strongSwan

Did some more digging. It seems like this happens when the build does 'git clone http://git.codelabs.ch/git/x509-ada.git'. It then compiles a bunch of stuff, and ends up calling into cert_tests.adb, which does this:

declare
         use type Ada.Calendar.Time;
         use type Ada.Calendar.Time_Zones.Time_Offset;

V  : constant Validity.Validity_Type := Certs.Get_Validity (Cert);
         T1 : Ada.Calendar.Time
           := Ada.Calendar.Time_Of
             (Year    => 2009,
              Month   => 8,
              Day     => 27,
              Seconds => 36444.0);
         T2 : Ada.Calendar.Time
           := Ada.Calendar.Time_Of
             (Year    => 2014,
              Month   => 8,
              Day     => 26,
              Seconds => 36444.0);
      begin

--  Add TZ specific time offset to reference times.

T1 := T1 + Duration
           (Ada.Calendar.Time_Zones.UTC_Time_Offset (T1) * 60);
         T2 := T2 + Duration
           (Ada.Calendar.Time_Zones.UTC_Time_Offset (T2) * 60);

Assert (Condition => Validity.Get_Start (V) = T1,
                 Message   => "Validity start mismatch");
         Assert (Condition => Validity.Get_End (V) = T2,
                 Message   => "Validity end mismatch");
         Assert (Condition => Validity.Is_Valid (V),
                 Message   => "Cert not valid");  <=== this is the failing message?
      end;

and the Is_Valid method does:

function Is_Valid (V : Validity_Type) return Boolean
   is
      use Ada.Calendar;

Now : constant Time := Clock;
   begin
      return V.Not_Before <= Now and then Now <= V.Not_After;
   end Is_Valid;

So if the clock is not in range for the dates in the cert, we bomb? Looking at the date range above, it looks like if the wall clock is prior to 8/27/2009 or after 8/26/2014, it fails. Today is 9/16/2014, so we fail? I guess I'm puzzled how this is expected to ever work (unless no one has run this build process since 8/26/2014?) A little surprised code like this has a fixed end date that has to be (presumably) updated periodically? What should I be doing here? Running with a make flag to ignore errors? Somehow skipping the cert checking? Something else?

The issue has been fixed upstream, the associated commits update the build recipe and the certificates used in the TKM tests.

Good to go, thanks!