Patch for all-1s valid_before cert

ssh-key/src/certificate.rs

@@ -463,7 +463,20 @@ impl Decode for Certificate {
             key_id: String::decode(reader)?,
             valid_principals: Vec::decode(reader)?,
             valid_after: UnixTime::decode(reader)?,
-            valid_before: UnixTime::decode(reader)?,
+            valid_before: {
+                // For OpenSSH certs, the "valid before" field can be set to `u64::MAX` to indicate that the certificate never expires (i.e. "forever").
+                let timestamp = u64::decode(reader)?;
+                match UnixTime::try_from(timestamp) {
+                    Ok(ut) => ut,
+                    Err(_) => {
+                        if timestamp == u64::MAX {
+                            UnixTime::forever()?
+                        } else {
+                            return Err(Error::Time);
+                        }
+                    }
+                }
+            },
             critical_options: OptionsMap::decode(reader)?,
             extensions: OptionsMap::decode(reader)?,
             reserved: Vec::decode(reader)?,

ssh-key/src/certificate/unix_time.rs

@@ -53,6 +53,20 @@ impl UnixTime {
         }
     }
 
+    #[cfg(not(feature = "std"))]
+    pub fn forever() -> Result<Self> {
+        Ok(Self { secs: u64::MAX })
+    }
+
+    #[cfg(feature = "std")]
+    pub fn forever() -> Result<Self> {
+        let secs = u64::MAX;
+        match UNIX_EPOCH.checked_add(Duration::from_secs(i64::MAX as u64)) {
+            Some(time) => Ok(Self { secs, time }),
+            None => Err(Error::Time),
+        }
+    }
+
     /// Get the current time as a Unix timestamp.
     #[cfg(feature = "std")]
     pub fn now() -> Result<Self> {