pub enum LeapMode {
Slew,
Step,
Ignore,
}Expand description
What to do about a leap second the upstream source has announced.
A leap second is the one correction a time daemon can see coming. The server sets the leap indicator during the UTC day it happens, and at midnight the second is inserted or removed — every client sees a one-second step at the same instant.
Handling it is not optional in the way it looks. Unhandled, the step arrives
as an ordinary offset and is corrected like any other, which takes about
twelve seconds at the slew ceiling and leaves the clock a whole second wrong
meanwhile. Worse, and this is the case that matters: with max_change_s set
below one second the guard REFUSES it, and since every node in a fleet sees
the same leap at the same moment, every node exhausts its allowance and exits
together. A safety limit turning into a synchronised outage on a date known
years in advance is not a hypothetical failure mode.
Variants§
Slew
Slew the second in like any other offset, but exempt from the maximum-change guard because it is expected, bounded and announced.
Step
Step it, which is what a machine that cannot tolerate a slow second wants — and what most operating systems do natively.
Ignore
Take no special action. The step is then an ordinary offset, and the maximum-change guard applies to it like anything else.