vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Use the following command to extract the encrypted env section:

echo "hyper-protect-basic.${ENCRYPTED_PASSWORD}.${ENCRYPTED_ENV}"



Steps 4 - 8 are used to encrypt the env section. If you choose to not encrypt this section, skip these steps.





 Preparing the signature 

Complete the following steps on an Ubuntu system, to prepare the signature:

If you have got the encrypted user-data.yaml from the [Creating the encrypted workload section of a contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt_workload) and [Creating encrypted env section of a contract](https://cloud.ibm.com/docs/vpc?topic=vpc-about-contract_sehpcr_contract_encrypt_env) sections, skip to step 3.



1. Get the encrypted workload.yaml and encrypted env.yaml files.
2. Add them into the user-data.yaml file.

workload: hyper-protect-basic.js7TGt77EQ5bgTIKk5C0pViFTRHqWtn..............
env: hyper-protect-basic.VWg/5/SWE+9jLfhr8q4i.........
3. Create the contract.txt file. Add the value of workload first then add the value of env from the user-data.yaml file. Ensure that there is no space or new line after workload and before env. Also, ensure that there is no new line or space at the end of the file. It is recommended to cross-check the binary content of the contract.txt file with tools such as hexdump. In the binary file dump, make sure that you do not see the 0a ASCII value as the last entry.
loop0 7:0 0 600M 0 loop /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/centos01-flat.vmdk_0
loop1 7:1 0 67.2M 1 loop /snap/lxd/21835
loop2 7:2 0 61.9M 1 loop /snap/core20/1242
loop3 7:3 0 55.5M 1 loop /snap/core18/2246
loop4 7:4 0 32.5M 1 loop /snap/snapd/13640
loop5 7:5 0 61.9M 1 loop /snap/core20/1169
loop6 7:6 0 42.2M 1 loop /snap/snapd/13831
loop7 7:7 0 67.2M 1 loop /snap/lxd/21803
loop8 7:8 0 55.5M 1 loop /snap/core18/2253
loop9 7:9 0 1G 0 loop /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/centos01-flat.vmdk_1
loop10 7:10 0 1.6G 0 loop
loop11 7:11 0 12.8G 0 loop /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/cl-root
Show more

For example, if the target server installs ClamAV, the following command scans the centos01 VM file system in the mounted backup file for malware clamscan -r -i /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/cl-root.





 Related links
For more information, see [Region and data center locations for resource deployment](https://cloud.ibm.com/docs/overview?topic=overview-locations), [Setting up access to classic infrastructure](https://cloud.ibm.com/docs/vpc?topic=vpc-setting-up-access-to-classic-infrastructure&interface=ui), and [Dedicated host profiles](https://cloud.ibm.com/docs/vpc?topic=vpc-dh-profiles&interface=ui).





 20 June 2023 

IBM Hyper Protect Container Runtime image ibm-hyper-protect-container-runtime-1-0-s390x-11 updates
: For the IBM Hyper Protect Container Runtime image version ibm-hyper-protect-container-runtime-1-0-s390x-11, new certificates are available.



* [Attestation certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-11-attestation.crt)
* [Encryption certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-11-encrypt.crt)
* [Intermediate certificate](https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-11-intermediate.crt)



Support for customer-managed keys through integration with Hyper Protect Crypto Services



* Without the feature, the data volume that you attach to your instance is encrypted automatically with a LUKS passphrase generated by using the two seeds from the workload - volumes and env - volumes sections of the contract.
loop11 7:11 0 12.8G 0 loop /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/cl-root
Show more

For example, if the target server installs ClamAV, the following command scans the centos01 VM file system in the mounted backup file for malware clamscan -r -i /tmp/Veeam®.Mount.FS.b2811b87-5bf4-4056-8134-21ce9555dca7/cl-root.





 Related links 



* [Veeam vPower NFS service](https://helpcenter.veeam.com/docs/backup/vsphere/vpower_nfs_service.html?ver=120)
* [Veeam data integration API](https://helpcenter.veeam.com/docs/backup/vsphere/data_integration_api.html?ver=120)
[Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 vApp: Use Console ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 vApp: View ACL ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) 
 vApp: View VM and VM's Disks Encryption Status ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) ![Available](https://cloud.ibm.com/docs-content/v1/content/icons/checkmark-icon.svg) !
For more information, see [Update IAM restricted IP address lists by 23 June 2022](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_notices_iam_private_network) and [Permit worker nodes to communicate with IBM Cloud Container Registry](https://cloud.ibm.com/docs/openshift?topic=openshift-firewallfirewall_private_container_registry).

New! Enable volume encryption in OpenShift Data Foundation by using Hyper Protect Crypto Services.
: For more information, see [Deploying OpenShift Data Foundation on VPC clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-vpc) and [Deploying OpenShift Data Foundation on Classic clusters](https://cloud.ibm.com/docs/openshift?topic=openshift-deploy-odf-classic). Note that volume encryption is available with add-on version 4.10 and later.

New! Version 4.10.0 of the OpenShift Data Foundation add-on is available.
: For more information, see the [change log](https://cloud.ibm.com/docs/openshift?topic=openshift-odf_addon_changelog).





 16 May 2022 

Cluster autoscaler add-on
: Versions 1.0.5_628 and 1.1.0_615 are available. See [Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog).

ALB OAuth Proxy add-on
: Version 1.0.0 is no longer supported. For more information, see the [change log](https://cloud.ibm.com/docs/containers?topic=containers-alb-oauth-proxy-changelog).





 12 May 2022 

Block Storage for VPC add-on.
* IBM Cloud retains a set of [user IDs](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-audit_user_ids) in your instance. You can disable or revoke these user IDs. When you need to restore IBM Cloud access, for example, to deploy a new host, you must re-enable these accounts. If you changed the password for these accounts, you must open a support ticket to provide the updated password to IBM Cloud.







 About customer-managed keys 

For vCenter Server, envelope encryption is used to offer customer–managed keys. For VMware Shared, envelope encryption is used but with IBM–managed rather than customer–managed keys.

Envelope encryption within VMware Solutions uses the [KMIP for VMware service](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip_standalone_considerations) to provide key management for VMware vSphere® encryption or vSAN encryption.

In both cases, these offerings use IBM Cloud Key Protect or IBM Cloud Hyper Protect Crypto Services for key wrapping and unwrapping. Key Protect offers Bring Your Own Key (BYOK) capability by using FIPS 140–2 level 3 certified hardware security modules (HSMs). Hyper Protect Crypto Services offers Keep Your Own Key (KYOK) capability by using FIPS 140–2 level 4 certified HSMs.





 Enabling customer-managed keys for VMware Solutions 

You can use IBM Cloud key management with VMware vSphere or vSAN encryption. For more information, see the [KMIP for VMware implementation guide](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-kmip-implementation).





 Working with customer-managed keys for VMware Solutions 

For more information about considerations for VMware key management, key revocation, and key rotation, see:
"scan_issues": 123, 342, 453], // link(s) to the issues found by the scan (X-Ray)
"expired_issues": 134, 132, 342], // link(s) to the issues for which the grace period expired
"required": "yes"|"no"] // yes: this is an auditable step; no: this is a non auditable step
}, {
"evidence_type_id": "com.ibm.container_images",
"version": "1.0.0",
"date": "2020-05-06T12:00:00Z", // date of the scan
"origin": {
"url":"https://us-south.git.cloud.ibm.com/open-toolchain/compliance-pipelines/-/blob/master/definitions/mytask.yaml", // where the task is taken from
"version": "423792" // commit id representing the task version used to produce the evidence
}
"toolchain_crn": "crn:v1:bluemix:public:toolchain:us-south:a/190e0b4ce4cd013159917665213ddc51:7467a214-f404-4e23-acab-2e57e935d138::" // CRN of the toolchain
"pipeline_id": "b1cfb6a4-813d-4fec-bbf7-ce662e8ce4e0", // the id of the pipeline that generated this piece of evidence
"pipeline_run_id": 12345, // this is the id of the pipeline run that generated this piece of evidence
"artifact_name": "mybaseimage", //name of the dependent artifact
"checksum": "324334", // checksum or digital isgnature
"verified": "yes"|"no"], // checksum verified or not
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) 
 NGFW Add-ons (IPS, AV, WF) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/09179fd478349810f8adb559294b68138ac393ca/hardware-firewall-shared/includes/icons/checkmark-icon.svg) TLS encryption, IP Firewall rules, and Proxy Protocol v1
![Validation by control](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/cd-devsecops-validation-by-control.png)

Figure 3. Validation by control

Zoom

![Validation by resource](https://cloud.ibm.com/docs-content/v1/content/5eb88a2575e30e316dbb83829c7f4c8b1ddbc67c/devsecops/images/cd-devsecops-validation-by-resource.png)

Figure 4. Validation by resource

The 10 entries that are shown in Figure 4 map to the individual evidence fragments gathered in the CI pipeline. In this evidence sample, all the validations passed. There might be cases when few validations are classified as Fail or as Unable to perform. This situation can occur when a validation check finds no corresponding evidence, for example if task is removed or skipped in the CI pipeline. This condition might occur when a deployment is performed by using the CD EMERGENCY process to override the evidence failures. It is to be noted here that while it is possible to deploy an image with imperfect validations, these facts are reported on inspection in Security and Compliance Center.

To explore toolchains in Security and Compliance Center, it might be a useful start to learn about [managing scopes](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-scopes) in the [Security and Compliance Center documentation](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started).
VRVDR-45067 Critical vyatta-security-vpn: set security vpn ipsec site-to-site peer $CODE / code injection 
 VRVDR-45066 Critical vyatta-security-vpn: check_file_in_config passed unsanitized user input / code injection 
 VRVDR-45065 Critical vyatta-security-vpn-secrets: code injection 
 VRVDR-40303 Critical fsck doesn't seem to be running on boot 







 Security Vulnerabilities Resolved 



Security vulnerabilities resolved for 1801zf

 Issue Number CVSS score Advisory Summary 

 VRVDR-51236 8.6 DSA-4689-1 CVE-2019-6477, CVE-2020-8616, CVE-2020-8617: Debian DSA-4689-1 : bind9 - security update 
 VRVDR-51142 5.5 DSA-4685-1 CVE-2020-3810: Debian DSA-4685-1 : apt - security update 
 VRVDR-50886 8.8 DSA-4670-1 CVE-2018-12900, CVE-2018-17000, CVE-2018-17100, CVE-2018-19210, CVE-2019-7663, CVE-2019-14973, CVE-2019-17546 : Debian DSA-4670-1 : tiff - security update 
 VRVDR-50851 7.5 DSA-4666-1 CVE-2020-12243: Debian DSA-4666-1 : openldap - security update 
 VRVDR-50498 8.8 DSA-4646-1 CVE-2020-10531: Debian DSA-4646-1 : icu - security update 
 VRVDR-50166 9.8 DSA-4633-1 CVE-2019-5436, CVE-2019-5481, CVE-2019-5482: Debian DSA-4633-1 : curl - security update
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-2additional-ibm-cloud-for-financial-services-specifications)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-2nist-supplemental-guidance)



[RA-3 - Risk Assessment](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-3ra-3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-3control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-3additional-ibm-cloud-for-financial-services-specifications)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-3nist-supplemental-guidance)



[RA-5 - Vulnerability Scanning](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-5ra-5)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-5control-requirements)
* [Additional IBM Cloud for Financial Services specifications](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-ra-5additional-ibm-cloud-for-financial-services-specifications)
Activity Tracker Event Routing provides for either event routing or [hosted event search](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-getting-started-search). However, only the event routing features of Activity Tracker Event Routing are Financial Services Validated. In regions where it's available, you must configure Activity Tracker Event Routing event routing to send events to Object Storage, where they must be encrypted with KYOK.

Activity Tracker Event Routing event routing is only available in some regions (see [Locations for Activity Tracker Event Routing event routing](https://cloud.ibm.com/docs/activity-tracker?topic=activity-tracker-regionsregions-atracker) for more details). For regions where it's not available, you must use Activity Tracker Event Routing hosted event search until Activity Tracker Event Routing event routing is available. When event routing becomes available in those regions, you must switch to use event routing. For more information and possible exceptions, see [Use only services that are IBM Cloud for Financial Services Validated](https://cloud.ibm.com/docs/framework-financial-services?topic=framework-financial-services-best-practicesbest-practices-financial-services-validated-services).





 IBM Cloud® Security and Compliance Center 

With [IBM Cloud® Security and Compliance Center](https://cloud.ibm.com/docs/security-compliance?topic=security-compliance-getting-started) you can embed security checks into your every day workflows to help monitor for security and compliance. By monitoring for risks, you can identify security vulnerabilities and quickly work to mitigate the impact and fix the issue. By using Security and Compliance Center along with [external integrations](https://cloud.ibm.com/security-compliance/integrations) (such as, OpenShift Compliance Operator (OSCO), Tanium, NeuVector, and so on), you can build a robust approach for monitoring for security and compliance issues.





 IBM Cloud Flow Logs for VPC
* [Collecting the metadata](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-metadata) - VUM downloads metadata about the upgrades, patches, or extensions through a predefined automatic process that you can modify. At regular configurable intervals, VUM contacts VMware, or third-party sources, to gather the most recent metadata about available upgrades, patches, or extensions.
* [Creating baselines](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-baselines) - Use the pre-defined baselines and baseline groups or create custom ones. Baselines and baseline groups are then attached to inventory objects.
* [Scanning and review](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-scanning) - Inventory objects are scanned, and the results are reviewed to determine how they comply with the baselines and baseline groups. Scan results can be filtered by text search, group selection, baseline selection, and compliance status selection.
* [Staging and remediation](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-staging) - Patches and extensions can be optionally staged before remediation to ensure that they are downloaded to the host. During remediation, VUM applies the patches, extensions, and upgrades to the inventory objects.





This document assumes that you have one primary vCenter Server instance that is deployed, or a number of separate primary vCenter Server instances. If you have primary and secondary vCenter Server instances that are deployed and that use Single Sign On (SSO), see [SSO-linked vCenters](https://cloud.ibm.com/docs/vmwaresolutions?topic=vmwaresolutions-vum-updating-vcsa).
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to arbitrary code execution in Git (CVE-2022-41903)](https://www.ibm.com/support/pages/node/6981861)







 23 February 2023 (Version 4.6.3) 

Version 4.6.3 is now available
: Speech to Text for IBM Cloud Pak for Data version 4.6.3 is now available. This version supports IBM Cloud Pak for Data version 4.6.x and Red Hat OpenShift version 4.10. Red Hat OpenShift version 4.8 is no longer supported. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

Important: All previous-generation models are deprecated and will reach end of service on 31 July 2023
: Important: All previous-generation models are deprecated and will reach end of service effective 31 July 2023. On that date, all previous-generation models will be removed from the service and the documentation. The previous deprecation date was 3 March 2023. The new date allows users more time to migrate to the appropriate next-generation models. But users must migrate to the equivalent next-generation model by 31 July 2023.

Most previous-generation models were deprecated on 15 March 2022. Previously, the Arabic and Japanese models were not deprecated. Deprecation now applies to all previous-generation models.



* For more information about the next-generation models to which you can migrate from each of the deprecated models, see [Previous-generation languages and models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models)
* For more information about migrating from previous-generation to next-generation models, see [Migrating to next-generation models](https://cloud.ibm.com/docs/speech-to-text?topic=speech-to-text-models-migrate).
Review the version history for the ibm-vpc-block-csi-driver Satellite storage template.



 Version 5.0 



 Revision 11, released 19 June 2023 



* Resolves the following CVEs: [CVE-2022-43552](https://nvd.nist.gov/vuln/detail/CVE-2022-43552)[CVE-2022-3204](https://nvd.nist.gov/vuln/detail/CVE-2022-3204)[CVE-2023-27535](https://nvd.nist.gov/vuln/detail/CVE-2023-27535)[CVE-2022-36227](https://nvd.nist.gov/vuln/detail/CVE-2022-36227)[CVE-2022-35252](https://nvd.nist.gov/vuln/detail/CVE-2022-35252)[CVE-2023-29403](https://nvd.nist.gov/vuln/detail/CVE-2023-29403)[CVE-2023-29404](https://nvd.nist.gov/vuln/detail/CVE-2023-29404)[CVE-2023-29405](https://nvd.nist.gov/vuln/detail/CVE-2023-29405)[CVE-2023-29402](https://nvd.nist.gov/vuln/detail/CVE-2023-29402)[CVE-2023-29400](https://nvd.nist.gov/vuln/detail/CVE-2023-29400)[CVE-2023-24540](https://nvd.nist.gov/vuln/detail/CVE-2023-24540)[CVE-2023-24539](https://nvd.nist.gov/vuln/detail/CVE-2023-24539)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow](https://www.ibm.com/support/pages/node/6523816)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Node.js](https://www.ibm.com/support/pages/node/6523818)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Netty](https://www.ibm.com/support/pages/node/6523820)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j](https://www.ibm.com/support/pages/node/6526072)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Apache Log4j 1.2](https://www.ibm.com/support/pages/node/6526478)



Features that are not available in this release
: The following features are generally available from IBM Cloud deployments at the time of this release, but not from installed deployments:



* Home page updates
* Answer finding







 4.0.3 release, 30 November 2021 

IBM Watson® Discovery Cartridge for IBM Cloud Pak® for Data 4.0.3 is available.

Another storage option is supported
: IBM Spectrum Scale Container Native storage is now supported in addition to Red Hat OpenShift Container Storage and Portworx.

Microsoft SharePoint Online data source improvement
: The Sharepoint Online data source now supports crawling your data as a service principal, which means you can access your data without disabling multifactor authentication. For more information, see [Microsoft Sharepoint Online](https://cloud.ibm.com/docs/discovery-data?topic=discovery-data-connector-sharepoint-online-cp4d).

Microsoft Windows File System improvements
: Extra configuration options mean you can specify the following information:



* The types of files (by file extension) to include or exclude from a crawl of a Windows directory.
* The character encoding of the data to be crawled.