Level 1 and Level 2 key fixes reach the deploy CLI

This entry is for the record rather than for anything you need to do.

Over the past week we corrected how keys are handled for encrypted workloads. Level 1 keys never reach our servers, and Level 2 content opens only for people you authorise. Those changes were made in the portal, the control plane and the edge nodes, and they are live.

The deploy CLI and its Astro integration build workloads as well, and carried the same faults. A Level 2 site could be built with its key written into the page, and could be uploaded without registering the key that makes access control work — so the content was readable by anyone holding the link while nobody could be properly authorised. The tool now also strips a Level 2 key that was already present in a page handed to it, instead of merely declining to add one of its own.

There is nothing to update. The CLI has never been published, so no one is running a version with these faults. When it is published, it will include these fixes from the start.

We’re noting it here so the record is complete — the same corrections have now been made in every tool we maintain, not only in the parts already running in production.