vania-janet/multiturn-rag-retrieval-data huggingface dataset:
[Clicking the Run Stage icon on a stage](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/RunStage.png)

Figure 2. Running a stage

You can also request on-demand builds and deployments from the build history page in one of two ways:



* Drag a build to the box that is under a configured stage.
* In the LAST EXECUTION RESULT section, click the Send to icon and then select a space to deploy to.



Zoom

![The Execute stage with this build icon](https://cloud.ibm.com/docs-content/v1/content/562806c0b18119f4d21cb66f5ae6d051634b4a16/ContinuousDelivery/images/deploy_to.png)

Figure 3. Deploying a stage

To cancel a running stage, on the stage, click View logs and history. In the list of jobs, click the running job's number and then click CANCEL. You can also cancel jobs individually by clicking a job and then clicking CANCEL, or by clicking the Stop icon for a job on its stage.





 Deploying an app 

A properly configured deploy job deploys your app to your target whenever the job is run. To manually run a deploy job, click the Run Stage icon of the stage that the job is in.



 Input revisions 

When you run a stage manually, or if it runs because the stage before it is completed, the running stage selects its input revision. Usually, the input revision is a build number. To select the input revision, the stage follows these conditions:



* If a specific revision is selected, use it.
* If a specific revision is not specified, search previous stages until a stage is found that uses the same input. Find and use the last successfully run revision of that input.
* If a specific revision is not specified and no other stages use the specified source as input, use the latest revision of the input.



You can deploy a previous build.
From the Software tab, click the Actions icon ![Actions icon](https://cloud.ibm.com/docs-content/v1/content/ff5860bfede49db3197c4bbba7f7123769bdc068/icons/actions-icon-vertical.svg) for the version you want to restore, and select Restore version.







 Restoring a deprecated product by using the API 

You can programmatically restore your product by calling the [Partner Center Sell API](https://cloud.ibm.com/apidocs/partner-center-sellrestore-product) as shown in the following sample request. Specify reason to provide details about why you want to restore your deprecated product.

curl --request POST --url https://product-
lifecycle.api.cloud.ibm.com/openapi/v1/products/9fab83da-98cb-4f18-
a7ba-b6f0435c9673/restore --header 'Authorization: Bearer TOKEN' --data '{
"reason": "I want to restore my deprecated product to keep it in the catalog."
}'
-i, --instance-id INSTANCE_ID
[-m, --monthly-interval MONTHS]
[-o, --output OUTPUT]



 Example 

This example applies a policy to rotate the key every 2 months.

 create a root key
$ KEY_ID=$(ibmcloud kp key create my-root-key --output json | jq -r '.["id"]')

$ echo $KEY_ID

c024c2b3-2093-46e5-aabb-fdf8cbc14e44

 show key details
$ ibmcloud kp key show $KEY_ID --output json

{
"id": "c024c2b3-2093-46e5-aabb-fdf8cbc14e44",
"name": "my-root-key",
"type": "application/vnd.ibm.kms.key+json",
"algorithmType": "AES",
"createdBy": "user id ...<redacted>...",
"creationDate": "2020-06-18T20:34:39Z",
"lastUpdateDate": "2020-06-18T20:34:39Z",
"keyVersion": {
"id": "c024c2b3-2093-46e5-aabb-fdf8cbc14e44",
"creationDate": "2020-06-18T20:34:39Z"
},
"extractable": false,
"state": 1,
"00920f38ce07c2e2f4df50b1f61d4194"
] ! !
}
}
Show more
-s, --json-str: Deprecated. The JSON data describing a global load balancer.-j, --json-file: Deprecated. A file contains input JSON data.-i, --instance: Instance name or ID. If not set, the context instance specified by ibmcloud cis instance-set INSTANCE is used.--output: Specify output format, only JSON is supported.<-- </section "id="section-update-glb-options" "> --><-- <section "id="section-update-glb-examples" "> --> Examples Update global load balancer 699d98642c564d2e855e9661899b7252 in domain 31984fea73a15b45779fa0df4ef62f9b. ibmcloud cis glb-update 31984fea73a15b45779fa0df4ef62f9b 699d98642c564d2e855e9661899b7252 --json '{"description":"Example global load balancer."
Dallas us-south dal13 169.61.23.199/29 169.61.23.193 
 Dallas us-south dal13 169.61.48.207/29 169.61.48.201 
 Dallas us-south dal13 169.61.48.239/29 169.61.48.233 
 Dallas us-south dal13 169.61.49.143/29 169.61.49.137 
 Dallas us-south dal13 169.61.56.223/29 169.61.56.217 
 Dallas us-south dal13 169.61.59.103/29 169.61.59.97 
 Dallas us-south dal13 169.61.60.39/29 169.61.60.33 
 Dallas us-south dal13 169.61.60.47/29 169.61.60.41 
 Dallas us-south dal13 169.62.134.103/29 169.62.134.97 
 Dallas us-south dal13 169.62.144.71/29 169.62.144.65 
 Dallas us-south dal13 169.62.151.47/29 169.62.151.41 
 Dallas us-south dal13 169.62.158.95/29 169.62.158.89 
 Dallas us-south dal13 169.62.184.207/29 169.62.184.201 
 Dallas us-south dal13 169.62.187.159/29 169.62.187.153 
 Dallas us-south dal13 169.62.193.183/29 169.62.193.177 
 Dallas us-south dal13 169.62.206.31/29 169.62.206.25 
 Dallas us-south dal13 169.62.238.151/29 169.62.238.145 
 Dallas us-south dal13 169.62.239.47/29 169.62.239.41 
 Dallas us-south dal13 169.62.240.223/29 169.62.240.217 
 Dallas us-south dal13 169.62.240.231/29 169.62.240.225 
 Dallas us-south dal13 174.36.70.143/29 174.36.70.137 







 Private Subnets
},
{
"LastModified": "2016-09-09T12:49:58.018Z",
"ETag": ""3ca744fa96cb95e92081708887f63de5"",
"StorageClass": "STANDARD",
"Key": "c9872-filename-00002",
"Owner": {
"DisplayName": "{storage-account-uuid}",
"ID": "{storage-account-uuid}"
},
"Size": 533
},
{
"LastModified": "2016-09-28T15:36:17.573Z",
"ETag": ""a54ed08bcb07c28f89f4b14ff54ce5b7"",
"StorageClass": "STANDARD",
"Key": "98837-filename-00003",
"Owner": {
"DisplayName": "{storage-account-uuid}",
"ID": "{storage-account-uuid}"
},
"Size": 14476
},
{
"LastModified": "2016-10-06T14:46:26.923Z",
"ETag": ""2bcc8ee6bc1e4b8cd2f9a1d61d817ed2"",
"StorageClass": "STANDARD",
"Key": "abfc4-filename-00004",
"Owner": {
"DisplayName": "{storage-account-uuid}",
"ID": "{storage-account-uuid}"
},
"Size": 20950
}
]
}
Show more





 Configure a Static Website
"issuing_certificates_urls_encoded": true,
"key_bits": 2048,
"key_type": "rsa",
"locality": [],
"max_path_length": -1,
"max_ttl": 157788000,
"organization": [],
"other_sans": [],
"ou": [],
"permitted_dns_domains": [],
"postal_code": [],
"private_key_format": "der",
"province": [],
"status": "configured",
"street_address": [],
"ttl": 157788000
},
"name": "my-configured-root-ca",
"type": "root_certificate_authority"
},
"wrap_info": null,
"warnings": null,
"auth": null
}







 Update a configuration 

Updates the configuration of a secrets engine that serves as the backend for a specific type of secret. You can update the configuration for the following secret types: iam_credentials, private_cert, public_cert



 Example requests 

Update a DNS provider configuration for the public_cert secrets engine.

curl -X PUT 'https://https://{instance_id}.{region}.secrets-manager.appdomain.cloud/v1/ibmcloud/public_cert/config/dns_providers' -H 'X-Vault-Token: {Vault-Token}' -H 'Content-Type: application/json' -d'{
"name": "my-cis-instance",
"type": "cis",
"config": {
Dallas us-south dal10 169.63.201.255/25 169.63.201.129 
 Dallas us-south dal10 169.63.204.255/24 169.63.204.1 
 Dallas us-south dal10 52.116.160.151/29 52.116.160.145 
 Dallas us-south dal10 52.116.190.135/29 52.116.190.129 
 Dallas us-south dal10 52.116.190.239/29 52.116.190.233 
 Dallas us-south dal10 52.117.135.111/29 52.117.135.105 
 Dallas us-south dal10 52.117.148.31/29 52.117.148.25 
 Dallas us-south dal10 52.117.166.239/29 52.117.166.233 
 Dallas us-south dal10 52.118.41.103/29 52.118.41.97 
 Dallas us-south dal10 52.118.153.159/29 52.118.153.153 
 Dallas us-south dal10 150.238.4.151/29 150.238.4.145 
 Dallas us-south dal10 150.238.229.39/29 150.238.229.33 
 Dallas us-south dal10 150.238.247.167/29 150.238.247.161 
 Dallas us-south dal10 169.46.13.239/29 169.46.13.233 
 Dallas us-south dal10 169.46.17.87/29 169.46.17.81 
 Dallas us-south dal10 169.46.18.23/29 169.46.18.17 
 Dallas us-south dal10 169.46.21.175/29 169.46.21.169 
 Dallas us-south dal10 169.46.21.183/29 169.46.21.177 
 Dallas us-south dal10 169.46.25.103/29 169.46.25.97 
 Dallas us-south dal10 169.46.31.175/29 169.46.31.169 
 Dallas us-south dal10 169.46.39.199/29 169.46.39.193
Dallas us-south dal10 169.47.212.191/27 169.47.212.161 
 Dallas us-south dal10 169.48.177.159/28 169.48.177.145 
 Dallas us-south dal10 169.60.22.255/27 169.60.22.225 
 Dallas us-south dal10 169.61.212.255/26 169.61.212.193 
 Dallas us-south dal10 169.61.219.239/28 169.61.219.225 
 Dallas us-south dal10 169.63.201.255/25 169.63.201.129 
 Dallas us-south dal10 169.63.204.255/24 169.63.204.1 
 Dallas us-south dal10 52.116.160.151/29 52.116.160.145 
 Dallas us-south dal10 52.116.190.135/29 52.116.190.129 
 Dallas us-south dal10 52.116.190.239/29 52.116.190.233 
 Dallas us-south dal10 52.117.135.111/29 52.117.135.105 
 Dallas us-south dal10 52.117.148.31/29 52.117.148.25 
 Dallas us-south dal10 52.117.166.239/29 52.117.166.233 
 Dallas us-south dal10 52.118.41.103/29 52.118.41.97 
 Dallas us-south dal10 52.118.153.159/29 52.118.153.153 
 Dallas us-south dal10 150.238.4.151/29 150.238.4.145 
 Dallas us-south dal10 150.238.229.39/29 150.238.229.33 
 Dallas us-south dal10 150.238.247.167/29 150.238.247.161 
 Dallas us-south dal10 169.46.13.239/29 169.46.13.233 
 Dallas us-south dal10 169.46.17.87/29 169.46.17.81 
 Dallas us-south dal10 169.46.18.23/29 169.46.18.17
For example, if you have a secret with keys, a, b, and c, these environment variables display as a, b, and c. However, if you add a prefix such as read_, then the keys display with the prefix, such as read_a, read_b, and read_c. Using a prefix also groups your environment variables in the referencing app, job, or jobrun, and helps you avoid duplicates of keys in configmaps or secrets.
4. (Optional) View the details of the demo job. The output displays the full reference to the mydatabasesec secret.

ibmcloud ce job get -n demo

Example output

Getting job 'demo'...
OK

Name: demo
ID: abcdefgh-abcd-abcd-abcd-1a2b3c4d5e6f
Project Name: myproject
Project ID: 01234567-abcd-abcd-abcd-abcdabcd1111
Age: 6s
Created: 2022-05-04T15:04:16-04:00

Commands:
env
Environment Variables:
Type Name Value
Secret full reference read_=mydatabasesec
Image: busybox
Resource Allocation:
CPU: 1
Memory: 4G

Runtime:
Array Indices: 0
Max Execution Time: 7200
Retry Limit: 3
5. Run a job that uses the configuration of the demo job.

ibmcloud ce jobrun submit --name demo1 --job demo
6. Display the logs of the job run. You can display logs of all the instances of a job run or display logs of a specific instance of a job run. In this example, display the logs of the demo1 job run. Notice in the log output that the keys of the full secret mydatabasesec are displayed with the prefix read_. Secret values are added to the environment decoded.

ibmcloud ce jobrun logs --jobrun demo1

Example output

Getting logs for all instances of job run 'demo1'...
keepalive_timeout 5;
types_hash_max_size 2048;

include /etc/nginx/mime.types;
default_type application/octet-stream;
ssl_session_cache shared:SSL:1m;
ssl_session_timeout 10m;
ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;
proxy_http_version 1.1;
proxy_buffering off;
proxy_intercept_errors on;

 IBM COS Endpoints
 US
server {
listen 443 ssl http2;
server_name us-cos.myibmcloud.com;
ssl_certificate "/etc/pki/tls/certs/star.myibmcloud.com.pem";
ssl_certificate_key "/etc/pki/tls/private/star.myibmcloud.com.key";
location / {
proxy_set_header Host $server_name;
proxy_pass https://s3-api.us-geo.objectstorage.service.networklayer.com;
}
}

 Dallas
server {
listen 443 ssl http2;
server_name dal-cos.myibmcloud.com;
ssl_certificate "/etc/pki/tls/certs/star.myibmcloud.com.pem";
ssl_certificate_key "/etc/pki/tls/private/star.myibmcloud.com.key";
location / {
proxy_set_header Host $server_name;
proxy_pass https://s3-api.dal-us-geo.objectstorage.service.networklayer.com;
}
}
}
Show more
version: '3'
services:
nginx:
image: nginx@sha256:e73ba8654ba7fd1834e78a3d4e9d72ffaaa3372d42996af5c34ba3e1abc293e8
privileged: true
user: 0:0
restart: always
ports:
- 80:80

There exist use cases in which the registry is not known when the workload section is pre-encrypted, for example, when the workload provider wants to allow the deployer to use a registry mirror or a private container registry. In such a case, it's possible to dynamically override the registry as well as the pull credentials. This is a coordinated effort between the workload provider and the deployer. For more information, see [Using a dynamic registry reference](https://cloud.ibm.com/docs/vpc?topic=vpc-hyper-protect-virtual-server-use-dynamic-registry-reference).

Use the following command to get the base64 encoded archive file. The base64 output is available in the compose.b64 file.

tar czvf - -C <COMPOSE_FOLDER> . | base64 -w0 > compose.b64

Make sure that the compose tgz file only contains directories and regular files. Links or pipes are not supported.

Copy the content of compose.b64 as a value of compose -> archive.

compose:
archive: <paste the content of compose.b64 >

For this example, you'd see a response similar to the following output:

compose:
[Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) 
 [Version history](https://cloud.ibm.com/docs/secrets-manager?topic=secrets-manager-version-history) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) ![Checkmark icon](https://cloud.ibm.com/docs-content/v1/content/991f60ddbe3ab0a9aa69481a07a0a73b359fa329/icons/checkmark-icon.svg) !
For more secret names, search for "secret_name" in the variable list.





 IBM® Key Protect 

Secrets Manager is the default secrets provider for the DevSecOps toolchains. However, you can use Key Protect instead. Set the following variables for Key Protect. These variables apply to the Key Protect integration in all the DevSecOps toolchains that are created.



Table 8. Key Protect

 Name Description Type Default 

 kp_name Name of the Key Protect instance where the secrets are stored. string "kp-compliance-secrets" 
 kp_location IBM Cloud® location or region that contains the Key Protect instance. string "us-south" 
 kp_resource_group The resource group that contains the Key Protect instance for your secrets. string "Default" 



Alternatively, you can set the Key Protect integration settings in individual toolchains by using the prefixed form of the variables:



Table 9. Prefixed forms

 Name Description Type Default 

 ci_kp_name Name of the Key Protect instance where the secrets are stored. string "" 
 ci_kp_location IBM Cloud® location or region that contains the Key Protect instance. string "" 
 ci_kp_resource_group The resource group that contains the Key Protect instance. string "" 
 cd_kp_name Name of the Key Protect instance where the secrets are stored. string "" 
 cd_kp_location IBM Cloud® location or region that contains the Key Protect instance. string "" 
 cd_kp_resource_group The resource group that contains the Key Protect instance for your secrets. string "" 
 cc_kp_name Name of the Key Protect instance where the secrets are stored. string "" 
 cc_kp_location IBM Cloud® location or region that contains the Key Protect instance. string "" 
 cc_kp_resource_group The resource group that contains the Key Protect instance for your secrets. string "" 







 Switching between secrets providers 

Secrets Manager is the default provider for the toolchains. Use the following variables to switch between Key Protect and Secrets Manager for each toolchain.
}, {
"config_type" : "public_cert_configuration_dns_cloud_internet_services",
"created_at" : "2022-06-27T11:58:15Z",
"created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
"name" : "cloud-internet-services-config",
"secret_type" : "public_cert",
"updated_at" : "2022-10-05T21:33:11Z"
}, {
"config_type" : "public_cert_configuration_dns_classic_infrastructure",
"created_at" : "2022-06-27T11:58:15Z",
"created_by" : "iam-ServiceId-e4a2f0a4-3c76-4bef-b1f2-fbeae11c0f21",
"name" : "classic-infrastructure-config",
"secret_type" : "public_cert",
"updated_at" : "2022-10-05T21:33:11Z"
}, {
"common_name" : "ibm.com",
"config_type" : "private_cert_configuration_root_ca",
"created_at" : "2022-11-08T11:22:19Z",
"created_by" : "iam-ServiceId-1ba95813-1b0f-45c1-b46c-969a5fda08d1",
"expiration_date" : "2023-03-31T01:13:07Z",
"key_bits" : 2048,
"key_type" : "rsa",
"name" : "internal-root",
"secret_type" : "private_cert",
"secret_group_id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"secret_type": "kv",
"state": 1,
"state_description": "Active",
"versions": [
{
"created_by": "iam-ServiceId-00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"creation_date": "2022-01-26T20:11:29Z",
"downloaded": true,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": false
},
{
"created_by": "iam-ServiceId-00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"creation_date": "2022-01-27T21:00:03Z",
"downloaded": false,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": false
},
{
"created_by": "iam-ServiceId-00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"creation_date": "2022-01-27T21:00:27Z",
"downloaded": false,
"id": "00000ea00-7d0000-0000ce-c0002a-0a0000f4b3ee",
"payload_available": true
}
],
"versions_total": 3
},
"wrap_info": null,
"warnings": null,
For the new data to take effect, run your job again. Resubmit the job run again and specify to use the myliteralsecret secret for this job run.

ibmcloud ce jobrun resubmit --jobrun myjobrun --name myjobrunresubmit2 --env-from-secret myliteralsecret
11. Display the logs of the myjobrunresubmit2 job run. This time, the job log displays Hello My new big literal secret!, which is the value in the updated myliteralsecret secret. You can use the jobrun get command to display the details of the job run, including the running instances of the job run. Display the logs for any running instance of the job run.

ibmcloud ce jobrun logs --instance myjobrunresubmit2-2-0

Example output

Getting logs for job run instance 'myjobrunresubmit2-2-0'...
OK

myjobrunresubmit2-2-0/myjob:
Hello from helloworld! I'm a batch job! Index: 2

Hello My new big literal secret from:
. ___ __ ____ ____
./ __)/ ( ( __)
( (__( O )) D ( ) _)
.___)__/(____/(____)
.____ __ _ ___ __ __ _ ____
( __)( ( / __)( )( ( ( __)
.) _) / /( (_ )( / / ) _)
(____)_)__) ___/(__)_)__)(____)

Some Env Vars:
--------------
HOME=/root
HOSTNAME=myjobrunresubmit2-2-0
JOB_INDEX=2
Dallas us-south dal13 169.62.158.95/29 169.62.158.89 
 Dallas us-south dal13 169.62.184.207/29 169.62.184.201 
 Dallas us-south dal13 169.62.187.159/29 169.62.187.153 
 Dallas us-south dal13 169.62.193.183/29 169.62.193.177 
 Dallas us-south dal13 169.62.206.31/29 169.62.206.25 
 Dallas us-south dal13 169.62.238.151/29 169.62.238.145 
 Dallas us-south dal13 169.62.239.47/29 169.62.239.41 
 Dallas us-south dal13 169.62.240.223/29 169.62.240.217 
 Dallas us-south dal13 169.62.240.231/29 169.62.240.225 
 Dallas us-south dal13 174.36.70.143/29 174.36.70.137 







 Private Subnets 



Table 20. us-south Private Subnets

 Location Region Data center Subnet First IP 

 Dallas us-south dal10 10.5.5.255/24 10.5.5.1 
 Dallas us-south dal10 10.5.124.255/24 10.5.124.1 
 Dallas us-south dal10 10.5.204.255/24 10.5.204.1 
 Dallas us-south dal10 10.23.68.255/24 10.23.68.1 
 Dallas us-south dal10 10.38.177.255/24 10.38.177.1 
 Dallas us-south dal10 10.94.35.255/24 10.94.35.1 
 Dallas us-south dal10 10.95.108.191/26 10.95.108.129 
 Dallas us-south dal10 10.95.123.255/24 10.95.123.1 
 Dallas us-south dal10 10.95.170.255/25 10.95.170.129 
 Dallas us-south dal10 10.95.191.255/24 10.95.191.1
$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys?state=<state_integers>" -H "accept: application/vnd.ibm.collection+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"

Replace the state variable in your request according to the following table.



Table 3. Describes the state variable.

 Variable Description 

 state The states of the keys to be retrieved. States are integers, where Pre-activation = 0, Active = 1, Suspended = 2, Deactivated = 3, and Destroyed = 5 values. For example, if you want to only list keys in the active state in your Key Protect instance, use ../keys?state=1. You can also pair states with offsets and limits to page through your available resources. 



For usage notes, check out the following examples for setting your state query parameter.



Table 4. Provides usage notes for the stage query parameter.

 URL Description 

 .../keys Lists all of your available resources, up to the first 200 keys. 
 .../keys?state=5 Lists keys in the deleted state. 
 .../keys?state=2,3 Lists keys in the suspended and deactivated state. 







 Retrieving keys by Extractable value 

By specifying the extractable parameter at query time, you can retrieve keys whose material can leave the service.

For example, you might have both standard and root keys in your Key Protect instance, but you only want to retrieve keys with extractable key material when you make a GET /keys request.

The extractable query parameter takes in a boolean.

You can use the following example request to retrieve a different set of keys.

$ curl -X GET "https://<region>.kms.cloud.ibm.com/api/v2/keys?extractable=<extractable>" -H "accept: application/vnd.ibm.collection+json" -H "authorization: Bearer <IAM_token>" -H "bluemix-instance: <instance_ID>"
new util.Attribute(ep11.CKA_PRIVATE, true),
new util.Attribute(ep11.CKA_SENSITIVE, true),
new util.Attribute(ep11.CKA_DECRYPT, true),
new util.Attribute(ep11.CKA_SIGN, true),
new util.Attribute(ep11.CKA_EXTRACTABLE, false),
);

client.GenerateKeyPair({
Mech: {
Mechanism: ep11.CKM_RSA_PKCS_KEY_PAIR_GEN
},
PubKeyTemplate: publicKeyTemplate,
PrivKeyTemplate: privateKeyTemplate,
PubKeyId: uuidv4(),
PrivKeyId: uuidv4()
}, (err, response) => {
callback(err, response);
});
Show more







 DeriveKey 

The DeriveKey function derives a key from a base key.

Enterprise PKCS #11 over gRPC

Enterprise PKCS #11

PKCS #11





 Description Binds to EP11 m_DeriveKey, which is an implementation of PKCS #11 C_DeriveKey. 
 Parameters message DeriveKeyRequest { Mechanism Mech = 1; bytes BaseKey = 3; bytes Data = 4; map<uint64,AttributeValue> Template = 8; } message DeriveKeyResponse { bytes NewKeyBytes = 6; bytes CheckSum = 7; } 
 Return values Wraps EP11 error into message Grep11Error. 



Code snippets



* Golang code snippet

// Derive AES key for Alice
deriveKeyTemplate := ep11.EP11Attributes{
ep11.CKA_CLASS: ep11.CKO_SECRET_KEY,
ep11.CKA_KEY_TYPE: ep11.CKK_AES,
ep11.CKA_VALUE_LEN: 128 / 8,
ep11.CKA_ENCRYPT: true,
ep11.CKA_DECRYPT: true,
}
Using the Stage Results API in custom scripts 

You can use the [Stage Results API](https://cloud.ibm.com/docs/devsecops?topic=devsecops-custom-scripts) to access the results of specific stages and custom stages.



1.  Type get_data result to print which stages have saved results:



$ get_data result
test
detect-secrets
branch-protection



1.  Type get_data result <stage-name> to print the result for a specific stage:



$ get_data result detect-secrets
success
$ get_data result test
failure



1.  Iterate through the saved results:



!/usr/bin/env bash
while read -r stage; do
result=$(get_data result $stage)
echo "The result of '$stage' stage is: '$result'"
done < <(get_data result)

Outputs the following lines to the console:

The result of 'detect-secrets' stage is: 'success'
The result of 'branch-protection' stage is: 'success'