    5. /usr/libexec/helper-scripts/onion-time-pre-script was missing entirely (privleap/AppArmor-specific upstream component) ~ replaced with the no-op lainos-onion-time-pre-script described above.
    6. url_to_unixtime wasn't installed at all (missed in the initial package file list) ~ added.
    7. Tor's control-port authentication cookie (/var/lib/tor/control_auth_cookie) wasn't readable by the sdwdate user, causing Tor consensus sanity checks to fail even though basic SOCKS-based fetching worked ~ fixed by adding sdwdate to the tor group.
    Downloads