provisioning failing due to bad RTC

[rukai]

Hi, I dont understand the problem well, but it seems if I dont manually set the RTC time, then provisioning will fail.
My project initialy worked but after a while (no code changes) provisioning my device started failing and I was very confused.
I got this log which was suspicious:

[2026-05-23T05:38:16Z DEBUG rs_matter::dm::clusters::decl::operational_credentials] Endpt(0x00)::Cluster::OperationalCredentials(0x003e)::Cmd::AddNOC(0x06)::Invoke::NOCResponse::statusCode -> InvalidNOC +

Eventually I was able to solve the problem by adding this to my rs-matter-stack application:

        const MATTER_EPOCH_US: u64 = 946_684_800 * 1_000_000;
        let now_matter_us = std::time::SystemTime::now()
            .duration_since(std::time::UNIX_EPOCH)
            .map(|d| d.as_micros() as u64)
            .unwrap_or(0)
            .saturating_sub(MATTER_EPOCH_US);
        stack.matter().with_rtc(|rtc| {
            rtc.set_utc_time(
                now_matter_us,
                GranularityEnum::SecondsGranularity,
                TimeSourceEnum::Unknown,
                &(),
            )
        });

But I think that we should be able to provision correctly without providing rtc time, otherwise why is it an option to skip it?
Maybe we need a special check in the NOC validation to skip a check if were relying on the RS_MATTER_BUILD_MATTER_SECS build time timestamp.

possibly introduced by #449 but I only started using this project earlier today.

[ivmarkov]

@rukai

(CC @snabb as he is pulling rs-matter main often.)

Yep - I started reproducing this, thanks for reporting!

There is a sneaky bug in there indeed. When the device does not advertise the TimeSync cluster support, we now STILL do check nevertheless the validity of the certificates passed to use by the controller, by comparing those with the rs-matter build-time timestamp.

That's OK, as long as we don't compare the build-time timestamp with the "valid since" lower bound of the certificate validity period, because it could be - and that's perfectly fine - that the certificate was generated after rs-matter last build time.

So we can do <build_time> <= valid_until but we should not do <build_time> >= valid_since, which is the bug.
To be fixed shortly.

This was not caught up by the integration tests, as they do test with TimeSync enabled, and therefore have reliable wall clock.

[ivmarkov]

Fixed by #461