From 16c6a6288b34bff7f2076f029e47c375d257947f Mon Sep 17 00:00:00 2001
From: arlishansenn <144086874+arlishansenn@users.noreply.github.com>
Date: Sun, 21 Jun 2026 15:47:12 +0800
Subject: [PATCH 1/2] fix(guest): sync system clock from RTC at boot

The host signs short-lived MITM TLS certificates with notBefore set to the
host wall-clock time. When the guest system clock lags behind the host, those
freshly minted certificates are rejected as "certificate is not yet valid",
breaking every HTTPS egress (curl, apk, Node/Python runtimes, ...).

Seed the system clock from the QEMU-exposed hardware RTC early in guest init
(before networking/CA setup) so the guest stays inside the certificate
validity window. Falls back gracefully when hwclock is unavailable.
---
 guest/image/init | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

diff --git a/guest/image/init b/guest/image/init
index b738120..143bea5 100755
--- a/guest/image/init
+++ b/guest/image/init
@@ -38,6 +38,25 @@ mount -t tmpfs tmpfs /run || log "[init] mount tmpfs failed"
 
 export PATH=/usr/sbin:/usr/bin:/sbin:/bin
 
+# Sync the system clock from the hardware RTC as early as possible.
+#
+# The host issues short-lived MITM TLS certificates whose notBefore is the
+# host wall-clock time. If the guest system clock lags behind the host (which
+# can happen depending on how the kernel initialises time on boot), freshly
+# minted certificates are seen as "certificate is not yet valid" and every
+# HTTPS request through the egress proxy (curl, apk, language runtimes, ...)
+# fails. The QEMU-exposed RTC tracks host time, so seeding the system clock
+# from it keeps the guest within the certificate validity window.
+if command -v hwclock > /dev/null 2>&1; then
+  if hwclock --hctosys --utc > /dev/null 2>&1 || hwclock -s > /dev/null 2>&1; then
+    log "[init] synced system clock from RTC: $(date -u 2>/dev/null)"
+  else
+    log "[init] hwclock RTC sync failed"
+  fi
+else
+  log "[init] hwclock not available; skipping RTC clock sync"
+fi
+
 mkdir -p /tmp /var/tmp /var/cache /var/log /root /home
 mount -t tmpfs tmpfs /tmp || log "[init] mount tmpfs /tmp failed"
 mount -t tmpfs tmpfs /root || log "[init] mount tmpfs /root failed"

From bab7f943c9c0d3c77ba2d4df6c0c13d31362e27c Mon Sep 17 00:00:00 2001
From: arlishansenn <144086874+arlishansenn@users.noreply.github.com>
Date: Sun, 21 Jun 2026 19:38:36 +0800
Subject: [PATCH 2/2] build(image): add e2fsprogs-extra for resize2fs

Alpine splits resize2fs into the e2fsprogs-extra package; e2fsprogs
alone does not ship it. Without resize2fs in the guest image, setting
rootfs.size makes the VM fail to boot with "requires resize2fs in the
guest image (install e2fsprogs)".

Also gitignore the top-level image-out/ build output directory.
---
 .gitignore              | 1 +
 images/alpine-base.json | 1 +
 2 files changed, 2 insertions(+)

diff --git a/.gitignore b/.gitignore
index 838828a..61d58a2 100644
--- a/.gitignore
+++ b/.gitignore
@@ -8,6 +8,7 @@ guest/zig-cache/
 guest/zig-out/
 guest/.zig-cache/
 guest/image/out/
+image-out/
 guest/image/.cache/
 guest/fuzz/out/
 guest/fuzz/out-native/
diff --git a/images/alpine-base.json b/images/alpine-base.json
index 11d7b40..9e8eeb9 100644
--- a/images/alpine-base.json
+++ b/images/alpine-base.json
@@ -13,6 +13,7 @@
       "ca-certificates",
       "curl",
       "e2fsprogs",
+      "e2fsprogs-extra",
       "nodejs",
       "npm",
       "uv",