Product release PIC
The Product Release PIC prepares, governs, and oversees secure release-signing workflows for production software, firmware, containers, and related release artifacts. Users in this workflow validate signing capacity, authorized access, release windows, and recovery readiness so release signing remains secure, repeatable, auditable, and resilient at the required volume.
They ensure only approved identities, teams, releases, keys, certificates, signing environments, and workflows can produce trusted software artifacts while coordinating release execution with development, build/DevOps engineering, security, and compliance stakeholders.
Using Software Trust Manager, a Product Release PIC can:
Oversees release-scoped signing governance through projects, releases, teams, keypairs, and certificates.
Coordinate release readiness with developers, build engineers, and security teams.
Assign approved signers, teams, keypairs, certificates, and projects to releases.
Restrict signing by release window, signer, approval workflow, and signature limits.
Validate release execution through audit logs, signature logs, and release evidence.
Review approved and rejected signing activity before production release.
Coordinate CI/CD signing workflows where release processes extend beyond Software Trust Manager.
The Product Release PIC role typically needs the following Software Trust Manager permissions:
Category | Permission | Description | Notes |
|---|---|---|---|
User settings | Default | View own user profile and generate own API key and client authentication certificate in DigiCert ONE. | |
Projects | View project | View projects associated with release-signing workflows. | Needed to confirm the correct project is tied to the release. |
Releases | View release | View all releases in the account. | Required to review release scope, release windows, signing resources, and release status. |
Releases | Create/Edit release | Create or update releases, including release scope, release window, ownership, and assigned signing resources. | Needed if the PIC is responsible for configuring release governance. |
Teams | View team | View teams and assigned users or groups involved in release signing. | Helps validate signer access and separation of duties. |
Keypairs | View keypair | View approved keypairs assigned to release-signing workflows. | Needed to confirm production releases use approved signing keys. |
Certificates | View certificate | View certificates associated with approved signing keypairs. | Needed to validate certificate usage for production artifacts. |
Audit logs | View audit log | View audit and signature logs to verify signer, keypair, certificate, artifact, and workflow evidence | Required for release evidence, compliance review, and troubleshooting failed or rejected signing attempts. |
Signatures | Sign | Sign software with keypairs assigned to the user. | Required only if the Product Release PIC also performs signing |
Approval workflows | View approval status | Review approval history and signing-request status where approval workflows are used | Needed to confirm approvals were completed before release signing. |
The Product Release PIC persona typically needs permissions for Projects, Releases, Teams, audit logs, signature logs, release visibility, and signing governance controls.
Confirm the Product Release PIC has the required permissions for releases, projects, audit logs, and signing visibility.
Confirm approved keypairs, certificates, teams, and signing resources are available.
Identify release approval requirements and separation-of-duty policies.
Confirm CI/CD pipelines and signing integrations are operational.
Identify which release controls will be enforced through Software Trust Manager.
Releases provide governance controls around signing operations and help ensure only approved artifacts are released.
Sign in to DigiCert ONE.
Go to Releases > Releases.
Create a release or select an existing release.
Define release scope, release window, and ownership.
Assign approved projects, teams, keypairs, and certificates.
Only approved signing resources should be available for production releases.
Review approved keypairs and certificates.
Verify team access and signer authorization.
Map approved resources to the release.
Validate production and development separation.
Release controls help enforce governance and separation of duties.
Configure authorized signers.
Define release windows.
Configure signature limits where required.
Enable request and approval workflows when policy requires approval.
Coordinate with build engineers and DevOps engineers to ensure release artifacts are ready for signing.
Confirm build success.
Verify artifact availability.
Validate CI/CD readiness.
Confirm the release version and artifact integrity.
Approved artifacts can now be signed through authorized workflows.
Initiate signing through CI/CD integrations or SMCTL.
Verify successful signing operations.
Review failed or rejected signing attempts.
Confirm artifacts were signed with approved resources.
Auditability is a key responsibility of the Product Release PIC.
Review audit logs.
Review signature logs.
Validate approval history.
Capture release evidence for compliance and audit reviews.