secure_time: true can never sync — guest chrony is built without NTS

meta-dstack/recipes-core/chrony/chrony%.bbappend から始め、その PACKAGECONFIG を upstream の chrony_4.8.bb と比較し、次に chronyc waitsync ゲートの周辺にある dstack-util/system_setup.rs を調べます。NTS を有効にしたイメージをビルドし、chronyc が同期できることを確認します。また、信頼できる時刻ソースが存在しない場合に secure_time が false になるよう、単一ノードのデフォルトも追跡します。

Problem

Guest images ship /etc/chrony/chrony.conf with every time server set to NTS (server <host> iburst nts), but chronyd is compiled without NTS support. Chrony therefore has zero usable sources and never synchronizes.

Any app with secure_time: true — the manifest default (default_true) — then blocks in dstack-util system_setup.rs on chronyc waitsync, which bails → boot.error → reboot. On SEV-SNP this is a hard loop (cpus are not resettable, terminating → VMM restarts forever); on TDX it's a boot failure.

Confirmed from inside a running CVM:

chronyd 4.8 starting (... -NTS ...)
Missing NTS support
Can't synchronise: no selectable sources (10 unreachable sources)

chronyc authdata shows Cook=0 for all servers (NTS-KE never attempted), and the clock was already correct (stepped 0.000000s) — so it's not a network, clock, or platform issue.

It has gone unnoticed because every real deployment sets secure_time: false; the broken NTS sync is silent until the strict gate is enabled.

Fix

In meta-dstack, recipes-core/chrony/chrony%.bbappend adds DEPENDS += "gnutls" and an NTS config but never enables the NTS build flag. Upstream chrony_4.8.bb gates it behind PACKAGECONFIG[nts]. Add:

PACKAGECONFIG:append = " nts"

Then chronyd is built with NTS and secure_time: true can actually sync.

Separately, single-node/no-gateway deploys (no trusted time source) should default secure_time: false.