vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Before you can manage EP11 keystores with the console, complete the following steps to open your Hyper Protect Crypto Services dashboard:



1. [Log in to the IBM Cloud console](https://cloud.ibm.com/login).
2. Go to Menu > Resource list to view a list of your resources.
3. From your IBM Cloud resource list, select your provisioned instance of Hyper Protect Crypto Services and click the instance name.







 Viewing EP11 keystores 

For default service access roles that support viewing EP11 keystores, see [service access roles](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-manage-accessservice-access-roles). If you are to create custom roles, make sure to assign the following action to the custom role:



* hs-crypto.keystore.listkeystoresbyids



For instructions on creating custom roles, see [Creating custom roles](https://cloud.ibm.com/docs/account?topic=account-custom-roles).

To view a list of created EP11 keystores, on the Hyper Protect Crypto Services dashboard, select the EP11 keystores tab in the side menu.

An EP11 keystore table is displayed with the following details.



Table 1. Describes the EP11 keystores table

 Property Description 

 ID The unique identifier that is assigned when the keystore is created. 
 Name A human-readable alias for easy identification of your keystore. The keystore name might not be unique. You can assign multiple keystores with the same name. If there is no name associated with the keystore, it means the keystore is created using the PKCS #11 API. 
 Type The type of the keystore. Possible values are Public and Private. The database-backed EP11 keystores are composed of two types of keystores: public keystores for storing less sensitive EP11 keys that can be accessed by any user types (security officers, normal users, and anonymous users) and private keystores for storing sensitive EP11 keys that can be accessed by normal users only.
Using service endpoints to privately connect to IBM Cloud Activity Tracker Event Routing 

To ensure that you have enhanced control and security over your data when you use IBM Cloud® Activity Tracker Event Routing, you have the option of using private routes to IBM Cloud® service endpoints. Private routes are not accessible or reachable over the internet. By using the IBM Cloud private service endpoints feature, you can protect your data from threats from the public network and logically extend your private network.

You can use private and public endpoints to configure IBM Cloud® Activity Tracker Event Routing resources in your account.

You can connect to IBM Cloud Activity Tracker Event Routing over a private network by using IBM Cloud private service endpoints.



* When using the classic infrastructure, you connect to resources in your account over the IBM Cloud public network by default. You can enable virtual routing and forwarding (VRF) to move IP routing for your account and all of its resources into a separate routing table. If VRF is enabled, you can then enable IBM Cloud service endpoints to connect directly to resources without using the public network. [Enabling VRF and service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpoint).
* Virtual Private Clouds (VPCs) are automatically enabled for virtual routing and forwarding (VRF). To enable service endpoints for your VPC, continue to [Enabling service endpoints](https://cloud.ibm.com/docs/account?topic=account-vrf-service-endpointservice-endpoint).





 Before you begin 

Check if the account is VRF enabled by running the following command:

ibmcloud account show

To enable private endpoints, run the following command:

ibmcloud account update --service-endpoint-enable true





 Setting up service endpoints for IBM Cloud Activity Tracker Event Routing 

By default, private and public endpoints are enabled. For more information about supported endpoints, see [Endpoints](https://cloud.ibm.com/docs/atracker?topic=atracker-endpoints).





 Disabling public service endpoints 

You cannot disable private endpoints.
export KP_PRIVATE_ADDR="https://api.us-south.hs-crypto.cloud.ibm.com:<port>"

To find out the regions that Hyper Protect Crypto Services supports, see [Regions and locations](https://cloud.ibm.com/docs/hs-crypto?topic=hs-crypto-regions).
* On the

Windows

operating system, in Control Panel, type environment variable in the search box to locate the Environment Variables window. Create a KP_PRIVATE_ADDR environment variable and set the value to the endpoint that is displayed on the Manage tab of your provisioned IBM Cloud console. For example, https://api.us-south.hs-crypto.cloud.ibm.com:<port>.



You can also retrieve the endpoint URL through the API. For details, [check out the Hyper Protect Crypto Services key management service API reference doc](https://cloud.ibm.com/apidocs/hs-crypto).

Depending on whether you are using public or private endpoint, choose the corresponding endpoint URL to set the value of the KP_PRIVATE_ADDR environment variable.
3. Set the KP_INSTANCE_ID environment variable on your workstation:



* On the

Linux

operating system or

macOS

, run the following command:

export KP_INSTANCE_ID=<instance_ID>

In this command, the instance_ID is displayed on the Manage tab of your provisioned IBM Cloud console. instance_ID is in a Universally Unique Identifier (UUID) format.
* On

Windows

, in Control Panel, type environment variable in the search box to locate the Environment Variables window. Create a KP_INSTANCE_ID environment variable and set the value to the instance ID value that is displayed on the Manage tab of your provisioned Hyper Protect Crypto Services dashboard.



Alternatively, you can use the -i <instance_ID> option on the ibmcloud kp command to set the instance ID.
4. Run the specific command to perform key management operations.
Custom Data Sets - Tests JUnit (JSON), xUnit (xml), Mocha (JSON), KarmaMocha (JSON) 
 Custom Data Sets - Code Coverage Cobertura (xml), lcov, JaCoCo (xml) 



Publish build records with the publishTestResult step. This step requires two parameters. It can also accept one optional parameter.



Table 2. Publishing build records parameters and definitions

 Parameter Definition 

 type The type of test result. 
 fileLocation The test result file's location. 
 environment The environment is only required for the functional verification tests (fvt) on your test runs. 
 buildNumber Optional: Set value to any string to represent the version number. 
 applicationName Optional: Set the application name. If this value is set, the environment variable IBM_CLOUD_DEVOPS_APP_NAME is ignored. 



The following are the commands that are used to view the test results for a specific test.



Table 3. Test result and test types

 Test Result Test Type 

 unittest Unit Tests 
 fvt Functional Verification Tests 
 code Code Coverage Tests 
 staticsecurityscan Static Security Scan Result 
 dynamicsecurityscan Dynamic Security Scan 



The following example commands include the parameters. The first command publishes Mocha unit test results, and the second command publishes code coverage test results.

publishTestResults type:'unittest', fileLocation: './mochatest.json'
publishTestResults type:'code', fileLocation: './tests/coverage/reports/coverage-summary.json'
publishTestResults type:'fvt', fileLocation: './mochafvt.json', environment: 'STAGING'
publishTestResults type:'staticsecurityscan', fileLocation: './static-result.xml'
publishTestResults type:'dynamicsecurityscan', fileLocation: './dynamic-result.xml'
publishTestResults type:'vulnerabilityadvisor', fileLocation: './vulnerability-advisor.json'
publishTestResults type:'fvt', fileLocation: './mochafvt.json', environment: 'STAGING'
publishTestResults type:'staticsecurityscan', fileLocation: './static-result.xml'
publishTestResults type:'dynamicsecurityscan', fileLocation: './dynamic-result.xml'
publishTestResults type:'vulnerabilityadvisor', fileLocation: './vulnerability-advisor.json'

For each command, you need to specify the toolchain ID to export the environment variable. For more information, see [Environment variables and definitions](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-publish-build-jenkins).





 Publishing SonarQube results (optional) 

After you configure a SonarQube scanner and server by following the instructions in the [SonarQube documentation](https://docs.sonarqube.org/latest/analysis/scan/sonarscanner-for-jenkins/), you can publish scan results to DevOps Insights.

To configure your Jenkins pipeline to accept these results, add the following parameters to it:



Table 4. Test result and test types

 Parameter Definition 

 SQHostURL The host portion of your SonarQube scanner's URL from your SonarQube server. 
 SQAuthToken Your SonarQube API authentication token from your SonarQube server. 
 SQProjectKey The project key of the SonarQube project you want to scan. 
 buildNumber Optional: The set value to any string that represents version number. 
 applicationName Optional: Set the application name. If this value is set, the environment variable IBM_CLOUD_DEVOPS_APP_NAME is ignored. 



Here are the SonarQube parameters that are used in a sample stage:

stage ('SonarQube analysis') {
steps {
script {
def scannerHome = tool 'Default SQ Scanner';
withSonarQubeEnv('Default SQ Server') {
System and Services Acquisition (SA) [SA-3 System Development Life Cycle](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-3) <br>[SA-8 Security Engineering Principles](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-8) <br>[SA-10 Developer Configuration Management](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-10) <br>[SA-10 (1) Developer Configuration Management | Software and Firmware Integrity Verification](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-10.1) <br>[SA-11 Developer Security Testing and Evaluation](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-11) <br>[SA-15 Development Process, Standards, and Tools](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-15) <br>[SA-15 (9) Development Process, Standards, and Tools | Use of Live Data](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-sa-15.9) 
 Risk Assessment (RA) [RA-5 Vulnerability Scanning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-5) 







 11. Encrypt consumer data at rest and in transit 

Requirement: Encrypt all consumer data whether at rest or in transit.

Purpose & value: Consumers do not want their data to be accessible to bad actors. Protecting consumer data against unauthorized disclosure, modification, or destruction throughout the data lifecycle is of paramount importance in the IBM Cloud for Financial Services.
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.code_bom_check",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.cloud.image_signing",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.acceptance_tests",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.cloud.image_vulnerability_scan",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.dynamic_scan",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
}
]
}
],
"post-deployment": [
{
"asset_type": "image",
"evidences":
{
"evidence_type_id": "com.ibm.prod_change_request",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
(https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards).



Table 5. Responsibilities for security and regulation compliance

 Resource IBM responsibilities Your responsibilities 

 General <br><br> * Maintain controls commensurate to [various industry compliance standards](https://cloud.ibm.com/docs/containers?topic=containers-faqsstandards), such as PCI DSS. Compliance to industry standards varies depending on the infrastructure provider of the cluster, such as classic or VPC.<br> * Monitor, isolate, and recover the cluster master.<br> * Provide highly available replicas of the Kubernetes master API server, etcd, scheduler, and controller manager components to protect against a master outage.<br> * Monitor and report the health of the master and worker nodes in the various interfaces.<br> * Automatically apply master security patch updates, and provide worker node security patch updates.<br> * Enable certain security settings, such as encrypted disks on worker nodes.<br> * Disable certain insecure actions for worker nodes, such as not permitting users to SSH into the host.<br> * Encrypt communication between the master and worker nodes with TLS.<br> * Provide CIS-compliant Linux images for worker node operating systems.<br> * Continuously monitor master and worker node images to detect vulnerability and security compliance issues.<br> * Provision worker nodes with two local SSD, AES 256-bit encrypted data partitions.<br> * Provide options for cluster network connectivity, such as public and private cloud service endpoints.<br> * Provide options for compute isolation, such as dedicated virtual machines or bare metal.<br> * Integrate Kubernetes role-based access control (RBAC) with IBM Cloud Identity and Access Management (IAM).<br><br><br> <br><br> * Set up and maintain security and regulation compliance for your apps and data.
Compliance to industry standards varies depending on the infrastructure provider of the cluster, such as classic or VPC.<br> * Monitor, isolate, and recover the cluster master.<br> * Provide highly available replicas of the Kubernetes master API server, etcd, scheduler, and controller manager components to protect against a master outage.<br> * Monitor and report the health of the master and worker nodes in the various interfaces.<br> * Automatically apply master security patch updates, and provide worker node security patch updates.<br> * Enable certain security settings, such as encrypted disks on worker nodes.<br> * Disable certain insecure actions for worker nodes, such as not permitting users to SSH into the host.<br> * Encrypt communication between the master and worker nodes with TLS.<br> * Provide CIS-compliant Linux images for worker node operating systems.<br> * Continuously monitor master and worker node images to detect vulnerability and security compliance issues.<br> * Provision worker nodes with two local SSD, AES 256-bit encrypted data partitions.<br> * Provide options for cluster network connectivity, such as public and private cloud service endpoints.<br> * Provide options for compute isolation, such as dedicated virtual machines or bare metal.<br> * Integrate Kubernetes role-based access control (RBAC) with IBM Cloud Identity and Access Management (IAM).<br><br><br> <br><br> * Set up and maintain security and regulation compliance for your apps and data. For example, choose how to set up your [cluster network](https://cloud.ibm.com/docs/containers?topic=containers-plan_clusters), [protect sensitive information](https://cloud.ibm.com/docs/containers?topic=containers-encryption) such as with IBM Key Protect encryption, and configure further [security settings](https://cloud.ibm.com/docs/containers?topic=containers-securitysecurity) to meet your workload's security and compliance needs.
"expired_issues": 134,132,342], // link(s) to the issues for which the grace period expired
"issues": 234,343,342], // link(s) to the issue(s) created to track the bugs found during the test run. Should be populated only if the scan failed
"required": "yes" | "no" ] // yes: this is an auditable step; no: this is a non auditable step
}, {
"evidence_type_id": "com.ibm.vulnerability_scan",
"version": "1.0.0",
"date": "2020-05-06T12:00:00Z", // date of task run
"origin": {
"url":"https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines/-/blob/master/definitions/mytask.yaml", // where the task is taken from
"version": "423792" // commit id representing the task version used to produce the evidence
}
"toolchain_crn": "crn:v1:bluemix:public:toolchain:us-south:a/190e0b4ce4cd013159917665213ddc51:7467a214-f404-4e23-acab-2e57e935d138::" // CRN of the toolchain
"pipeline_id": "b1cfb6a4-813d-4fec-bbf7-ce662e8ce4e0", // the id of the pipeline that generated this piece of evidence
"pipeline_run_id": 12345, // this is the id of the pipeline run that generated this piece of evidence
"result": "passed"|"failed"],/ the result of the scan
"log": {
"url": "https://acme.org/log.txt", // the link to where the actual log of the test is
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.unit_tests",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.static_scan",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.detect_secrets",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.code_vulnerability_scan",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.code_cis_check",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"evidence_type_id": "com.ibm.code_bom_check",
"rules": {
"required": ],
"optional":
{
"tool": ""
}
],
"ignore": ]
}
},
{
"date": "2022-04-20T09:33:43.782Z",
"evidence_type_id": "com.ibm.code_vulnerability_scan",
"evidence_type_version": "1.0.0",
"details": {
"result": "failure",
"tool": "cra"
},
"origin": {
"toolchain_crn": "crn:v1:bluemix:public:toolchain:us-south:a/779c0808c946b9e15cc2e63013fded8c:68213c68-4794-4d5e-ab50-f33d0d6190e4::",
"pipeline_id": "c17f18a6-24dd-4949-abb7-2b374f4691b6",
"pipeline_run_id": "d7a88836-72a1-402b-bb28-701439a543ae",
"pipeline_run_url": "https://cloud.ibm.com/devops/pipelines/tekton/c17f18a6-24dd-4949-abb7-2b374f4691b6/runs/d7a88836-72a1-402b-bb28-701439a543ae/code-compliance-checks/run-stage/?env_id=ibm:yp:us-south",
"scope": "117458e26512b0308d93cf6852958e5e875294a982d2b4ea2e9f463b4551a846"
},
"assets": [
{
"hash": "cdd3ee20188d2f5bfb7f14bdb9c7fa99b22184ca195d9fa0a953dfbe9b1769cb",
: The buildpack includes Liberty feature microProfile-1.2.





 26 January 2018 

Updated Liberty buildpack v3.17-20180122-1037
: The buildpack was updated to add the ability to dynamically set tracing on the Liberty server.



* The monthly Liberty runtime version was updated to 2018.1.0.0.
* The IBM JRE version was updated to 8 SR5 FP7.







 8 January 2018 

Updated Node.js buildpack v3.17
: The SDK for Node.js buildpack v3.17 provides IBM SDK for Node.js versions 4.8.5, 4.8.7, 6.12.0, 6.12.2, 8.9.0 and 8.9.3. The default is latest 6.x, so it is currently 6.12.2.





 5 January 2018 

Updated Liberty buildpack v3.16-20180102-0938
: The default Liberty runtime version was updated to the 17.0.0.4 release



* The monthly Liberty runtime version was updated to 2017.12.0.0.
* The IBM JRE version was updated to 8 SR5 FP6.







 11 December 2017 

Updated Node.js buildpack v3.16.1
: The SDK for Node.js buildpack v3.16.1 provides IBM SDK for Node.js versions v4.8.4, v4.8.5, v6.11.4, v6.12.0, v8.6.0, v8.9.0. The default is latest 6.x, so it is currently 6.12.0.

Please note that it fixes PSIRT Advisory ID: 10237 Product Record ID: 104487 Title: Node.js zlib DOS security vulnerability, October 2017 (CVE-2017-14919). It is recommended to upgrade to v3.16.1 to get fixes for security vulnerabilities affecting 8.6.0.0 and earlier, 6.10.2.0 to 6.11.4.0 and 4.8.2.0 to 4.8.4.0.





 1 November 2017
[“Develop and deploy an app by using IBM Cloud Satellite" toolchain](https://cloud.ibm.com/devops/setup/deploy?repository=https://github.com/open-toolchain/secure-app-toolchain)<br><br>Available in Dallas, Washington, Toronto, Sao Paulo, Frankfurt, Tokyo, Sydney, Osaka, and London With this toolchain, you can develop and deploy an application to a single IBM Cloud® Kubernetes Service, a Red Hat® OpenShift® on IBM Cloud® cluster, or to multiple clusters by using IBM Cloud Satellite. By default, the toolchain uses a sample Node.js "Hello World" app, but you can link to your own app instead. This toolchain is preconfigured for continuous delivery with Vulnerability Advisor, Code Risk Analyzer, source control, issue tracking, and online editing.<br><br>Try the tutorial: [Develop and deploy an app by using IBM Cloud Satellite](https://cloud.ibm.com/docs/ContinuousDelivery?topic=ContinuousDelivery-tutorial-cd-satellite) Delivery Pipeline<br><br>Git Repos and Issue Tracking<br><br>IBM Secrets Manager<br><br>IBM Cloud® DevOps Insights 
 [“Deploy Kubernetes resources to multiple clusters by using IBM Cloud Satellite" toolchain](https://cloud.ibm.com/devops/setup/deploy?repository=https://github.com/open-toolchain/satellite-cd-toolchain)<br><br>Available in Dallas, Washington, Toronto, Sao Paulo, Frankfurt, Tokyo, Sydney, Osaka, and London With this toolchain, you can deploy to multiple Red Hat® OpenShift® clusters that are hosted on IBM Cloud Satellite. By default, the toolchain uses a sample Golang "Hello World" app, but you can link to your own app instead.
VRVDR-56315 7.5 DLA-2788-1 CVE-2021-41991: Debian DLA-2788-1: A denial-ofservice vulnerability in the in-memory certificate 









 1912r 



 Issues Resolved 



Issues resolved for 1912r

 Issue Number Priority Summary 

 VRVDR-56188 Critical bgpd dumps core in as_list_apply() 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1912r

 Issue Number CVSS score Advisory Summary 

 VRVDR-56321 7.5 DLA-2786-1 CVE-2018-1000168, CVE-2020-11080: Debian DLA-2786-1 : nghttp2 - LTS security update 
 VRVDR-56308 7.4 DLA-2780-1 CVE-2021-31799, CVE-2021-31810, CVE-2021-32066: Debian DLA-2780-1 : ruby2.3 - LTS security update 
 VRVDR-56295 5.5 DLA-2784-1 CVE-2020-21913: Debian DLA-2784-1 : icu - LTS security update 
 VRVDR-56230 7.5 DLA-2777-1 CVE-2020-19131, CVE-2020-19144: Debian DLA-2777-1 : tiff - LTS security update 
 VRVDR-56229 7.4 DLA-2774-1 CVE-2021-3712: Debian DLA-2774-1 : openssl1.0 - LTS security update 
 VRVDR-56228 7.5 DLA-2773-1 CVE-2021-22946, CVE-2021-22947: Debian DLA-2773-1 : curl - LTS security update 
 VRVDR-56221 6.5 DLA-2771-1 CVE-2018-5729, CVE-2018-5730, CVE-2018-20217, CVE-2021-37750: Debian DLA-2771-1 : krb5 - LTS security update
* The buildpack also contains security fixes for the [Apache Standard Taglibs vulnerability](https://www.ibm.com/support/pages/node/282471).







 10 June 2016 

Updated ASP.NET Core buildpack v0.8.1-20160526-0957
: This version of the buildpack includes the following changes:



* The runtime's name is changed from ASP.NET 5 to ASP.NET Core.
* The buildpack version number is included in detect script output.
* This version of the buildpack removes support for DNX based apps using CoreCLR RC1 and lower.
* This version of the buildpack supports the .NET CLI and .NET Core RC2.
* The buildpack detects projects with either a project.json file or .runtimeconfig.json files from publish output.







 25 May 2016 

Updated Liberty buildpack v2.9-20160519-1249
: The buildpack contains an updated version of WebSphere Liberty based on the [May beta](https://developer.ibm.com/wasdev/blog/2016/05/06/beta-websphere-liberty-and-tools-may-2016/). The updated version of Liberty makes the bluemixLogCollector-1.1 and logstashCollector-1.1 beta features available in IBM Cloud.





 20 May 2016 

Updated Node.js buildpack v3.4-20160518-1653
: This release of the buildpack adds IBM SDK for Node.js runtime versions 0.10.45, 0.12.14, 4.4.4, 6.0.0, and 6.1.0. The default is now 4.4.4.

Included are fixes for the following security vulnerabilities:



* [CVE-2015-8855](https://www.ibm.com/support/pages/node/278621)