Skip to content

Product Change Requests

Product Change Requests provide a controlled way to modify operations, add operations, modify product metadata, delete products, or restore products. All changes require approval before they take effect.

Why Change Requests?

Products define critical signing and PKI operations. Direct modifications could disrupt active workflows. The change request system ensures:

  • Changes are reviewed and approved before being applied
  • An audit trail of all modifications is maintained
  • Protection against accidental or unauthorized changes

Change Types

Modify Operation

Allows modifying the settings of an existing product operation. When creating a modify request:

  1. Select the target product
  2. Select the operation to modify
  3. Update the desired settings (approval rules, security groups, etc.)
  4. Submit for approval

Note

Only products in an active state are available for operation modification.

Tip

When modifying an operation via a change request, you can update the security group assignments to change who has access to the operation.

Add Operation

Adds a new operation to an existing product. The operation creates the key material it needs. When creating an add-operation request:

  1. Select the target product
  2. Select the operation type to add
  3. Provide the operation settings, including a token for the new operation
  4. Submit for approval

Only the following operation types can be added, and each requires a token (none requires a profile):

  • DigestSigning
  • SignUBoot
  • SignKernel
  • OP-TEESigning
  • SignMcuBoot
  • EncryptImageWithAES

Modify Product Metadata

Modifies the product's metadata. When creating a modify-metadata request:

  1. Select the target product
  2. Update the desired metadata fields
  3. Submit for approval

The following fields can be modified:

  • Name — the product name. The new name must be unique; the system verifies uniqueness when the change is applied.
  • Description — the product description.
  • Type — the product type.
  • Enabled — whether the product is enabled. Currently always enabled; reserved for future use.

Set Product To Be Deleted

Marks a product for deletion by changing its state to To Be Deleted.

  • Products in Ready, InProcess, Rejected, or Failed state can be selected
  • The product is not immediately deleted — it is marked for deletion
  • A separate delete action can permanently remove products in To Be Deleted state

Warning

Deleting a product is irreversible. Ensure the product is no longer needed before proceeding.

Set Product To Ready

Restores a product to Ready state from To Be Deleted state.

  • Only products currently in To Be Deleted state are shown
  • This effectively cancels a pending deletion

Approval Flow

  1. Create — User creates a change request and submits it for approval
  2. Review — An approver reviews the requested changes
  3. Approve/Reject — The approver can approve or reject the request
  4. Applied — Approved changes are automatically applied

Fields

Field Description
Name A descriptive name for the change request
Description Optional details about why the change is needed
Change Type The type of change (Modify Operation, Add Operation, Modify Product Metadata, Set to Be Deleted, Set to Ready)
Product The target product
Operation The target operation (only for Modify Operation type)

For the full product documentation, see the Product Guide.