This has come up again with ARM boards that cannot finish booting out of the initramfs because they have no RTC and so upon booting in the initramfs their time simply gets forwarded to Nov 2019 (the epochd of systemd), but if the model assertion and the account-key used to create the image are both newer than Nov 2019 then the device fails to boot, resulting in something like:
```
[ 15.377377] the-tool[176]: error: cannot load metadata and verify essential bootstrap snaps [base kernel snapd gadget]: cannot accept some assertions:
[ 15.400931] [[0;1;31mFAILED[0m] Failed to start [0;1;39mthe-tool.service[0m.
See 'systemctl status the-tool.service' for details.
the-tool[176]: - assertion is signed with expired public key "PYn7GbIbTMPJk9SyM73DfKfzTXRfH0wPqSe3h7ixlKN3-Lw25rSO2_tZ3WVamWux" from "PcQpbi62D9Fvr3TBxaS5lf3M9650ceGr"
[ 15.436979] systemd[1]: the-tool.service: Main process exited, code=exited, status=1/FAILURE
[ 15.453782] systemd[1]: the-tool.service: Failed with result 'exit-code'.
[ 15.469151] systemd[1]: Failed to start the-tool.service.
```
I think the error message from snap-bootstrap here is a bit confusing it says "expired" when more accurately it is "not yet valid".
I think as a start, we should SRU to focal this bug: https://bugs.launchpad.net/ubuntu-core-initramfs/+bug/1878969 and then also work on adding an equivalent fixrtc-mount script to the initramfs somehow/somewhere that uses additional, trusted information about what time to move forward to using something in ubuntu-seed.
This has come up again with ARM boards that cannot finish booting out of the initramfs because they have no RTC and so upon booting in the initramfs their time simply gets forwarded to Nov 2019 (the epochd of systemd), but if the model assertion and the account-key used to create the image are both newer than Nov 2019 then the device fails to boot, resulting in something like:
``` 31mFAILED [0m] Failed to start [0;1;39mthe- tool.service [0m. SyM73DfKfzTXRfH 0wPqSe3h7ixlKN3 -Lw25rSO2_ tZ3WVamWux" from "PcQpbi62D9Fvr3 TBxaS5lf3M9650c eGr"
[ 15.377377] the-tool[176]: error: cannot load metadata and verify essential bootstrap snaps [base kernel snapd gadget]: cannot accept some assertions:
[ 15.400931] [[0;1;
See 'systemctl status the-tool.service' for details.
the-tool[176]: - assertion is signed with expired public key "PYn7GbIbTMPJk9
[ 15.436979] systemd[1]: the-tool.service: Main process exited, code=exited, status=1/FAILURE
[ 15.453782] systemd[1]: the-tool.service: Failed with result 'exit-code'.
[ 15.469151] systemd[1]: Failed to start the-tool.service.
```
I think the error message from snap-bootstrap here is a bit confusing it says "expired" when more accurately it is "not yet valid".
I think as a start, we should SRU to focal this bug: https:/ /bugs.launchpad .net/ubuntu- core-initramfs/ +bug/1878969 and then also work on adding an equivalent fixrtc-mount script to the initramfs somehow/somewhere that uses additional, trusted information about what time to move forward to using something in ubuntu-seed.