hsts: cap max-age to two years

[bagder]

And ignore problems saving individual HSTS entries - a single entry problem should not affect storing other entries.

Added test 1862 to verify.

[Copilot]

🟡 Changes recommended

The new date-conversion failure path lacks regression coverage.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

Caps HSTS max-age at two years and allows file serialization to continue when an entry’s date conversion fails.

Changes:

• Caps parsed HSTS lifetimes at 730 days.
• Skips entries with unconvertible expiry dates.
• Adds an integration test for extreme max-age.

File summaries

File	Description
lib/hsts.c	Implements lifetime capping and nonfatal serialization.
tests/data/test1862	Tests extreme max-age handling.
tests/data/Makefile.am	Registers test 1862.

Review details

• Files reviewed: 3/3 changed files
• Comments generated: 2
• Review effort level: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[testclutch]

Analysis of PR #22878 at b2fed2ba:

Test ../../tests/http/test_21_resolve.py::TestResolve::test_21_07_dnsd_a[DoH] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Test ../../tests/http/test_21_resolve.py::TestResolve::test_21_08_dnsd_aaaa[DoH] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Test ../../tests/http/test_21_resolve.py::TestResolve::test_21_09_dnsd_a_delay[DoH] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Test ../../tests/http/test_21_resolve.py::TestResolve::test_21_10_dnsd_aaaa_delay[DoH] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Test ../../tests/http/test_21_resolve.py::TestResolve::test_21_13_dnsd_nxdomain_cached[DoH] failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 2 different CI jobs (the link just goes to one of them).

Test 440 failed, which has NOT been flaky recently, so there could be a real issue in this PR. Note that this test has failed in 12 different CI jobs (the link just goes to one of them).

Generated by Testclutch