Fix NTS time sync to properly wait for TLS handshake

chronyc waitsync with multiple retries completes too quickly (~3s) for
NTS-KE TLS handshake. Replace with a loop that retries every 1s for up
to 30s in secure_time mode. Revert dstack-prepare.sh to simple makestep
since secure_time sync is handled in dstack-util.

Author: kvinwang

basefiles/dstack-prepare.sh

@@ -95,14 +95,9 @@ mount_overlay /bin $OVERLAY_TMP
 mount_overlay /home $OVERLAY_TMP
 
 # Make sure the system time is synchronized
-log "Waiting for time sync..."
-for i in $(seq 1 30); do
-	if chronyc waitsync 1 0.2 0 0 2>/dev/null; then
-		log "Time synchronized"
-		break
-	fi
-	sleep 1
-done || log "Warning: time sync timed out"
+log "Syncing system time..."
+# Let the chronyd correct the system time immediately
+chronyc makestep
 
 if ! [[ -e /dev/tdx_guest ]]; then
 	modprobe tdx-guest

dstack-util/src/system_setup.rs

@@ -708,10 +708,18 @@ pub async fn cmd_sys_setup(args: SetupArgs) -> Result<()> {
 async fn do_sys_setup(stage0: Stage0<'_>) -> Result<()> {
     if stage0.shared.app_compose.secure_time {
         info!("Waiting for the system time to be synchronized");
-        cmd! {
-            chronyc waitsync 20 0.1;
+        let mut synced = false;
+        for i in 1..=30 {
+            if cmd! { chronyc waitsync 1 0.2; }.is_ok() {
+                synced = true;
+                break;
+            }
+            info!("Time sync attempt {i}/30 failed, retrying...");
+            tokio::time::sleep(Duration::from_secs(1)).await;
+        }
+        if !synced {
+            bail!("Failed to sync system time after 30 attempts");
         }
-        .context("Failed to sync system time")?;
     } else {
         info!("System time will be synchronized by chronyd in background");
     }