Repo Deployment Keys Rotated

​

More Info:

​

Risk Level

​

Address

​

Compliance Standards

​

Remediation

​

Using Console

1. Login to your GitHub account and navigate to the repository where the deployment keys have been rotated.
2. Click on the “Settings” tab on the right-hand side of the repository page.
3. In the left-hand sidebar, click on the “Deploy Keys” option.
4. Locate the deployment key that needs to be rotated and click on the “Delete” button next to it.
5. Confirm the deletion by clicking on the “Delete” button in the pop-up window.
6. Now, create a new deployment key by clicking on the “Add deploy key” button.
7. Give a suitable title to the deployment key and paste the public key in the “Key” field.
8. Check the “Allow write access” option if you want the key to have write access to the repository.
9. Click on the “Add key” button to add the new deployment key to the repository.
10. Finally, update the deployment key in your deployment pipeline or any other relevant services that use the key.

​

Using CLI

1. Open a terminal or command prompt and ensure that you have the GitHub CLI installed on your system. If not, you can download it from the official website.
2. Log in to your GitHub account using the following command:

gh auth login

3. Select the appropriate authentication method and follow the prompts to complete the login process.
4. Navigate to the local copy of the repository in question using the cd command.
5. Run the following command to remove the existing deployment keys:

gh ssh-key remove <key-name>

6. Generate a new deployment key using the following command:

gh ssh-key add <key-name> --title "<title>" --public-key "<path-to-public-key>"

7. Add the new deployment key to the repository using the following command:

gh repo create-deploy-key <key-name> --read-write

8. Verify that the new deployment key is added to the repository by running the following command:

gh repo view --keys

9. Finally, update any relevant documentation or scripts to reflect the changes made.

​

Using Python

1. Generate a new deployment key for the repository using the pygithub library.

from github import Github

# Authenticate to GitHub using a personal access token
g = Github("YOUR_ACCESS_TOKEN")

# Get the repository object
repo = g.get_repo("OWNER/REPO_NAME")

# Generate a new deployment key
new_key = repo.create_key("New Deployment Key", "YOUR_PUBLIC_KEY")

2. Remove the old deployment key from the repository using the pygithub library.

# Get the old deployment key object
old_key = repo.get_key("OLD_KEY_ID")

# Delete the old deployment key
old_key.delete()

3. Update the deployment key in your deployment environment, such as your CI/CD pipeline, with the new key.

# Update the deployment key in your deployment environment
update_deployment_key(new_key)

​

Additional Reading:

• https://developer.github.com/v3/guides/managing-deploy-keys