vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Both of these scan types can find toolchains and associated evidence, as it is configured in the Name, Evidence repository name or URL, and Evidence namespace fields within the Security and Compliance Center tool integration.

The trigger validation scan after deploy field, and the other three trigger scan option fields work only with hybrid cloud scans.

Configure Security and Compliance Center to embed security checks into your workflows to monitor for security and compliance:



1. If you are configuring this tool integration as you are creating the toolchain, and a Security and Compliance Center tool integration exists within the template that you are configuring, click the Security and Compliance Center tab. Alternatively, in the More tools section, click Security and Compliance Center.
2. If you have a toolchain and are adding this tool integration to it, from the IBM Cloud console, click the menu icon ![hamburger icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/icon_hamburger.svg) and select DevOps. On the Toolchains page, click the toolchain to open its Overview page. Alternatively, on your app's Overview page, on the Continuous delivery card, click View toolchain. Then, click Overview.

a. Click Add tool.

b. In the Tool Integrations section, click Security and Compliance Center.
3. Type the name that you want to display for this tool integration on the Security and Compliance Center card in your toolchain. This name is used to identify the tool integration in your toolchain.
4. Specify the Evidence repository name or URL. This is the name or URL of the repo that stores the evidence locker for your toolchain. This repo must correspond to the Git tool integration you previously added to your toolchain to store your evidence. Currently, only GitHub, GitLab, and IBM-hosted Git are supported.
[Getting started with Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started)Getting started with Security and Compliance Center

For highly regulated industries, such as financial services, achieving continuous compliance within a cloud environment is an important first step toward protecting customer and application data. Historically, that process was difficult and manual, which placed your organization at risk. But, with IBM Cloud® Security and Compliance Center, you can integrate daily, automatic compliance checks into your development lifecycle to help minimize that risk.

Security and Compliance Center Object Storage

+2

Event Notifications,



* 5 minutes
* 2023-07-11



[Part 1: Manage permissions for IBM Cloud credentials](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ibm-credential)Part 1: Manage permissions for IBM Cloud credentials

This tutorial is part 1 of a 4-part tutorial series that guides you through configuring the Security and Compliance Center to scan your IBM Cloud resources for compliance.

Security and Compliance Center



* 20 minutes
* 2022-12-06



[Step 2: Discover your available resources](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ibm-discover)Step 2: Discover your available resources

This tutorial is part 2 of a 4-part tutorial series that guides you through configuring the Security and Compliance Center to scan your IBM Cloud resources for compliance.

Security and Compliance Center



* 20 minutes
* 2022-12-06



[Part 3: Map additional credentials](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-ibm-credential-map)Part 3: Map additional credentials

This tutorial is part 3 of a 4-part tutorial series that guides you through configuring the Security and Compliance Center to scan your IBM Cloud resources for compliance.

Security and Compliance Center



* 20 minutes
* 2022-12-13
* Use the native due date field in GitLab for managing issues.
* Added custom-exempt-label as an environment property that so pipelines are not marked as failed if they have the matching exempt label.
* Fixed Cloud Object Storage as an evidence locker for CC pipeline.







 25 July 2022 



* Upload Continuous Compliance evidence summary for Security and Compliance Center.







 24 June 2022 



* Enabled DevOps Insights integration for the continuous compliance (CC) template.



If you have an existing CC toolchain, you can set the [doi-toolchain-id](https://cloud.ibm.com/docs/devsecops?topic=devsecops-tutorial-cc-toolchaintutorial-cc-toolchain-insights) and doi-environment properties by linking an existing Insights tool integration from your DevSecOps continuous integration (CI) toolchain.



* Added [tags](https://cloud.ibm.com/docs/devops-insights-cli-plugin?topic=devops-insights-cli-plugin-CLI_devops-insights) to DevSecOps pipeline scripts to visualize Continuous Compliance scan results in the Insights user interface.
* Surfaced dynamic scan results in the [Insights quality dashboard](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-devops-data-aggregation).
* Improved message logging for the pipeline evaluator task so that users can better understand what failed or succeeded for a pipeline run.







 17 June 2022 

The deployment BOM that is attached in a generated Change Request was missing information that is related to artifacts in the inventory. This information is now included.





 19 May 2022 



* Notify users about incident issues that have approaching due dates and overdue due dates by using Slack after the Slack tool integration is enabled.
* Support for [cyclonedx](https://cloud.ibm.com/docs/devsecops?topic=devsecops-generate-cyclonedx-sbom) format when generating Software Bill of Material by using Code Risk Analyzer in compliance pipelines.







 13 May 2022
5. Type the password or authentication token that you use to connect to the SonarQube server.
6. If the server cannot be on the public internet, select Advanced. IBM Cloud cannot validate the connection details that you provide and certain functions that require API access to this server are disabled. The delivery pipeline works only by using a private worker that has network access to this server.
7. Click Create Integration.
8. On your Toolchain's Overview page, on the Third-Party tools card, click SonarQube to view the dashboard for the SonarQube instance that you connected to.





 Adding SonarQube to the continuous integration pipeline 



 Default SonarQube instance 

If sonarqube-config is set to default, then default configuration is used, a SonarQube scan runs as Docker-in-Docker and the instance is not available after the run.





 SonarQube instance on the dev cluster 

If sonarqube-config is set to cluster, the pipeline creates a SonarQube instance during the pipeline run in the dev cluster. You can access this instance after the static-scan stage successfully runs.





 Existing SonarQube instance 

Set sonarqube-config to custom, to add your own SonarQube instance to your existing pipeline, add the tool integration to your toolchain, and then add the SonarQube tool integration parameter to the pipeline. For more information, see [Configuring SonarQube](https://cloud.ibm.com/docs/devsecops?topic=devsecops-sonarqube).





 Parameters 

To run the SonarQube scan, the pipeline needs the following continuous integration parameters:



Table 1. Continuous integration pipeline parameters

 Name Type Description Required or Optional 

 cluster-name Text The name of the Docker build cluster. Required 
 dev-region Text The IBM Cloud region that hosts the cluster. Required 
 opt-in-sonar Text The option to enable the SonarQube scan. Required 
 sonarqube Tool integration The SonarQube tool integration. Optional
VRVDR-40988 Critical Vhost not starting when used with certain number of interfaces 
 VRVDR-40927 Critical DNAT: SDP in SIP 200 OK not translated when it follows a 183 response 
 VRVDR-40920 Major With 127.0.0.1 as listen-address snmpd does not start 
 VRVDR-40920 Critical ARP doesn’t work over bonded SR-IOV interface 
 VRVDR-40294 Major Dataplane doesn’t restore previous queues after slave is removed from bonding group 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801e

 Issue Number CVSS score Advisory Summary 

 VRVDR- 41172 N/A DSA-4140-1 DSA 4140-1: libvorbis security update 









 1801d 

Released March 8, 2018.



 Issues Resolved 



Issues resolved for 1801d

 Issue Number Priority Summary 

 VRVDR-40940 Major Data plane crash related to NAT/firewall 
 VRVDR-40886 Major Combining icmp name <value> with a number of other configuration for the rule will cause firewall to not load 
 VRVDR-39879 Major Configuring bonding for jumbo frames fails 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801d

 Issue Number CVSS score Advisory Summary 

 VRVDR- 40327 9.8 DSA-4098-1 
 VRVDR- 39907 7.8 CVE-2017-5717 Branch target injection / CVE-2017-5715 / Spectre, aka variant #2 









 1801c 

Released March 7, 2018.



 Issues Resolved 



Issues resolved for 1801c

 Issue Number Priority Summary 

 VRVDR-40281 Major After upgrading from 5.2 to more recent version error “-vbash: show: command not found” in operation mode 









 1801b 

Released February 21, 2018.



 Issues Resolved 



Issues resolved for 1801b

 Issue Number Priority Summary 

 VRVDR-40622 Major Cloud-init images fail to detect correctly if IP address has been obtained from DHCP server
Continuous integration pipeline 

The continuous integration pipeline builds the deployable artifacts from the application repositories.

Before it builds artifacts, the pipeline checks that the code is scanned and tested, in the same way that pull requests are processed. Built artifacts are also scanned for vulnerabilities and signed in the pipeline before they are marked ready for release and deployment in the [inventory](https://cloud.ibm.com/docs/devsecops?topic=devsecops-cd-devsecops-inventory). Unlike the pull request pipeline, the continuous integration pipeline collects evidence and result artifacts on each stage of the build, such as testing, scanning, and signing. This data correlates to the built artifacts and can be tracked through the deployment process and change management.



 Stages and tasks 



Table 1. Continuous integration stages and tasks

 Task or stage Short description Customizable in .pipeline-config.yaml 

 start Set up the pipeline environment. No 
 setup Set up your build and test environment. Yes 
 test Run unit tests and application tests on application code. Yes 
 static-scan Run static scan code on the application code. Yes 
 compliance-checks Run Code Risk Analyzer scans and other compliance checks on app repos. Yes 
 containerize Build the artifacts. Yes 
 sign-artifact Sign the built artifacts. Yes 
 deploy Deploy the built artifacts to the dev environment. Yes 
 dynamic-scan Run dynamic scan on the application. Yes 
 acceptance-test Run acceptance and integration tests on the deployed built artifacts on the dev environment. Yes 
 scan-artifact Scan the built artifacts. Yes 
 release Add the built artifacts to the inventory. Yes 
 finish Collect, create, and upload the logs files, artifacts, and evidence to the evidence locker. Yes
└── evidences/
├── 00/
│ └── abcdef123456789/
│ └── index.json
└── 01 /
└── abcdef123456789/
└── index.json
Show more







 v2 evidence collection 

The v2 evidence must be collected as near as possible to the process that created the result for an evidence. After each scan run, after each test for example.

For collecting evidence, the [collect-evidence](https://cloud.ibm.com/docs/devsecops?topic=devsecops-devsecops-collect-evidence) script can be used in the DevSecOps pipelines.





 v2 evidence format 

A piece of evidence represents the outcome of a scan, test, and so on. The evidence is always connected to at least a single asset. Multiple assets are allowed, such as a single end-to-end test suite that probably tests multiple assets together.

An asset represents something that you can test, scan, and so on, such as a Git commit in a repository, or a docker image, or any generic asset with an URI.

The Evidence and Asset types represent the schema of the v2 locker elements: evidence and asset. Although the schema uses typescript syntax, you can convert it to use JSON schema.

type SHA1 = string; // 40 character string representing a SHA-1 hash in hexadecimal format
type SHA256 = string; // 64 character string representing a SHA256 hash in hexadecimal format
type IssueURL = string; // Link to issues on a git service provide like GitHub or GitLab
type RepositoryURL = string; // Link to a git repository
type AssetURI = string; // URI of an Asset, like an image or a repository link and git hash
type FileName = string; // file basename of the attachment

interface Evidence {
version: 2;
id: SHA256;
date: string;
evidence_type_id: string;
evidence_type_version: string;
origin: {
You can start the scan manually or schedule a scan task.
4. Review the scan results displayed in the VUM Client Compliance view.
5. Remediate the non-compliant virtual machines in the container object to make them compliant with the attached baseline group. You can start the remediation manually or schedule a remediation task.



* During an upgrade of VMware Tools, the virtual machines must be powered on. If a virtual machine is in a powered off or suspended state before remediation, VUM powers on the virtual machine. After the upgrade is completed, VUM restarts the virtual machine and restores the original power state of it.
* During a virtual machine hardware upgrade, the virtual machines must be shut down. After the remediation is completed, VUM restores the original power state of the virtual machines. If a virtual machine is powered on, VUM powers it off, upgrades its hardware, and then powers it on.





You can now use these baseline groups in the scan, review, staging, and remediation processes.





 Related links 



* [VMware HCX solution architecture](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-hcx-archi-introhcx-archi-intro)
* [IBM Cloud for VMware Solutions Demos](https://www.ibm.com/demos/collection/IBM-Cloud-for-VMware-Solutions/) (demonstrations)
"date": "2020-05-06T12:00:00Z", // date of task run
"origin": {
"url":"https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines/-/blob/master/definitions/mytask.yaml", // where the task is taken from
"version": "423792" // commit id representing the task version used to produce the evidence
}
"toolchain_crn": "crn:v1:bluemix:public:toolchain:us-south:a/190e0b4ce4cd013159917665213ddc51:7467a214-f404-4e23-acab-2e57e935d138::" // CRN of the toolchain
"pipeline_id": "b1cfb6a4-813d-4fec-bbf7-ce662e8ce4e0", // the id of the pipeline that generated this piece of evidence
"pipeline_run_id": 12345, // this is the id of the pipeline run that generated this piece of evidence
"last_scan_date": "24-03-2020 UTC", // the last time the scan was run
"result": "passed"|"failed"], // the result of the scan
"log": {
"url": "https://acme.org/log.txt", // the link to where the actual log of the test is
"hash": "abc123", // the hash of the log file
},
"expired_issues": 134,132,342], // link(s) to the issues for which the grace period expired
"issues": 234,343,342], // link(s) to the issue(s) created to track the bugs found during the test run. Should be populated only if the scan failed
This name is used to identify the tool integration in your toolchain.
4. Specify the Evidence repository name or URL. This is the name or URL of the repo that stores the evidence locker for your toolchain. This repo must correspond to the Git tool integration you previously added to your toolchain to store your evidence. Currently, only GitHub, GitLab, and IBM-hosted Git are supported. Security and Compliance Center scans run with the user credentials that are configured in the Security and Compliance Center scope. That user must have Git OAuth credentials for this toolchain's region and read access to the evidence repo.
5. Optional. To use the deprecated trigger validation scan after deploy field, enable Trigger validation scan after deploy to configure a pipeline task to trigger scans.

a. Select an existing IBM Cloud API key from a secrets store or click New to create one. This API key is used to access the Security and Compliance Center API.

b. Select a Scope name. A scope narrows the focus of the scan. For more information about scopes, see [Managing scopes](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scopes).

c. Select a Profile name. A profile is a collection of security controls. For more information about profiles, see [Working with profiles](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-profiles).

Select the IBM Cloud Security Best Practices v1.0.0 profile for DevSecOps toolchains.
6. Click Create Integration.
7. On your Toolchain's Overview page, on the IBM Cloud tools card, click Security and Compliance Center.





 Configuring Security and Compliance Center by using the API
: The alternate Liberty runtime GA version is changed to the 21.0.0.11 release. The default runtime remains the same [21.0.0.9](https://openliberty.io/blog/2021/09/03/microprofile-21009.html)



* To specify the monthly runtime set the following two variables:

ibmcloud cf set-env <yourappname> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <yourappname> IBM_LIBERTY_MONTHLY true
* The AdoptOpenJDK OpenJ9 alternate JRE (11.0.12_7_openj9-0.27.0) and IBM JRE Version (8 SR6 FP36) remain unchanged.







 1 October 2021 

Updated Liberty buildpack v3.62-20210922-1852
: The alternate Liberty runtime GA version is changed to the 21.0.0.10 release. The default runtime remains the same 21.0.0.9.



* To specify the monthly runtime set the following two variables:

ibmcloud cf set-env <yourappname> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <yourappname> IBM_LIBERTY_MONTHLY true
* The default and alternate runtime 21.0.0.9 and 21.0.0.10 addresses the following PSIRT security vulnerabilities:



* [CVE-2021-36090, CVE-2021-35517](https://www.ibm.com/support/pages/node/6489683): Vulnerability in Apache Commons Compress library that is used by Websphere Application Server Liberty.
* [CVE-2021-29842](https://www.ibm.com/support/pages/node/6488623): Vulnerability in WebSphere Application Server to information disclosure.



* The IBM JRE Version is updated to 8 SR6 FP36.







 3 September 2021 

Updated Liberty buildpack v3.61-20210826-1015
* [CVE-2021-36090, CVE-2021-35517](https://www.ibm.com/support/pages/node/6489683): Vulnerability in Apache Commons Compress library that is used by Websphere Application Server Liberty.
* [CVE-2021-29842](https://www.ibm.com/support/pages/node/6488623): Vulnerability in WebSphere Application Server to information disclosure.



* The IBM JRE Version is updated to 8 SR6 FP36.







 3 September 2021 

Updated Liberty buildpack v3.61-20210826-1015
: The alternate and default Liberty runtime GA version is changed to the 21.0.0.9 release.



* To specify the monthly runtime set the following two variables:

ibmcloud cf set-env <yourappname> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <yourappname> IBM_LIBERTY_MONTHLY true
* The new release includes MicroProfile 4.1 package.
* The IBM JRE Version is updated to 8 SR6 FP35 and includes the [Oracle's July Security fixes](https://www.oracle.com/security-alerts/cpujul2021.html).
* The AdoptOpenJDK Open J9 alternate JRE is updated to 1.0.13_8_openj9-0.29.0.







 6 August 2021 

Updated Liberty buildpack v3.60-20210730-0620
: The alternate Liberty runtime GA version is changed to the 21.0.0.8 release.



* The default Liberty runtime GA version remains the same [21.0.0.6](https://openliberty.io/blog/2021/06/11/request-timing-21006.html).
* To specify the monthly runtime set the following two variables:

ibmcloud cf set-env <yourappname> JBP_CONFIG_LIBERTY "version: +"
ibmcloud cf set-env <yourappname> IBM_LIBERTY_MONTHLY true
* Remove support for .NET Runtime 5.0.0
* Remove support for .NET SDK 2.1.810
* Remove support for .NET SDK 2.1.811
* Remove support for .NET SDK 3.1.403
* Remove support for .NET SDK 3.1.404
* Remove support for .NET SDK 5.0.100
* Update Node.js version to 10.23.0







 15 March 2021 

Updated Liberty buildpack v3.55-20210311-1642
: The default and alternate Liberty runtime GA version is changed to the 21.0.0.3 release.



* The IBM JRE Version is updated to 8 SR6 FP26.
* The IBM JRE 8 SR6 FP26 includes the following security fixes:



* [CVE-2020-14782](https://www.ibm.com/support/pages/node/6370061) - A vulnerability in Java SE related to Libraries Component
* [CVE-2020-14781](https://www.ibm.com/support/pages/node/6370061) - A vulnerability in Java SE related to JNDI Component.
* [CVE-2020-27221](https://www.ibm.com/support/pages/node/6417051) - Eclipse OpenJ9 vulnerability to a stack-based buffer overflow.
* [CVE-2020-2773](https://www.ibm.com/support/pages/node/6414729) - A vulnerability in Java SE related to the Java SE Security component.









 5 March 2021 

Updated Node.js buildpack v4.6-20210305-2036
: The SDK for Node.js buildpack v4.6 is based on community buildpack v1.7.44 and includes the following Node.js runtimes: v10.23.3, v10.24.0, v12.20.2, v12.21.0, v14.15.5, v14.16.0.
Pipeline image version: Runs in a container by using a built-in docker image that provides various built-in commands. To adopt newer versions of those commands, use a newer image version.<br><br>API key: The IBM Cloud API key to use to provide permissions to account resources.<br><br>Cluster name: Name of the Kubernetes cluster; the platform that you deploy your Kubernetes components on.<br><br>Deploy script: Deploy command to run whenever the job runs. In the script field, enter a script or reference scripts that are stored in your project’s source control. 







 Test stage 

The test stage specifies the test configuration. The jobs in the test stage specify a Tester type. The following Tester types are available:



Table 3. Tester types

 Tester type Description Supported job types 

 Simple Launches a shell command to run the automated tests, with an optional test report. Pipeline image version: Not used.<br><br>Test script: Test command to run whenever the job runs. In the script field, enter a script or reference scripts that are stored in your project’s source control.<br><br>Working directory: The directory where the test script is run.<br><br>Enable test report: Not used.<br><br>Enable code coverage report: Not used. 
 Custom Docker image Tests by using your custom Docker image with fine-grained control over the versions of node, Java™, or other tools. Docker image name: The name of the Docker image to run the job with. To make sure that your jobs run in a clean context, run them in Docker containers.<br><br>Test script: Test command to run whenever the job runs. In the script field, enter a script or reference scripts that are stored in your project’s source control.<br><br>Working directory: The directory where the test script is run.<br><br>Enable test report: Not used.<br><br>Enable code coverage report: Not used. 
 Vulnerability Advisor Runs a compliance and vulnerability check against the specified image, and displays the results. If any issues are found, this stage fails.