4 files changed, 76 insertions, 1 deletions

diff --git a/system-profiles/openssh/known-hosts/ca-sign.gup b/system-profiles/openssh/known-hosts/ca-sign.gup
index f9aa3793..527a9763 100644
--- a/system-profiles/openssh/known-hosts/ca-sign.gup
+++ b/system-profiles/openssh/known-hosts/ca-sign.gup
@@ -8,4 +8,5 @@ principalsFile=${keyFile:h}/host-principals
 gup -u ${keyFile} ${principalsFile}
 gup -u expiration
 
-ssh-keygen -h -Us ../ca/ca.pub -I $(uuidgen) -z $(tai64dec) -V "-1d:$(cat expiration)" -n $(cat ${principalsFile}) -f $1 ${keyFile}
\ No newline at end of file
+ssh-keygen -h -Us ../ca/ca.pub -I $(uuidgen) -z $(tai64dec --no-ns) -V "-1d:$(cat expiration)" -n $(cat ${principalsFile}) -f $1 ${keyFile}
+sleep 1
diff --git a/tools/tai64dec/default.nix b/tools/tai64dec/default.nix
new file mode 100644
index 00000000..380c22bf
--- /dev/null
+++ b/tools/tai64dec/default.nix
@@ -0,0 +1,18 @@
+{ system, self, mach-nix, leapseconds, ... }:
+let
+  pkgs = self.legacyPackages.${system};
+in mach-nix.lib.${system}.buildPythonPackage {
+  pname = "tai64dec";
+  src = pkgs.lib.sourceByRegex ./. ["^setup\.py$" "^tai64dec(/[^/]+.*)?$"];
+  version = "0.0.0";
+  ignoreDataOutdated = true;
+
+  requirements = ''
+    leapseconddata
+  '';
+
+  postInstall = ''
+    wrapProgram $out/bin/tai64dec \
+      --set-default LEAPSECONDS_FILE ${leapseconds}
+  '';
+}
diff --git a/tools/tai64dec/setup.py b/tools/tai64dec/setup.py
new file mode 100644
index 00000000..d936796b
--- /dev/null
+++ b/tools/tai64dec/setup.py
@@ -0,0 +1,10 @@
+from setuptools import setup
+
+setup(name='tai64dec',
+      packages=['tai64dec'],
+      entry_points={
+          'console_scripts': [
+              'tai64dec=tai64dec.__main__:main'
+          ],
+      },
+)
diff --git a/tools/tai64dec/tai64dec/__main__.py b/tools/tai64dec/tai64dec/__main__.py
new file mode 100644
index 00000000..a8854523
--- /dev/null
+++ b/tools/tai64dec/tai64dec/__main__.py
@@ -0,0 +1,46 @@
+import sys, os
+
+import argparse
+
+from leapseconddata import LeapSecondData
+from math import ldexp
+from pathlib import Path
+from datetime import datetime, timezone
+import secrets
+
+
+class BooleanAction(argparse.Action):
+    def __init__(self, option_strings, dest, nargs=None, **kwargs):
+        super(BooleanAction, self).__init__(option_strings, dest, nargs=0, **kwargs)
+
+    def __call__(self, parser, namespace, values, option_string=None):
+        setattr(namespace, self.dest, False if option_string.startswith('--no') else True)
+
+
+def main():
+    parser = argparse.ArgumentParser(prog='tai64dec', formatter_class=argparse.ArgumentDefaultsHelpFormatter)
+    parser.add_argument('--random', '--no-random', action=BooleanAction, default=False)
+    parser.add_argument('--ns', '--no-ns', action=BooleanAction, default=True)
+    args = parser.parse_args()
+
+
+    leapsecond_data = LeapSecondData.from_file(Path(os.getenv('LEAPSECONDS_FILE')))
+
+    now = datetime.now(tz=timezone.utc)
+
+    tai_dt = leapsecond_data.to_tai(now)
+    seconds = int(tai_dt.timestamp())
+    seconds += int(ldexp(1, 62))
+    out = seconds
+
+    if args.ns:
+        nanoseconds = int((tai_dt.timestamp() - seconds) / 1e-9)
+        out = out << 32 | nanoseconds
+
+    if args.random:
+        out = out << 24 | int.from_bytes(secrets.token_bytes(3), byteorder='little', signed=False)
+
+    print('{:d}'.format(out), file=sys.stdout)
+
+if __name__ == '__main__':
+    sys.exit(main())