vania-janet/multiturn-rag-retrieval-data huggingface dataset:
Version (ibmcloud workload-protection) CLI 

The IBM Cloud® Security and Compliance Center Workload Protection version CLI option lets you determine the version of IBM Cloud Security and Compliance Center Workload Protection CLI that is running on your account.

You can use wp, sysdig-secure, security-compliance-secure, or scs as aliases for the workload-protection commands. For example, you can run ibmcloud wp policy create ..., ibmcloud sysdig-secure policy create ..., ibmcloud security-compliance-secure policy create ..., or ibmcloud scs policy create ... for ibmcloud workload-protection policy create ....



  ibmcloud workload-protection 

This command returns the version of IBM Cloud Security and Compliance Center Workload Protection CLI that is being run on your account.

ibmcloud workload-protection (-v | --version)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-14nist-supplemental-guidance)



[PE-15 - Water Damage Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-15pe-15)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-15control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-15nist-supplemental-guidance)



[PE-17 - Alternate Work Site](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-17pe-17)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-17control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-17nist-supplemental-guidance)







 Planning (PL) 

[PL-1 - Security Planning Policy and Procedures](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-1pl-1)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-1control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pl-1nist-supplemental-guidance)
* [RHSA-2021:1581](https://access.redhat.com/errata/RHSA-2021:1581)
* [RHSA-2021:1585](https://access.redhat.com/errata/RHSA-2021:1585)
* [RHSA-2021:1586](https://access.redhat.com/errata/RHSA-2021:1586)
* [RHSA-2021:1593](https://access.redhat.com/errata/RHSA-2021:1593)
* [RHSA-2021:1597](https://access.redhat.com/errata/RHSA-2021:1597)
* [RHSA-2021:1609](https://access.redhat.com/errata/RHSA-2021:1609)
* [RHSA-2021:1610](https://access.redhat.com/errata/RHSA-2021:1610)
* [RHSA-2021:1611](https://access.redhat.com/errata/RHSA-2021:1611)
* [RHSA-2021:1627](https://access.redhat.com/errata/RHSA-2021:1627)
* [RHSA-2021:1675](https://access.redhat.com/errata/RHSA-2021:1675)
* [RHSA-2021:1679](https://access.redhat.com/errata/RHSA-2021:1679)
* [RHSA-2021:1702](https://access.redhat.com/errata/RHSA-2021:1702)







 Version 4.5.0_679, released on 22 Apr 2021 



* Nettle vulnerabilities for [CVE-2021-20305](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-20305)
Cluster master HA proxy 2.0.1-alpine 1.8.21-alpine Moved to HA proxy 1.8 to fix [socket leak in HA proxy](https://github.com/haproxy/haproxy/issues/136). Also added a liveliness check to monitor the health of HA proxy. For more information, see [HA proxy release notes](https://www.haproxy.org/download/1.8/src/CHANGELOG). 
 Ubuntu 16.04 kernel and packages 4.4.0-157-generic 4.4.0-159-generic Updated worker node images with package updates for [CVE-2019-13012](https://nvd.nist.gov/vuln/detail/CVE-2019-13012), [CVE-2019-1125](https://nvd.nist.gov/vuln/detail/CVE-2019-1125), [CVE-2018-5383](https://nvd.nist.gov/vuln/detail/CVE-2018-5383), [CVE-2019-10126](https://nvd.nist.gov/vuln/detail/CVE-2019-10126), and [CVE-2019-3846](https://nvd.nist.gov/vuln/detail/CVE-2019-3846).
Changes since version 1.20.5_1535

 Component Previous Current Description 

 HA proxy a3b1ff e0fa2f The update addresses [CVE-2021-20305](https://nvd.nist.gov/vuln/detail/CVE-2021-20305). 
 Ubuntu 18.04 packages N/A N/A Added resiliency to systemd units to prevent failures situations where the worker nodes are overused. Updated worker node images with kernel and package updates for [CVE-2018-13095](https://nvd.nist.gov/vuln/detail/CVE-2018-13095), [CVE-2021-20305](https://nvd.nist.gov/vuln/detail/CVE-2021-20305), [CVE-2021-29154](https://nvd.nist.gov/vuln/detail/CVE-2021-29154), and [CVE-2021-3348](https://nvd.nist.gov/vuln/detail/CVE-2021-3348).
Key Protect CLI Reference 

The latest version of the IBM® Key Protect for IBM Cloud® CLI plug-in provides a safe and efficient way to manage keys in your instance of Key Protect.

When you log in to the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started), you're notified when updates are available. Be sure to keep your CLI up-to-date so that you can use the commands and flags that are available for the Key Protect CLI plug-in.



 Notes 

To install and configure the Key Protect CLI plug-in, see the topic on [Setting up the CLI](https://cloud.ibm.com/docs/key-protect?topic=key-protect-set-up-cli).

The example showing how to use [region-set](https://cloud.ibm.com/docs/cli?topic=cli-key-protect-cli-referencekp-region-set-examples) outlines a critical step in configuration.



 Previous versions 

This documentation for version 0.6.12 does not include deprecated commands.

[Version 0.3.9](https://cloud.ibm.com/docs/key-protect?topic=key-protect-cli-reference-039) has documentation for deprecated commands.

All deprecated commands work in versions 0.4.0 and 0.5.2. That is, version 0.5.2 is backwards compatible with versions 0.3.9 and 0.4.0.





 Examples 

All commands have an Example section, which shows how to use the command in the context of a workflow.

The examples assume you have [openssl](https://www.openssl.org/) and [jq](https://stedolan.github.io/jq/) installed.

Many examples take advantage of an environment variable set for the session regarding the Key Protect Instance ID instead of the -i parameter. Variables set in this manner will be automatically used by the plug-in where appropriate and when needed.
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-12nist-supplemental-guidance)



[PE-13 - Fire Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-13pe-13)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-13control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-13nist-supplemental-guidance)



[PE-13 (3) - Automatic Fire Suppression](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-13.3pe-13.3)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-13.3control-requirements)



[PE-14 - Temperature and Humidity Controls](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-14pe-14)



* [Control requirements](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-14control-requirements)
* [NIST supplemental guidance](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-14nist-supplemental-guidance)



[PE-15 - Water Damage Protection](https://cloud.ibm.com/docs/framework-financial-services-controls?topic=framework-financial-services-controls-pe-15pe-15)
Video library 

[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-postgresql//images/video-thumbnail-gettingstarted.png)<br><br>Getting Started with IBM Cloud Hyper Protect DBaaS](https://mediacenter.ibm.com/media/0_2wa8vkxt)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-postgresql//images/video-thumbnail-scaling.png)<br><br>IBM Cloud Hyper Protect DBaaS–flexible pricing & vertical scaling](https://mediacenter.ibm.com/media/1_xr1y01a4)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-postgresql//images/video-thumbnail-KYOK.png)<br><br>IBM Cloud Hyper Protect DBaaS and Keep Your Own Key](https://mediacenter.ibm.com/media/0_35qih8zo)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-postgresql//images/video-thumbnail-security.png)<br><br>Safeguarding your sensitive data with IBM Cloud Hyper Protect DBaaS](https://mediacenter.ibm.com/media/1_hvum5c19)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-postgresql//images/video-thumbnail-overview.png)<br><br>Hyper Protect DBaaS Overview](https://mediacenter.ibm.com/media/1_na8bdczg)

 Learn more
Video library 

[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-mongodb//images/video-thumbnail-gettingstarted.png)<br><br>Getting Started with IBM Cloud Hyper Protect DBaaS](https://mediacenter.ibm.com/media/0_2wa8vkxt)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-mongodb//images/video-thumbnail-scaling.png)<br><br>IBM Cloud Hyper Protect DBaaS–flexible pricing & vertical scaling](https://mediacenter.ibm.com/media/1_xr1y01a4)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-mongodb//images/video-thumbnail-KYOK.png)<br><br>IBM Cloud Hyper Protect DBaaS and Keep Your Own Key](https://mediacenter.ibm.com/media/0_35qih8zo)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-mongodb//images/video-thumbnail-security.png)<br><br>Safeguarding your sensitive data with IBM Cloud Hyper Protect DBaaS](https://mediacenter.ibm.com/media/1_hvum5c19)[![carousel thumbnail](https://cloud.ibm.com/docs-content/v1/content/hyper-protect-dbaas-for-mongodb//images/video-thumbnail-overview.png)<br><br>Hyper Protect DBaaS Overview](https://mediacenter.ibm.com/media/1_na8bdczg)

 Learn more
* [IBM Hyper Protect Crypto Services CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-hpcs-cli-plugin) (ibmcloud tke)
* [IBM Hyper Protect Crypto Services Certificate manager CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-hpcs-cli-plugincert-manager-cli-plugin) (ibmcloud hpcs-cert-mgr)
* [IBM Hyper Protect Virtual Servers CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-hpvs_cli_plugin) (ibmcloud hpvs)
* [IBM Cloud Internet Services CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-cis-cli) (ibmcloud cis)
* [IBM Cloud Kubernetes Service CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-kubernetes-service-cli) (ibmcloud ks)
* [IBM Cloud Monitoring (ibmcloud monitoring) CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-monitor-cli) (ibmcloud monitoring)
* [IBM Cloud Object Storage CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-ic-cos-cli) (ibmcloud cos)
* [IBM Power Systems Virtual Server CLI plug-in](https://cloud.ibm.com/docs/cli?topic=cli-power-iaas-cli-reference) (ibmcloud pi)
* [IBM Cloud Privileged Access Gateway CLI plug-in](https://cloud.ibm.com/docs/privileged-access-gateway?topic=privileged-access-gateway-pag-cli-commands) (ibmcloud gateway)
FRA04 IBM Power VS SL-FRA04-IBMPOWERLAASLITE-1-1 <br>SL-FRA04-IBMPOWERLAASLITE-1-2 <br>xPowerVS-FRA04-10G-NOGRE-1-1 <br><br>[5] SL-FRA04-IBMPOWERLAASLITE-2-1 <br>SL-FRA04-IBMPOWERLAASLITE-2-2 <br>xPowerVS-FRA04-10G-NOGRE-1-2 <br><br>[6] 
 WDC04 IBM Power VS NNI-LINK-SL-WDC04-IBMPOWERLAASLITE-1-2 <br>xPowerVS-WDC04-10G-NOGRE-1-1 <br><br>[7] NNI-LINK-SL-WDC04-IBMPOWERLAASLITE-2-2 <br>xPowerVS-WDC04-10G-NOGRE-1-2 <br><br>[8] 
 WDC06 IBM Power VS IBM POWER VS-CLOUD EXCHANGE SL-WDC06-1-1 <br>IBM POWER VS-CLOUD EXCHANGE SL-WDC06-1-2 IBM POWER VS-CLOUD EXCHANGE SL-WDC06-2-1 <br>IBM POWER VS-CLOUD EXCHANGE SL-WDC06-2-2 
 WDC07 IBM Power VS SL-WDC07-IBMPOWERLAASLITE-1-1 <br>SL-WDC07-IBMPOWERLAASLITE-1-2 SL-WDC07-IBMPOWERLAASLITE-2-1 <br>SL-WDC07-IBMPOWERLAASLITE-2-2 
 DAL10 IBM Power VS SL-DAL10-IBMPOWERLAASLITE-1-1 <br>SL-DAL10-IBMPOWERLAASLITE-1-2 SL-DAL10-IBMPOWERLAASLITE-2-1 <br>SL-DAL10-IBMPOWERLAASLITE-2-2
* [Security Bulletin: IBM Watson Speech Services Cartridge for IBM Cloud Pak for Data is vulnerable to denial of service in Pypa Setuptools (CVE-2022-40897)](https://www.ibm.com/support/pages/node/6958142)







 30 January 2023 (Version 4.6.2) 

Version 4.6.2 is now available
: Text to Speech for IBM Cloud Pak for Data version 4.6.2 is now available. This version supports IBM Cloud Pak for Data version 4.6.x and Red Hat OpenShift versions 4.8 and 4.10. For more information, see [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

The custom resource now includes a new fileStorageClass property
: The custom resource for the Watson Speech services now includes a fileStorageClass property in addition to the existing blockStorageClass property. You specify both block and file storage classes when you install or upgrade a service. During upgrade from a previous version, the new property is added automatically to the custom resource by the --file_storage_class option on cli manage apply-cr command.

For more information about the available block and file storage classes you use with each of the supported storage solutions, see the table of Storage requirements under Information you need to complete this task on the page "Installing Watson Speech services" in [Watson Speech services on IBM Cloud Pak for Data](https://www.ibm.com/docs/en/cloud-paks/cp-data/4.6.x?topic=services-watson-speech).

Additional information about provisioning a service instance
: The documentation now includes information about creating a service instance programmatically. It also includes examples of listing service instances and deleting a service instance.
* IBM Watson Discovery for ICP for Data Add-on 2.2.x



For more information, see announcement [ENUS921-134.PDF](https://www.ibm.com/common/ssi/ShowDoc.wss?docURL=/common/ssi/rep_ca/4/897/ENUS921-134/index.html&request_locale=en).





 4.0.7 release, 30 March 2022 

IBM Watson® Discovery Cartridge for IBM Cloud Pak® for Data 4.0.7 is available.

IBM Cloud Block Storage is now supported
: When you install Discovery, you can specify IBM Cloud Block Storage Gold tier (ibmc-block-gold) as your storage class. For more information about the storage class, see [Storing data on classic IBM Cloud Block Storage](https://cloud.ibm.com/docs/containers?topic=containers-block_storage).

Security vulnerabilities were addressed
: The following security patches were applied:



* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in NumPy](https://www.ibm.com/support/pages/node/6564599)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Spring](https://www.ibm.com/support/pages/node/6564601)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in FasterXML jackson-databind](https://www.ibm.com/support/pages/node/6564603)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in TensorFlow](https://www.ibm.com/support/pages/node/6564605)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in XStream](https://www.ibm.com/support/pages/node/6564607)
* [Security Bulletin: IBM Watson Discovery for IBM Cloud Pak for Data affected by vulnerability in Go](https://www.ibm.com/support/pages/node/6564609)
: In VPC clusters, you can now [enable the PROXY protocol](https://cloud.ibm.com/docs/containers?topic=containers-comm-ingress-annotationspreserve_source_ip_vpc) for all load balancers that expose Ingress ALBs in your cluster. The PROXY protocol enables load balancers to pass client connection information that is contained in headers on the client request, including the client IP address, the proxy server IP address, and both port numbers, to ALBs.

Helm version 2 unsupported
: Removed all steps for using Helm v2, which is unsupported. [Migrate to Helm v3 today](https://helm.sh/docs/topics/v2_v3_migration/) for several advantages over Helm v2, such as the removal of the Helm server, Tiller.





 7 December 2020 

Key Protect enhancements
: For clusters that run 4.4.16_1513_openshift or later, your cluster now [integrates more features from Key Protect](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkms-keyprotect-features) when you enable Key Protect as the KMS provider for the cluster. When you enable this integration, a Reader[service-to-service authorization policy](https://cloud.ibm.com/docs/account?topic=account-serviceauth) between Red Hat OpenShift on IBM Cloud and Key Protect is automatically created for your cluster, if the policy does not already exist. If you have a cluster that runs an earlier version, [update your cluster](https://cloud.ibm.com/docs/containers?topic=containers-update) and then [re-enable KMS encryption](https://cloud.ibm.com/docs/openshift?topic=openshift-encryptionkeyprotect) to register your cluster with Key Protect again.

Worker node versions
: Worker node fix pack update change log documentation is available.
* [5.2 Pod Security Policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-52)
* [5.3 Network policies and CNI](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-53)
* [5.4 Secrets management](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-54)
* [5.5 Extensible admission control](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-55)
* [5.7 General policies](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-57)



* [IBM Remediations and explanations](https://cloud.ibm.com/docs/openshift?topic=openshift-benchmarks_49_coco-benchmark-49-remdiations)









 Add-on version history 

[Supported cluster add-on versions](https://cloud.ibm.com/docs/openshift?topic=openshift-supported-cluster-addon-versionssupported-cluster-addon-versions)

[Cluster autoscaler add-on change log](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelogca_changelog)



* [Version 1.1.0 (Beta)](https://cloud.ibm.com/docs/openshift?topic=openshift-ca_changelog0110_ca_addon)
Workload Protection (ibmcloud workload-protection) CLI 

The IBM Cloud® command-line interface (CLI) provides extra capabilities for service offerings. This information describes how you can use the CLI to access information in IBM Cloud Security and Compliance Center Workload Protection.

You can use wp, sysdig-secure, security-compliance-secure, or scs as aliases for the workload-protection commands. For example, you can run ibmcloud wp policy create ..., ibmcloud sysdig-secure policy create ..., ibmcloud security-compliance-secure policy create ..., or ibmcloud scs policy create ... for ibmcloud workload-protection policy create ....



 Prerequisites 



* Install the [IBM Cloud CLI](https://cloud.ibm.com/docs/cli?topic=cli-getting-started).
* Install the IBM Cloud Security and Compliance Center Workload Protection CLI by running the following command:

ibmcloud plugin install workload-protection

Alternately one of the following commands can be used to install the CLI:



* ibmcloud plugin install wp
* ibmcloud plugin install sysdig-secure
* ibmcloud plugin install security-compliance-secure
* ibmcloud plugin install scs





You are notified on the command line when updates to the IBM Cloud CLI and plug-ins are available. Be sure to keep your CLI up to date so that you can use the latest commands. You can view the current version of all installed plug-ins by running ibmcloud plugin list.





 Available CLIs 

IBM Cloud Security and Compliance Center Workload Protection provides the following CLIs:

[Compliance](https://cloud.ibm.com/docs/workload-protection-cli-plugin?topic=workload-protection-cli-plugin-workload-protection-compliance-cli)
: The compliance CLI lets you determine the available frameworks, platforms, and scope options as well as create and manage benchmark and compliance tasks.
* [Actions that generate events for exemption policies](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_api_methods_exemptions)



* [Analyzing Activity Tracker events](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze)



* [Request data for vulnerability events](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_vuln_events)



* [Request data for the account vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_report_list)
* [Request data for the account vulnerability status](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_status_list)
* [Request and response data for the vulnerability report](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_report_read)
* [Request and response data for the vulnerability status](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_analyze_status_read)



* [Request data for image signing events](https://cloud.ibm.com/docs/Registry?topic=Registry-at_eventsat_events_sign_events)





[Analyzing logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs)



* [Locations of platform services logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs_locations)
* [Where to look for IBM Log Analysis logs](https://cloud.ibm.com/docs/Registry?topic=Registry-registry_logsregistry_logs_region)
Starting from ibm-hyper-protect-container-runtime-1-0-s390x-7-encrypt.crt and ibm-hyper-protect-container-runtime-1-0-s390x-7-attestation.crt, the certificates will contain Certificate Revocation List (CRL) Distribution Points. You can use the CRL to verify that your certificates are valid (not revoked).



1. Extract and download the CRL URL from the attestation or encryption certificate:

openssl x509 -in "ibm-hyper-protect-container-runtime-1-0-s390x-11-encrypt.crt" -noout -ext crlDistributionPoints
crl_url=https://ibm.biz/hyper-protect-container-runtime-023BC9-crl-1 (example)
curl --location --silent "$crl_url" --output "ibm-hyper-protect-container-runtime.crl"
2. Verify that the CRL is valid (check valid dates and issuer):

openssl crl -text -noout -in "ibm-hyper-protect-container-runtime.crl"
3. Verify the CRL signature:

openssl x509 -in "ibm-hyper-protect-container-runtime-1-0-s390x-11-intermediate.crt" -pubkey -noout -out pubkey
bbegin="$(openssl asn1parse -in "ibm-hyper-protect-container-runtime.crl" | head -2 | tail -1 | cut -d : -f 1)"
bend="$(openssl asn1parse -in "ibm-hyper-protect-container-runtime.crl" | tail -1 | cut -d : -f 1)"
openssl asn1parse -in "ibm-hyper-protect-container-runtime.crl" -out signature -strparse $bend -noout