Skip to content

Set final cutoff date for projects using SSH keys with write access #12536

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 3 commits into from
Nov 3, 2025
+16 −7
Merged

Set final cutoff date for projects using SSH keys with write access #12536

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1744da8
Set final cutoff date for projects using SSH keys with write access
stsewd Oct 29, 2025
11a07a1
Use timezone-aware datetime for SSH key cutoff date comparison (#12538)
Copilot Oct 29, 2025
e111e42
Format
stsewd Oct 29, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 14 additions & 5 deletions readthedocs/doc_builder/director.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -8,6 +8,7 @@
* fetching instructions etc.
"""

import datetime
import os
import tarfile

Expand Down Expand Up @@ -216,12 +217,20 @@ def checkout(self):
self.data.api_client.project(self.data.project.pk).patch(
{"has_ssh_key_with_write_access": has_ssh_key_with_write_access}
)

now = datetime.datetime.now(tz=datetime.timezone.utc)
hard_failure = now >= datetime.datetime(
2025, 12, 1, 0, 0, 0, tzinfo=datetime.timezone.utc
)
if has_ssh_key_with_write_access:
self.attach_notification(
attached_to=f"project/{self.data.project.pk}",
message_id=MESSAGE_PROJECT_SSH_KEY_WITH_WRITE_ACCESS,
dismissable=True,
)
if hard_failure and settings.RTD_ENFORCE_BROWNOUTS_FOR_DEPRECATIONS:
Copy link
Member

@humitos humitos Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

settings.RTD_ENFORCE_BROWNOUTS_FOR_DEPRECATIONS I assume this setting will True only on commercial, right?

Don't we need to add it here as False?

Copy link
Member Author

@stsewd stsewd Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

That setting is True on production, .org and .com. https://github.com/readthedocs/readthedocs-ops/blob/98917ade4ccd68ca31fec369ea0764df83c1cfe6/salt/base/readthedocs/settings/base.py#L83

Copy link
Member

@humitos humitos Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we are not using SSH keys on .org, so it should have no effect there; right?

Copy link
Member Author

@stsewd stsewd Nov 3, 2025

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Nope, we already check for that just above

readthedocs.org/readthedocs/doc_builder/director.py

Line 214 in e111e42

if settings.ALLOW_PRIVATE_REPOS:

raise BuildUserError(BuildUserError.SSH_KEY_WITH_WRITE_ACCESS)
else:
self.attach_notification(
attached_to=f"project/{self.data.project.pk}",
message_id=MESSAGE_PROJECT_SSH_KEY_WITH_WRITE_ACCESS,
dismissable=True,
)

identifier = self.data.build_commit or self.data.version.identifier
log.info("Checking out.", identifier=identifier)
Expand Down
2 changes: 1 addition & 1 deletion readthedocs/notifications/messages.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -226,7 +226,7 @@ def get_rendered_body(self):
"""
This build has failed because the current deploy key on the repository was created with write permission.
For protection against abuse we've restricted use of these deploy keys.
A read-only deploy key will need to be set up <b>before July 31, 2025</b> to continue building this project.
A read-only deploy key will need to be set up <b>before December 1st, 2025</b> to continue building this project.
Read more about this in our <a href="https://about.readthedocs.com/blog/2025/07/ssh-keys-with-write-access/">blog post</a>.
"""
).strip(),
Expand Down
2 changes: 1 addition & 1 deletion readthedocs/projects/notifications.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -186,7 +186,7 @@
"""
This project has a deploy key with write access to the repository.
For protection against abuse we've restricted use of these deploy keys.
A read-only deploy key will need to be set up <b>before July 31, 2025</b> to continue building this project.
A read-only deploy key will need to be set up <b>before December 1st, 2025</b> to continue building this project.
Read more about this in our <a href="https://about.readthedocs.com/blog/2025/07/ssh-keys-with-write-access/">blog post</a>.
"""
).strip(),
Expand Down