Commit e87770e391 for strongswan.org

commit e87770e391409aec06c08d2446e412da763c94d8
Author: Tobias Brunner <tobias@strongswan.org>
Date:   Thu Oct 15 12:16:44 2026 +0200

    pgp: Use platform-dependent value for keys that never expire

    This fixes a year-2038 issue on 64-bit platforms where keys without
    expiration time would be considered expired.

    The value on 64-bit platforms is deliberately chosen way below the
    actual maximum so it can still be printed reasonably.

    Also note that the PGP key format uses 4-byte unsigned integers as
    timestamps, so keys can't have a creation time after Feb 2106.

    References strongswan/strongswan#3160

diff --git a/src/libstrongswan/credentials/certificates/certificate_printer.c b/src/libstrongswan/credentials/certificates/certificate_printer.c
index 7fd56338b5..f520fa860e 100644
--- a/src/libstrongswan/credentials/certificates/certificate_printer.c
+++ b/src/libstrongswan/credentials/certificates/certificate_printer.c
@@ -642,7 +642,7 @@ METHOD(certificate_printer_t, print, void,
 		{
 			fprintf(f, "  created:   %T\n", &notBefore, this->utc);
 			fprintf(f, "  until:     %T%s\n", &notAfter, this->utc,
-				(notAfter == TIME_32_BIT_SIGNED_MAX) ?" expires never" : "");
+				(notAfter == TIME_NEVER) ?" expires never" : "");
 		}
 		else
 		{
diff --git a/src/libstrongswan/plugins/pgp/pgp_cert.c b/src/libstrongswan/plugins/pgp/pgp_cert.c
index 901df398da..7275b1070c 100644
--- a/src/libstrongswan/plugins/pgp/pgp_cert.c
+++ b/src/libstrongswan/plugins/pgp/pgp_cert.c
@@ -167,8 +167,7 @@ METHOD(certificate_t, get_validity, bool,
 	}
 	if (!expiry)
 	{
-		/* Jan 19 03:14:07 UTC 2038 */
-		until = TIME_32_BIT_SIGNED_MAX;
+		until = TIME_NEVER;
 	}
 	else
 	{
diff --git a/src/libstrongswan/utils/utils/time.h b/src/libstrongswan/utils/utils/time.h
index 471fcaf3c2..6572ea3607 100644
--- a/src/libstrongswan/utils/utils/time.h
+++ b/src/libstrongswan/utils/utils/time.h
@@ -33,6 +33,14 @@
  */
 #define TIME_32_BIT_SIGNED_MAX	0x7fffffff

+/**
+ * Time that is used to e.g. represent a never expiring PGP key.  Either
+ * Jan 19 03:14:07 UTC 2038 or Dec 31 23:59:59 UTC 9999 (just because it can
+ * reasonably be represented when printing).
+ */
+#define TIME_NEVER (sizeof(time_t) == 4 ? TIME_32_BIT_SIGNED_MAX \
+										: (time_t)253402300799ULL)
+
 /**
  * The clock that should be used for time_monotonic() and conditional variables
  */