System.system_time(:second) lags producing invalid claim after OS sleep/hibernate

[pcapel]

On MacOS Ventura 13.5.2, running System.system_time(:second) appears to drift if the machine has slept. This means that during development you may find that the nbf claim fails intermittently, requiring you to restart your application.

You should be able to reproduce this by running an application, sleeping the machine, and then trying to log back in to the application. If you want to verify the behavior of System.system_time then you can start an IEx session, then sleep your machine for some period of time. When you return to the session, you can get the system time, and in another session started after you wake up your machine check it as well. It should be close to the amount of time that your machine was asleep for.

For example:

On the left is the session that got slept, on the right is a session started after waking up the machine.

I'd love to dig down to the actual system calls and figure out why this is happening. Maybe it's the Erlang VM caching in some expected way? I'm not actually sure if it's system specific or if this is expected behavior. The Erlang call underlying System.system_time is :erlang.system_time which is documented to give you the Erlang view of the OS time. It's stated that this may not match the OS view of the time.

At any rate, the issue of failing nbf claims would be fixed by swapping System.system_time(:second) with :os.system_time(:second) in lib/verify/claims.ex. That is, unless I've misunderstood the nature of the verification and this is expected behavior.

[whossname]

You are probably right, but I will need to think about this more. I wrote the code you are referencing about 4 years ago when I was pretty new to Elixir, and I haven't really thought about it since then.

The documentation you sent says:

it is not uncommon that OS monotonic time stops if the system is suspended

Which is a bit confusing. Your observations seem to indicate the problem is the other way around?

The other issue is that this code is mostly targeted at production web servers, so we need to be confident that this change is better for that use case.

For example, is os time more correct in a Docker container?