vania-janet/multiturn-rag-retrieval-data huggingface dataset:
./kms-encrypt-nonce -key $KEY_MATERIAL -nonce $NONCE -alg "CBC" > EncryptedValues.json
Use the IBM Key Protect CLI

ibmcloud kp import-token nonce-encrypt --key "$KEY_MATERIAL" --nonce "$NONCE" --cbc -o json > EncryptedValues.json



3. Optional: Inspect the contents of the JSON file.

jq '.' EncryptedValues.json

The output displays the values that you'll need to provide for the next step. The following snippet shows example output with truncated values.

{
"encryptedNonce": "DVy/Dbk37X8gSVwRA5U6vrHdWQy8T2ej+riIVw==",
"iv": "puQrzDX7gU1TcTTx"
}

The encryptedNonce value represents the original nonce that is wrapped (or encrypted) by th key that you generated using OpenSSL. The iv value is the initialization vector (IV) that is created by the AES-CBC algorithm, and it's required later so that Hyper Protect Crypto Servicescan successfully decrypt the nonce.







 Step 6: Encrypt the created encryption key 

Next, use the public key that was distributed by Hyper Protect Crypto Services in [step 2](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-tutorial-import-keystutorial-import-retrieve-token) to encrypt the encryption key that you created using OpenSSL.



* Encrypt the created encryption key with the API, and assign the key to the environment variable:
sysdig-url https://secure.sysdig.com (property is not set) The URL of the Sysdig instance to be used for the scan. This value needs to be provided if any other Sysdig instance is being used. 
 sysdig-inline-scanner-image quay.io/sysdig/secure-inline-scan:2 (property is not set) Enter the Sysdig inline scanner image to be used for the scan. 
 cr-ibmcloud-api-key Overrides ibmcloud-api-key if provided, for pulling the image from container registry for the Sysdig scan. 







 Evidence and attachments 

The created evidence is based on the values in table 3. The DevSecOps pipeline uploads evidence to the locker and includes the evidence in the evidence summary for change requests.



Table 3. Evidence fields and values

 Field Value 

 tool type sysdig 
 evidence type com.ibm.code_vulnerability_scan 
 asset type artifact 
 attachments scan report generated by the sysdig inline scanner in JSON 
 attachments processed scan report containing an array of vulnerabilities filtering out the ignored vulnerailities - in JSON 







 Debugging and logging 



Table 4. Debug parameters

 Parameter name Default value Description 

 pipeline-debug 0 Debug flag 0 off; 1 on 







 Accessing your scan results 

You can access your scan results by using any of the following methods:



* Viewing them on the Sysdig dashboard.
* Using the [DevSecOps CLI](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-cli) to download your scan results from the evidence locker by using the information that is printed in the stage log. For more information, see the following resources:



* [cocoa locker evidence get](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-clilocker-evidence-get)
Updates need to be requested through a support ticket.







 Penetration and Vulnerability Testing 



* IBM’s Product Transformation Center (PTC) conducts penetration testing on IBM TRIRIGA Application Suite Managed Service offering annually.
* IBM performs external and internal vulnerability scanning and subsequent remediation in all IBM TRIRIGA Application Suite Managed Service environments on a quarterly basis per IBM IT Security Standards (ITSS). This includes Operating System, Middleware, Application and TCP/IP vulnerability scanning.
* Vulnerabilities are assigned individual vulnerability ratings and exploitation categories (Critical, High, Medium or Low). These ratings are used to determine an IBM mandated time requirement to remediate and resolve the vulnerability.
* Vulnerability scanning results and logs are considered IBM Confidential Information and are not disclosed to customers or prospects.



SQL Injection - please see FAQ link below regarding how TRIRIGA protects against SQL injection: [https://www.ibm.com/support/pages/node/268401](https://www.ibm.com/support/pages/node/268401)





 Security Services 

The IBM TRIRIGA Application Suite Managed Service team provides the following security and system access services. These services are included as part of the IBM TRIRIGA Application Suite Managed Service:



* Setup of SSL certificates and DNS registration. This is standard by default and allows for secure browser based HTTPS (encrypted) access IBM TRIRIGA Application Suite Managed Service end users.
* Setup of IPsec Virtual Private Network (VPN) between client locations and IBM Cloud data center(s). VPN setup is optional, and is used to provide the following:



* Direct read-only access to IBM on Cloud databases
* LDAP authentication
* Other uses are not currently available using VPN.



* Setup and configuration of SSO including OIDC (default), SAML and LDAP user authentication for IBM TRIRIGA Application Suite applications. SSO configuration is optional but is included as part of the IBM on Cloud subscription.







 Compliance - IBM Cloud (Infrastructure) 



* All IBM TRIRIGA Application Suite Managed Service customer environments are managed to IBM IT Security Standards (ITSS) defined by IBM’s Chief Information Security Officer (CISO). This includes vulnerability scanning and subsequent remediation
In the script field, enter a script or reference scripts that are stored in your project’s source control.<br><br>Working directory: The directory where the test script is run.<br><br>Enable test report: Not used.<br><br>Enable code coverage report: Not used. 
 Vulnerability Advisor Runs a compliance and vulnerability check against the specified image, and displays the results. If any issues are found, this stage fails. Pipeline image version: Runs in a container by using a built-in docker image that provides various built-in commands. To adopt newer versions of those commands, use a newer image version.<br><br>API key: The IBM Cloud API key to use to provide permissions to account resources.<br><br>Container Registry namespace: The namespace where your built image is stored.<br><br>Docker image name: The name of the Docker image to run the job with. To make sure that your jobs run in a clean context, run them in Docker containers.<br><br>Docker image tag: A tag for the Docker image that is displayed in the IBM Cloud Container Registry.<br><br>Test script: Test command to run whenever the job runs. In the script field, enter a script or reference scripts that are stored in your project’s source control.<br><br>Working directory: The directory where the test script is run.<br><br>Enable test report: Not used.<br><br>Enable code coverage report: Not used. 
 Sauce Labs Runs JavaScript, Node, or Java™ tests by using Sauce Labs. Pipeline image version: Runs in a container by using a built-in docker image that provides various built-in commands. To adopt newer versions of those commands, use a newer image version.<br><br>Service instance: Select a configuration instance or create one. 







 Deprecated job types 

Several job types, such as the IBM Globalization Pipeline Build job, the Space Shell Test job, and the DevOps Insights Gate Test job are deprecated. Although these job types are deprecated, you might still be able to load them in the UI, with an indicator that the job type is deprecated.
For example, the BOM captures the list of base images that are used in the build, the list of packages from the base images, and the list of app packages that are installed over the base image. The BOM acts as a ground truth for the analytic results and can potentially be used to enforce policy gates. Uses the Code Risk Analyzer tool. 
 Repository compliance checking Checks that branch protection settings are correct. For example, the master/main branch should always restrict the force push. For more information, see [Configuring your Git Repos and Issue Tracking repository](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-config-github). 
 Mend Unified Agent vulnerability scan The [Mend Unified Agent scanning tool](https://docs.mend.io/bundle/unified_agent/page/overview_of_the_unified_agent.html) scans app repos' open source components for vulnerable libraries and source files. For more information, see [Configuring Mend Unified Agent scans](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-mend-scans). 



These scripts are run on all of the app repos that the pipeline is aware of. To add repos to these scans, use the [pipelinectl](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-pipelinectl) interface that is provided in your setup stage.

For more information about the expected output from user script stages, see [Custom scripts](https://cloud.ibm.com/docs/devsecops?topic=devsecops-custom-scripts).





 Build 

In the Build stage, you can build your own artifacts. Although the pipeline provides some default features for Docker image type artifacts, you can build any type of artifact in this stage.

Use the environment variables from the Pipeline UI to provide credentials, secrets, and parameters for your build. You can access these environment variables in this stage, and in all custom stages.
Key Management Service provider 207 212 Image updated for [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809). 
 Kubernetes v1.13.9 v1.13.10 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.13.10). Update resolves [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809).
Key Management Service provider 207 212 Image updated for [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809). 
 Kubernetes v1.14.5 v1.14.6 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.14.6). Update resolves [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809).
View the security.yaml file in the [GitHub repository](https://github.com/IBM/registry-va-workflow), and read about customizing [policies](https://cloud.ibm.com/docs/Registry?topic=Registry-security_enforce_portierispolicies_portieris) to understand this file's contents. In short, this policy requires all images in your namespace to have no issues reported by Vulnerability Advisor.
3. Update the following line in the security.yaml file by replacing <my_namespace> with your namespace:

- name: us.icr.io/<my_namespace>/
4. Apply the custom policies:

kubectl apply -f security.yaml
5. To update hello-world.yaml so that it references your vulnerable image, change the tag from 1 to 2 as shown here:

image: us.icr.io/<my_namespace>/hello-world:2
6. Try to patch the existing deployment by running the following command:

kubectl apply -f hello-world.yaml

You see the following error message:

Deny "us.icr.io/<my_namespace>/hello-world:2", the Vulnerability Advisor image scan assessment
found issues with the container image that are not exempted. Refer to your image vulnerability
report for more details by using the ibmcloud cr va command.

The Vulnerability Advisor verdict is subject to any [exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-va_index&interface=uiva_managing_policy) that you create. If you want to use an image that Vulnerability Advisor considers vulnerable, you can exempt one, or more vulnerabilities so that Vulnerability Advisor doesn't consider them in its verdict.
Key Management Service provider 207 212 Image updated for [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809). 
 Kubernetes v1.15.2 v1.15.3 See the [Kubernetes release notes](https://github.com/kubernetes/kubernetes/releases/tag/v1.15.3). Update resolves [CVE-2019-9512](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9512) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), [CVE-2019-9514](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9514) (see [IBM security bulletin](https://www.ibm.com/support/pages/security-bulletin-ibm-cloud-kubernetes-service-affected-kubernetes-security-vulnerabilities-cve-2019-9512-cve-2019-9514)), and [CVE-2019-14809](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-14809).
For more information about how the "seed" input can be provided through the env section, see [The env section](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_env). It is mandatory to provide both the seeds for encryption. Encryption fails if only one of the seeds is provided instance shuts down.

You can add a higher level of encryption protection and control to your data at rest by integrating with Hyper Protect Crypto Services. Starting from ibm-hyper-protect-container-runtime-1-0-s390x-11, you can use Hyper Protect Crypto Services to generate a random value as the third seed and wrap it with your root key. The LUKS passphrase is generated by using three seeds - the seed in the metadata partition and the two seeds from the contract. For more information, See [Securing your data](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-mng-data).

The following snippet is an example for the volumes section:

volumes:
test:
filesystem: ext4
mount: /mnt/data
seed: workload phrase

Starting from the HPCR image version ibm-hyper-protect-container-runtime-1-0-s390x-9, for new Hyper Protect Virtual Servers for VPC instances, the data volume is partitioned into two parts. The first partition (100Mib) is reserved for internal metadata; the second partition remains as the data volume for workload. Only new volumes are partitioned, and you can't use the partitioned volume with an older version of the HPCR image. Provisioning with an existing encrypted volume also works. The difference is that the existing volume does not get partitioned, and you can also go back to an older image with this volume.







 The env section 

The env section is also one of the most important sections in a contract. The env section of a contract deals with information that is specific to the cloud environment and is not known to the workload persona.
Component Previous Current Description 

 Cluster health image v1.3.5 v1.3.6 Updated Go to version 1.17.9 and also updated the dependencies. Update registry base image version to 103. 
 Gateway-enabled cluster controller 1669 1680 Updated metadata for a rotated key. 
 GPU device plug-in and installer 13677d2 9485e14 Updated Drivers to 470.103.01. Updated metadata for a rotated key. 
 IBM Calico extension 950 954 Updated to latest UBI-minimal image to resolve [CVE-2021-3999](https://nvd.nist.gov/vuln/detail/CVE-2021-3999), [CVE-2022-23218](https://nvd.nist.gov/vuln/detail/CVE-2022-23218), [CVE-2022-23219](https://nvd.nist.gov/vuln/detail/CVE-2022-23219), [CVE-2022-23308](https://nvd.nist.gov/vuln/detail/CVE-2022-23308), [CVE-2021-23177](https://nvd.nist.gov/vuln/detail/CVE-2021-23177), and [CVE-2021-31566](https://nvd.nist.gov/vuln/detail/CVE-2021-31566). 
 IBM Cloud Controller Manager v1.20.15-6 v1.20.15-9 Updated vpcctl to the 3003 binary image. 
 IBM Cloud File Storage for Classic plug-in and monitor 407 408 Fixed [CVE-2022-0778](https://nvd.nist.gov/vuln/detail/CVE-2022-0778). 
 IBM Cloud RBAC Operator 6c43ef1 8c8c82b Updated Go to version 1.17.8 
 Key Management Service provider v2.5.3 v2.5.4 Moved to a different base image, version 102, to reduce CVE footprint.
[Configure a notification channel](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-notificationsnotifications_create) You can configure a notification channel to get notified about events, anomalies, or security incidents that require attention. 
 [Scan container images](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-scan_kube) You can scan container images for vulnerabilities, and other violations. 
 [Configure an image scanning alert](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-alert-config) You can set up a runtime Scanning Alert to detect if an image is impacted by newly discovered vulnerabilities. You can scan a repository that hosts container images for vulnerabilities, secrets, and license violations. Then, you can configure an alert on the repository to receive notifications on issues that need your attention. 
 [Configure a rule](https://cloud.ibm.com/docs/workload-protection?topic=workload-protection-manage_rules) You can create a Detection Rule to detect and respond to anomalous runtime activity. <br>You can create a rule to specify which image versions can be used. 
 [Define a policy](https://cloud.ibm.com/docs/docs/workload-protection?topic=workload-protection-manage_policies) You can configure a policy on a resource and define what to do when 1 or more rules that are included in the policy are noncompliant. <br>Secure includes a number of pre-defined policies that you can use.
HA proxy db4e6d 9b2dca Image update for [CVE-2020-1971](https://nvd.nist.gov/vuln/detail/CVE-2020-1971) and [CVE-2020-24659](https://nvd.nist.gov/vuln/detail/CVE-2020-24659). 
 Red Hat OpenShift node 3.11.318 3.11.346 See the [Red Hat OpenShift release notes](https://docs.openshift.com/container-platform/3.11/release_notes/ocp_3_11_release_notes.htmlocp-3-11-346). 
 RHEL 7 Packages 3.10.0-1160.6.1.el7 3.10.0-1160.11.1.el7 Updated worker node image with kernel and package updates for: [CVE-2019-18282](https://nvd.nist.gov/vuln/detail/CVE-2019-18282), [CVE-2020-10769](https://nvd.nist.gov/vuln/detail/CVE-2020-10769), [CVE-2020-14314](https://nvd.nist.gov/vuln/detail/CVE-2020-14314), [CVE-2020-14385](https://nvd.nist.gov/vuln/detail/CVE-2020-14385), [CVE-2020-24394](https://nvd.nist.gov/vuln/detail/CVE-2020-24394), [CVE-2020-25212](https://nvd.nist.gov/vuln/detail/CVE-2020-25212), [CVE-2020-25643](https://nvd.nist.gov/vuln/detail/CVE-2020-25643), and [CVE-2020-1971](https://nvd.nist.gov/vuln/detail/CVE-2020-1971).
* UI
* CLI
* API
* Terraform







 Upgrading weak cipher suites on a VPN gateway 

To maintain security best practices and minimize security vulnerabilities, VPN for VPC now supports an enhanced cipher suite, providing new algorithms and removing weak algorithms to meet customer compliance requirements. VPN gateways that use weak ciphers put networks and data at risk and compromise compliance, requiring an upgrade to the secure cipher suite.

As of 20 September 2022, the following VPN IKE and IPsec ciphers are deprecated:



* Authentication algorithms md5 and sha1
* Encryption algorithm triple_des
* Diffie-Hellman groups 2 and 5



Effective 17 January 2023, these ciphers are no longer supported in the UI. You must transition to more secure ciphers as soon as possible; otherwise:



* VPN connections that use deprecated ciphers stop working.
* VPN connections that use an auto-negotiation policy are forced to upgrade to the [enhanced auto-negotiation policy](https://cloud.ibm.com/docs/vpc?topic=vpc-using-vpnpolicy-negotiation).
* VPN connections that use custom IKE or IPsec policies that contain deprecated ciphers are disabled.



To prevent affected connections from becoming disconnected, take steps to upgrade your VPN connection to secure ciphers now. Also, if your disaster recovery plan or API/CLI-based automation references these deprecated ciphers, take steps to upgrade them.



 Upgrading the auto-negotiation policy 

Complete the following procedure to upgrade your VPN to the enhanced auto-negotiation policy. You can upgrade the auto-negotiation policy by using the UI, CLI, or API.



 Before you begin 

You will experience a network outage during the upgrade. The duration of the outage depends on the interval between the disable and re-enable actions to reestablish the VPN connection. It is recommended that you plan a maintenance window for this upgrade.

Before you upgrade, review the following information:



* By default, the new auto-negotiation policy is used for newly created VPN connections.
IBM Cloud Block Storage driver and plug-in 1.17.2 v2.0.0 Updated to use the universal base image (UBI), to use Go version 1.15.5, to run with a least privileged security context, and to improve logging. Updated image to implement additional IBM security controls. 
 IBM Cloud Controller Manager v1.17.15-1 v1.17.16-1 Updated to support the Kubernetes 1.17.16 release. 
 IBM Cloud File Storage for Classic plug-in N/A N/A Updated to run with a privileged security context. 
 IBM Cloud RBAC Operator c148a8a f859228 Updated image for [CVE-2020-1971](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1971) and [CVE-2020-24659](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-24659). 
 Key Management Service provider v2.0.7 v2.2.2 Updated the key management service (KMS) provider support as follows.<br><br><br><br> * Updated to use Go version 1.15.2.<br> * Added support for [service-to-service authentication](https://cloud.ibm.com/docs/account?topic=account-serviceauth).<br> * Updated to use the KMS provider secret to identify when a [Key Protect](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) key is enabled and disabled so that encryption and decryption requests are updated accordingly.<br><br><br> 
 Red Hat OpenShift Control Plane Operator v4.4.0-20201207 v4.4.0-20201210 See the [Red Hat OpenShift on IBM Cloud toolkit release notes](https://github.com/openshift/ibm-roks-toolkit/releases/tag/v4.4.0+20201210).