checkId: check.timestamp.timesync.tsa-skew plugin: stellaops.doctor.timestamping severity: warn tags: [timestamping, timesync, tsa, skew]

TSA Time Skew

This Stella Ops Doctor check measures the clock drift between the host running Stella Ops and each configured timestamping authority (TSA). It is aimed at platform operators: even when the local clock is healthy, a drifting TSA can stamp release evidence with times that fall out of order relative to other events, quietly eroding the temporal integrity of audit trails.

What It Checks

Checks time skew between the system clock and TSA genTime. The check:

For each active TSA provider, requests a timestamp token with a random hash.
Compares the TSA genTime against the local system clock, accounting for network round-trip time.
Fails if skew exceeds the critical threshold (default 30 seconds).
Warns if skew is elevated but below critical.

Why It Matters

Time skew between the system and TSA indicates that either the local clock or the TSA clock is drifting. This can produce timestamps that appear out of order relative to other events, undermining the temporal integrity of release evidence and audit trails.

Common Causes

Local system clock not synchronized with NTP
TSA provider clock drifting
High network latency distorting round-trip time estimation
Proxy or load balancer adding variable latency

# Verify system time sync
chronyc tracking

# Measure the TSA round-trip time (inline curl timing format)
curl -w "dns:%{time_namelookup}s connect:%{time_connect}s total:%{time_total}s\n" \
  -s -o /dev/null https://freetsa.org/tsr

Kubernetes / Helm

Verify node-level NTP synchronization. If a specific TSA consistently shows skew, switch to an alternative provider.

Verification

stella doctor run --check check.timestamp.timesync.tsa-skew

System Time Synchronization (check.timestamp.timesync.system) — checks system clock synchronization with NTP
Rekor Time Correlation (check.timestamp.timesync.rekor-correlation) — checks TST-Rekor time correlation