vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Having at least some headroom is desirable, as it will allow peers and ordering services to be a part of additional channels and take on higher throughput without having to deploy additional resources into your Kubernetes cluster before adjusting the size of your nodes. For more information about how these values are adjusted, see [Reallocating resources](https://cloud.ibm.com/docs/blockchain?topic=blockchain-ibp-console-govern-componentsibp-console-govern-components-reallocate-resources).

Creating an initial deployment of sufficient size to allow growth is particularly important for users who will choose to not use the [Kubernetes Service](https://cloud.ibm.com/docs/containers?topic=containers-caca) or [OpenShift](https://cloud.ibm.com/docs/openshift?topic=openshift-ca) autoscaler, which can take on some of the burden of deploying additional nodes and pods for the user.

While it is simpler to have enough resources deployed to IBM Cloud Kubernetes Service and be able to expand your pods and worker nodes as you see fit without having to increase your Kubernetes cluster deployment first, bigger Kubernetes cluster deployments will cost more money. Users will have to consider their options carefully and recognize the tradeoffs they are making regardless of the option they choose.

For a sense of how much storage and compute you will need in your cluster, refer to this chart, which contains the current defaults for the peer, ordering node, and CA:



Table 2. Recommended resources for nodes on IBM Blockchain Platform for IBM Cloud

 Component (all containers) CPU** Memory (GB) Storage (GB) 

 Peer (Hyperledger Fabric v1.4) 1.1 2.8 200 (includes 100GB for peer and 100GB for state database) 
 Peer (Hyperledger Fabric v2.x) 0.7 2.0 200 (includes 100GB for peer and 100GB for state database) 
 CA 0.1 0.2 20 
 Ordering node 0.35 0.7 100 
 Operator 0.1 0.2 0 
 Console 1.2 2.4 10
With this update, the jsp-2.3, el-3.0, and jdbc-4.1 Liberty features, previously available as beta features, are now available as production-ready features. Also, additional Java EE 7 features such as jsf-2.2, javaMail-1.5, webProfile-7.0, and javaee-7.0 are now available as beta features.



* The buildpack also provides initial support for Java 8. IBM JRE 7.1 remains the default JRE but IBM JRE 8 can be enabled for an app by setting the JBP_CONFIG_IBMJDK environment variable. Configuring version of OpenJDK is also supported. See [Customizing the JRE](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-customizing_jre) for all the details.
* The buildpack provides a new JBP_CONFIG_LIBERTY environment variable that can be used to override the default set of Liberty features enabled for an app when it deploys a WAR or EAR file. See [Stand-alone Apps](https://cloud.ibm.com/docs/cloud-foundry-public?topic=cloud-foundry-public-options_for_pushingstand_alone_apps) for more information.
* The service plug-in for the Monitoring and Analytics service was updated to reduce the size of logs that are generated for the service.
* With this version of the buildpack, the way the app files are laid out in the droplet changed. The change in the file structure eliminated complexity that is related to maintaining symbolic links and should have no impact on the apps.



Updated Node.js buildpack v1.17-20150429-1033
: The Node.js buildpack now comes with [IBM SDK for Node.js v0.12.1](https://developer.ibm.com/languages/node-js/articles/download-nodejs-for-ibm-platforms/).
IA-6 - Authenticator Feedback 



  Control requirements 

IA-6 - 0
:   The information system obscures feedback of authentication information during the authentication process to protect the information from possible exploitation/use by unauthorized individuals.





  IBM Cloud for Financial Services profile 

The rules related to this control that follow are part of the IBM Cloud for Financial Services v1.2.0 profile in [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).



*  IBMid protects user information during the authentication process from possible exploitation by unauthorized individuals by obscuring it







  NIST supplemental guidance 

The feedback from information systems does not provide information that would allow unauthorized individuals to compromise authentication mechanisms. For some types of information systems or system components, for example, desktops/notebooks with relatively large monitors, the threat (often referred to as shoulder surfing) may be significant. For other types of systems or components, for example, mobile devices with 2-4 inch screens, this threat may be less significant, and may need to be balanced against the increased likelihood of typographic input errors due to the small keyboards. Therefore, the means for obscuring the authenticator feedback is selected accordingly. Obscuring the feedback of authentication information includes, for example, displaying asterisks when users type passwords into input devices, or displaying feedback for a very limited time before fully obscuring it.
The VMware vSAN is a distributed layer of software that runs natively as a part of the ESXi hypervisor. It aggregates local or direct-attached capacity devices of a host cluster and creates a single storage pool that is shared across all hosts in the vSAN cluster. The VMware features that require shared storage, such as HA, vMotion, DRS, and vSAN eliminate the need for external shared storage. They also simplify storage configuration and virtual machine provisioning activities. However, if needed, you can combine these functions with IBM Cloud VPC provided storage solutions.

Within vSAN design, the compute nodes contain local disk drives for the ESXi operating system (OS) and extra disk drives for the vSAN data store. In every bare metal server, two M.2 SSD mirrored drives are included in each node to house the ESXi installation, regardless of which type of cluster the host belongs to. The IBM Cloud bare metal server profiles with letter d represent a number of additional attached NVMe U.2 SSDs, which can be used for vSAN.

With vSAN, you must specify each host and each device to be used for the vSAN data store. You can organize cache and capacity devices into disk groups. Each disk group contains one flash cache device and one or more capacity devices. When you create a disk group, consider the ratio of flash cache to used capacity. The ratio depends on the requirements and workload of the cluster. For more information about disk groups, see [Managing disk groups and devices](https://docs.vmware.com/en/VMware-vSphere/7.0/com.vmware.vsphere.vsan.doc/GUID-88790522-2FA0-476F-B874-6FE4E8E5B908.html). For more information about determining the cache ratio for all-flash clusters, see [Understanding vSAN architecture: disk groups](https://blogs.vmware.com/virtualblocks/2019/04/18/vsan-disk-groups/).

vSAN can be employed as follows:



* One or two-disk group vSAN designs.
Additional permissions that are applicable to the entire Program shall be treated as though they were included in this License, to the extent that they are valid under applicable law. If additional permissions apply only to part of the Program, that part may be used separately under those permissions, but the entire Program remains governed by this License without regard to the additional permissions.When you convey a copy of a covered work, you may at your option remove any additional permissions from that copy, or from any part of it. (Additional permissions may be written to require their own removal in certain cases when you modify the work.) You may place additional permissions on material, added by you to a covered work, for which you have or can give appropriate copyright permission.Notwithstanding any other provision of this License, for material you add to a covered work, you may (if authorized by the copyright holders of that material) supplement the terms of this License with terms:a) Disclaiming warranty or limiting liability differently from the terms of sections 15 and 16 of this License; orb) Requiring preservation of specified reasonable legal notices or author attributions in that material or in the Appropriate Legal Notices displayed by works containing it; orc) Prohibiting misrepresentation of the origin of that material, or requiring that modified versions of such material be marked in reasonable ways as different from the original version; ord) Limiting the use for publicity purposes of names of licensors or authors of the material; ore) Declining to grant rights under trademark law for use of some trade names, trademarks, or service marks; orf) Requiring indemnification of licensors and authors of that material by anyone who conveys the material (or modified versions of it) with contractual assumptions of liability to the recipient, for any liability that these contractual assumptions directly impose on those licensors and authors.All other non-permissive additional terms are considered "further restrictions" within the meaning of section 10. If the Program as you received it, or any part of it, contains a notice stating that it is governed by this License along with a term that is a further restriction, you may remove that term.
Understanding your responsibilities when using IBM Cloud Direct Link 

Learn about the management responsibilities and terms and conditions that you have when you use IBM Cloud Direct Link. For a high-level view of the service types in IBM Cloud® and the breakdown of responsibilities between the customer and IBM for each type, see [Shared responsibilities for IBM Cloud offerings](https://cloud.ibm.com/docs/overview?topic=overview-shared-responsibilities).

Review the following sections for the specific responsibilities for you and for IBM when you use IBM Cloud Direct Link. For the overall terms of use, see [IBM Cloud® Terms and Notices](https://cloud.ibm.com/docs/overview/terms-of-use?topic=overview-terms).



 Incident and operations management 

Incident and operations management includes tasks, such as monitoring, event management, high availability, problem determination, recovery, and full state backup and recovery.



Table 1. Responsibilities for incident and operations

 Task IBM Responsibilities Your Responsibilities 

 High Availability IBM is responsible for deploying a fully managed, highly available, secure, IBM-owned infrastructure. The Customer is responsible for ordering two diverse direct links, and create a Border Gateway Protocol (BGP) schema that allows for failover between the two links. 
 Management IBM provisions and manages the Direct Link gateway. The Customer is responsible for: <br>Following instructions in the IBM Cloud Direct Link user documentation to make any necessary configurations, such as BGP. <br>Setting up routing, adding virtual connections to resources, and adjusting networking configurations to meet the needs of their workloads. <br>Making sure that any self-provided BGP addresses do not conflict with blocks that are used by IBM, or by resources external to your deployment. <br>Ensuring that there are no IP address conflicts between on-premises subnets, and subnets on IBM Cloud for both VPC and classic infrastructure connections. 
 Fulfillment IBM fulfills requests for Direct Link connections and additional capacity based on use. The Customer is responsible for monitoring service notifications for communications regarding maintenance operations. The Customer is also responsible for uploading the Completion notice from their service provider when Cross Connect is completed by the chosen service provider. 
 Partnership IBM provides partner relationships with physical locations for Direct Link interconnects.
Constructing an HMAC signature 

Instead of token-based authorization, it's possible to use [HMAC credentials](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-uhc-hmac-credentials-main).

These credentials are used to create an authorization header analogous to AWS Signature Version 4. Calculating signatures provides identity verification and in-transit data integrity. Each signature is tied to the time stamp of the request, so you can't reuse authorization headers. The header is composed of four components: an algorithm declaration, credential information, signed headers, and the calculated signature.

AWS4-HMAC-SHA256 Credential={access-key}/{date}/{region}/s3/aws4_request,SignedHeaders=host;x-amz-date;{other-required-headers},Signature={signature}

The date is provided in YYYYMMDD format, and the region corresponds to the location of specified bucket, for example us. The host and x-amz-date headers are always required. Depending on the request other headers might be required as well (for example, x-amz-content-sha256 in requests with payloads). It's necessary to recalculate the signature for every individual request, so many developers prefer to use a tool or SDK that produces the authorization header automatically.



  Next steps 

You can review the documentation for credentials as part of a [Service Credential](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-service-credentials). For an overview on authentication, check out the [IBM Cloud Identity and Access Management service](https://cloud.ibm.com/docs/cloud-object-storage?topic=cloud-object-storage-iam-overview).
<-- </ol> -->The C MQI sample program is using a secured connection to send/receive messages.<-- </section "id="section-export-the-necessary-environment-variables" "> --><-- </section "id="section-mqoc_connect_app_ssl_c_tasks" "> --><-- <section "id="section-mqoc_connect_app_ssl_jms_tasks" "> --> Tasks specific to the JMS Program If you are not familiar with the JMS sample program, there is a full tutorial on how to install and run the sample without TLS here: https://developer.ibm.com/learningpaths/ibm-mq-badge/write-run-first-mq-app/]https_developer_.ibm_.com_learningpaths_ibm_-mq_-badge_write_-run_-first_-mq_-app] ! !!The sample above runs on the IBM Java 1.8 SDK on Windows and Linux. At the time of writing, we also tried this using the Oracle 1.8 SDK, but were unable to get the connection working - there was a cipher suite mismatch.When you can run the JMS sample, you now need to alter it to accept the cipher specification:<-- <ol> -->1. Update the MQ JMS sample for making a secured connection:
<-- <ol> -->

1. Navigate to MQ JMS Samples directory. The location will vary depending on your operating system. By default, these will be $MQ_INSTALLATION_PATH/samp/jms/samples on Linux and %MQ_INSTALLATION_PATH%\tools\jms\samples on Windows
2. Use any editor to open the simple/JmsPut.java program.
3. Add following new properties to the jms program, just after creating JMS ConnectionFactory instance.

System.setProperty("javax.net.ssl.keyStore", "/Users/you/store/key.kdb");
<modelVersion>4.0.0</modelVersion>
<groupId>com.cos</groupId>
<artifactId>docs</artifactId>
<version>1.0.0-SNAPSHOT</version>
<dependencies>
<dependency>
<groupId>com.ibm.cos</groupId>
<artifactId>ibm-cos-java-sdk</artifactId>
<version>2.8.0</version>
</dependency>
</dependencies>
</project>







 Migrating from 1.x.x 

The 2.0 release of the SDK introduces a namespacing change that allows an application to make use of the original AWS library to connect to AWS resources within the same application or environment. To migrate from 1.x to 2.0 some changes are necessary:



1. Update by using Maven by changing all ibm-cos-java-sdk dependency version tags to 2.0.0 in the pom.xml. Verify that there are no SDK module dependencies in the pom.xml with a version earlier than 2.0.0.
2. Update any import declarations from amazonaws to ibm.cloud.objectstorage.







 Creating a client and sourcing credentials 

In the following example, a client cos is created and configured by providing credential information (API key and service instance ID). These values can also be automatically sourced from a credentials file or from environment variables.

After generating a [Service Credential](https://cloud.ibm.com/docs/cloud-object-storage/iam?topic=cloud-object-storage-service-credentials), the resulting JSON document can be saved to /.bluemix/cos_credentials. The SDK will automatically source credentials from this file unless other credentials are explicitly set during client creation. If the cos_credentials file contains HMAC keys the client authenticates with a signature, otherwise the client uses the provided API key to authenticate by using a bearer token.
Install smart contracts on both peers and join the peers to your channels.





 Using indexes with CouchDB 

If you use CouchDB as your state database, you can perform JSON data queries from your smart contract against the channel's state data. It is strongly recommended that you create indexes for your JSON queries and use them in your smart contract. Indexes allow your applications to retrieve data efficiently when your network adds additional blocks of transactions and entries in the world state.

For more information about CouchDB and how to set up indexes, see [CouchDB as the State Database](https://hyperledger-fabric.readthedocs.io/en/release-2.2/couchdb_as_state_database.html) in the Hyperledger Fabric documentation. You can also find an example that uses an index with chaincode in the [Fabric CouchDB tutorial](https://hyperledger-fabric.readthedocs.io/en/release-2.2/couchdb_tutorial.html).

Avoid using chaincode for queries that will result in a scan of the entire CouchDB database. Full length database scans result in long response times and will degrade the performance of your network. You can take some of the following steps to avoid and manage large queries:



* Set up indexes with your chaincode.
* All fields in the index must also be in the selector or sort sections of your query for the index to be used.
* More complex queries will have a lower performance and will be less likely to use an index.
* You should try to avoid operators that will result in a full table scan or a full index scan, such as $or, $in , and $regex.



You can find examples that demonstrate how queries use indexes and what type of queries will have the best performance in the [Fabric CouchDB tutorial](https://hyperledger-fabric.readthedocs.io/en/release-2.2/couchdb_tutorial.htmluse-best-practices-for-queries-and-indexes).

Peers on the IBM Blockchain Platform have a set queryLimit, and will only return 10,000 entries from the state database.
x = tspy.time_series([1.0, 2.0, 4.0, 7.0, 11.0, 16.0, 22.0, 29.0, 28.0, 30.0, 29.0, 30.0, 30.0])
v = x.transform(transformers.difference())
a = v.transform(transformers.difference())
h = a.map(harsh).filter(lambda h: h != 0)

print(h[5, 10])

The harsh lambda is defined as follows:

def harsh(a):
threshold_acceleration = 2.0
threshold_braking = -2.0

if (a > threshold_acceleration):
return +1
elif (a < threshold_braking):
return -1
else:
return 0





 Learn more 

To use the tspy Python SDK, see the [tspy Python SDK documentation](https://ibm-cloud.github.io/tspy-docs/).
Successfully installed pyjokes-0.6.0
6. Stop the virtualenv virtual environment.

(virtualenv) $ deactivate
7. Copy the following code and save it into a file called __main__.py in your jokes directory.

import pyjokes

def joke(params):
return {"joke": pyjokes.get_joke()}
8. From your jokes directory, create an archive of the virtualenv folder and your __main__.py file. These files must be in the top level of your .zip file.

zip -r jokes.zip virtualenv __main__.py

Example output

...
adding: virtualenv (stored 0%)
adding: __main__.py (deflated 18%)
...
9. Create an action called jokes that uses your jokes.zip file. You must also specify the entry point as jokes. You must also specify the --kind flag for the runtime.

ibmcloud fn action create jokes </path/to/file/>jokes.zip --kind python:3.11 --main joke

Example output

ok: created action jokes
10. Invoke the action to verify it is working. Include the --result flag to return the result in the command line.

ibmcloud fn action invoke jokes --result

Example output

{
"joke": "A QA engineer walks into a bar. Runs into a bar. Crawls into a bar. Dances into a bar. Tiptoes into a bar. Rams a bar. Jumps into a bar."
}



You can use this method to extend the functionality of Cloud Functions actions by using other Python packages.





 Packaging Python code with a Docker virtual environment in an archive 

You can package Python dependencies by using a virtual environment, virtualenv.
On an object PUT, HEAD, or GET request, [the If-Match header](https://tools.ietf.org/html/rfc7232section-3.1) will check to see if a provided Etag (MD5 hash of the object content) matches the provided Etag value. If this value matches, the operation will proceed. If the match fails, the system will return a 412 Precondition Failed error.

> If-Match is most often used with state-changing methods (e.g., POST, PUT, DELETE) to prevent accidental overwrites when multiple user agents might be acting in parallel on the same resource (i.e., to prevent the "lost update" problem).





 Using If-None-Match 

On an object PUT, HEAD, or GET request, [the If-None-Match header](https://tools.ietf.org/html/rfc7232section-3.2) will check to see if a provided Etag (MD5 hash of the object content) matches the provided Etag value. If this value does not match, the operation will proceed. If the match succeeds, the system will return a 412 Precondition Failed error on a PUT and a 304 Not Modified on GET or HEAD.

> If-None-Match is primarily used in conditional GET requests to enable efficient updates of cached information with a minimum amount of transaction overhead. When a client desires to update one or more stored responses that have entity-tags, the client SHOULD generate an If-None-Match header field containing a list of those entity-tags when making a GET request; this allows recipient servers to send a 304 (Not Modified) response to indicate when one of those stored responses matches the selected representation.





 Using If-Modified-Since 

On an object HEAD or GET request, [the If-Modified-Since header](https://tools.ietf.org/html/rfc7232section-3.3) will check to see if the object's Last-Modified value (for example Sat, 14 March 2020 19:43:31 GMT) is newer than a provided value. If the object has been modified, the operation will proceed. If the object has not been modified, the system will return a 304 Not Modified.