Strip Monotonic Clock Readings when Comparing Credential Expiry Time

[skmcgrail]

Strip monotonic clock readings from credential cache implementation when comparing expiration time.

[shogo82148]

I don't understand why stripping is needed.
Could you explain to me, please?

[skmcgrail]

I don't understand why stripping is needed.
Could you explain to me, please?

The reason for stripping off monotonic readings when comparing the expiry time is to prevent issues where Go's time functions will utilize the monotonic clock readings if present on both time values. The monotonic clock reading can be incorrect in cases where the host system is hibernated (for example using EC2 Hibernate). On Linux the monotonic clock readings post hibernation will not correctly represent the time that elapsed while the host system was hibernated. To ensure that credential expiration time comparisons are occurring based on the wall-clock time, we call Round(0) on one of the time values being compared, which will strip off the monotonic reading but keep the wall-clock the same.

[shogo82148]

The monotonic clock reading can be incorrect in cases where the host system is hibernated (for example using EC2 Hibernate).

I got it, thanks!