fix: NTP syncs as soon as DHCP has a lease, random origin cookie instead of the unsynced local clock, TLS validates certificates against UTC

kernel/src/Api/BuildNo.hpp

@@ -12,4 +12,4 @@
 
 #pragma once
 
-#define MONTAUK_BUILD_NUMBER 103
+#define MONTAUK_BUILD_NUMBER 107

kernel/src/Api/Syscall.cpp

@@ -16,7 +16,7 @@
 #include "Terminal.hpp"   // SYS_PRINT, SYS_PUTCHAR
 #include "Filesystem.hpp" // SYS_OPEN, SYS_READ, SYS_GETSIZE, SYS_CLOSE, SYS_READDIR, SYS_FWRITE, SYS_FCREATE
 #include "Heap.hpp"       // SYS_ALLOC, SYS_FREE
-#include "Time.hpp"       // SYS_GETTICKS, SYS_GETMILLISECONDS, SYS_GETTIME
+#include "Time.hpp"       // SYS_GETTICKS, SYS_GETMILLISECONDS, SYS_GETTIME, SYS_GETUNIXTIME
 #include "Keyboard.hpp"   // SYS_ISKEYAVAILABLE, SYS_GETKEY, SYS_GETCHAR
 #include "Info.hpp"       // SYS_GETINFO
 #include "Graphics.hpp"   // SYS_FBINFO, SYS_FBMAP, SYS_TERMSIZE, SYS_TERMSCALE
@@ -245,6 +245,8 @@ namespace montauk::abi {
                 if (!UserMemory::Writable<DateTime>(frame->arg1)) return BadPointer;
                 Sys_GetTime((DateTime*)frame->arg1);
                 return Success;
+            case SYS_GETUNIXTIME:
+                return Sys_GetUnixTime();
             case SYS_SETUNIXTIME:
                 if (!Sched::Consent::Require(CAP_SET_TIME)) return CapabilityDenied;
                 return Sys_SetUnixTime((int64_t)frame->arg1);

kernel/src/Api/Syscall.hpp

@@ -405,6 +405,9 @@ namespace montauk::abi {
        and returns 1 while more remains, 0 once done. CAP_STORAGE_ADMIN. */
     static constexpr uint64_t SYS_FS_GROW              = 208;  // (drive, FsGrowStatus*, apply) -> 1 / 0 / status
 
+    /* Time.hpp -- wall clock as UTC unix seconds (SYS_GETTIME is local time). */
+    static constexpr uint64_t SYS_GETUNIXTIME          = 209;  // () -> seconds
+
     /* Kernel-owned process capabilities. User identities may namespace
        per-user resources, but never participate in authorization decisions. */
     static constexpr uint64_t CAP_PROCESS_ADMIN = 1ULL << 0;

kernel/src/Api/Time.hpp

@@ -1,6 +1,6 @@
 /*
     * Time.hpp
-    * SYS_GETTICKS, SYS_GETMILLISECONDS, SYS_GETTIME syscalls
+    * SYS_GETTICKS, SYS_GETMILLISECONDS, SYS_GETTIME, SYS_GETUNIXTIME syscalls
     * Copyright (c) 2026 Daniel Hammer
 */
 
@@ -39,6 +39,10 @@ namespace montauk::abi {
         return (int64_t)Timekeeping::GetTZOffset();
     }
 
+    static int64_t Sys_GetUnixTime() {
+        return Timekeeping::GetUnixTimestamp();
+    }
+
     static int64_t Sys_SetUnixTime(int64_t unixSeconds) {
         return Timekeeping::SetUnixTimestamp(unixSeconds) ? Success : InvalidArgument;
     }

kernel/src/Timekeeping/Time.cpp

@@ -37,7 +37,9 @@ static int64_t DateToEpoch(int year, int month, int day, int hour, int minute, i
 
 static Timekeeping::DateTime EpochToDate(int64_t epoch) {
     Timekeeping::DateTime dt = {};
-    int64_t rem = epoch;
+    /* Before the first NTP sync on a board with no RTC the clock sits near
+       the epoch, and a negative time zone pushes local time before it. */
+    int64_t rem = epoch < 0 ? 0 : epoch;
     int year = 1970;
     while (true) {
         int64_t daysInYear = IsLeapYear(year) ? 366 : 365;