Verifying container image security for IBM Cloud Pak for Business Automation

Fix Readme

Abstract

Container images for IBM Cloud Pak for Business Automation are signed by using GPG keys. You can verify the integrity of these images by using signature validation when you pull images by using Linux command-line tools. In Red Hat OpenShift, you can create a policy to enforce signature validation when your worker nodes pull images.

Content

IBM Cloud Pak® for Business Automation provides container images in the IBM® Entitled Registry that are signed following the approach from Red Hat. You can use the signature to verify that the images come from IBM when they are pulled onto the system. For more information about the signature verification, see Verifying signatures of Red Hat container images .

IBM Cloud Pak for Business Automation installs a number of dependencies, such as IBM Cloud Pak foundational services, which might have their own signature validation process.

Contents

Signature validation policy in Red Hat OpenShift
Signature validation in Linux command-line tools
Verifying key material
Scanning for vulnerabilities

Signature validation policy in Red Hat OpenShift

Red Hat OpenShift can be configured to verify container image signatures upon pulling images from a specific location. See Container image signatures for details about Red Hat's signatures of Red Hat OpenShift images. Images for IBM Cloud Pak for Business Automation are signed by using GPG keys, which in turn are signed by a certificate chain with Digicert as its root. See Verification of key material for details about key validation. The signing key changed multiple times - most recently in March 2023. Therefore, multiple keys are configured in the signature policy. The following sections can be used to verify the Cloud Pak for Business Automation signature on the container images.

Creating files containing GPG public keys
Creating a policy to require signed images for IBM Cloud Pak for Business Automation
Cleaning up local images and caches

Creating files containing GPG public keys

Create files containing the public GPG keys in the GNU Privacy Guard (GPG) format, which were used to sign container images for IBM Cloud Pak for Business Automation:

For images signed before 21.0.1-IF004: icp4a-pubkey1.gpg

For images signed before March 2023 (up to including 21.0.3-IF018 and 22.0.2-IF002): icp4a-pubkey2.gpg

For images signed starting March 2023 (starting with 21.0.3-IF019 and 22.0.2-IF003 and later releases): icp4a-pubkey3.gpg

Creating a policy to require signed images for IBM Cloud Pak for Business Automation

A security policy can

Deny images
Allow images
Require a trust relationship for pulling images

for entire image registries or specific parts of image registries. For more information, see Controlling what image sources can be deployed.

The following policy is least intrusive: It requires images pulled from cp.icr.io/cp/cp4a to be signed by using any of the GPG keys listed in the keyPaths array. Images from any other container registry and even all other parts inside of cp.icr.io are accepted without signatures.

If you can provide public keys for signature validation of all applications and their dependencies in your Red Hat OpenShiftcluster, you can set the default type to reject.

policy.json

{
    "default": [
      {
       "type": "insecureAcceptAnything"
      }
    ],
    "transports": {
      "docker": {
        "cp.icr.io/cp/cp4a": [
          {
            "type": "signedBy",
            "keyType": "GPGKeys",
            "keyPaths": ["/etc/pki/icp4a-pubkey1.gpg", "/etc/pki/icp4a-pubkey2.gpg", "/etc/pki/icp4a-pubkey3.gpg"]
          }
        ]
      }
    }
  }

You can use a MachineConfig object to inject the needed configuration files into the nodes: the GPG public key files and the policy.json file. The following example includes all GPG public key files like /etc/pki/icp4a-pubkey1.gpg and /etc/containers/policy.json file inline in the URL encoded format: machine-config.yaml

machine-config.yaml

apiVersion: machineconfiguration.openshift.io/v1
kind: MachineConfig
metadata:
    labels:
    machineconfiguration.openshift.io/role: worker
    name: image-signature
spec:
    config:
    ignition:
        version: 3.2.0
    storage:
        files:
        - contents:
            source: >-
                data:,-----BEGIN%20PGP%20PUBLIC%20KEY%20BLOCK-----%0AmQENBF0UBwABCADAk2QMLvahhx2owpDyasQo0E36I7VM%2FYdK1J9lAAgsHBJFvn%2FP%0A0PznCfnnFAw2cCj49ftYBN8orxJOSkuQE3p3hz%2Fg21C9jrsrqwoNfNbo5WRUsIxA%0A0hL9ywV8EvuOLAKdNY0ACOBHv2g82KSa%2FbZMg3bPA3Ir1jZZ3jjQrAzwAzvhp2Bo%0Av5FwU0xYqm9DwCb%2Fd4yYaEJ28jFWrwGdRnVHuoohu5PyUoQMpt4rwiU1yb3CabaN%0AEpGo4ZF2%2F07sVdhSv1ieqfQMa%2FrC6XcFALygt%2FvxzQDeSkPlxWb8wBqzq%2FsgI5Jb%0AwG6I55f3EMP67d%2FvWzA62FNbXk8DWMRLzWDHABEBAAG0BWljcDRhiQE5BBMBCAAj%0ABQJdFAcAAhsvBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQcjTsJWhPPpnT%0Ahgf%2FZYjAuPqiiHtJkmm1Nrw5HSCKHMsiHwUc1y5lb+J+xxfz7B3Jm07r%2FR82h6zI%0AZNnUTpgWzbEM7NazSAPcfL%2FKQXd3jw713hIXr2D4wzyMnvVAPJz0U%2FFUXDkZeTil%0AU04PT4T9BF5b+kIh560TuouY4bot2QFhuBMnKasLMMrXx1PXbySH9OHWc5bnx3J6%0Aj+%2Fd7TMj7MsdVgraoqmPtM68fOQUXyn0FCsx2M4kQRllGp7Wv0rIXVVh5lbT7VFs%0AOP+8LBBj1DEfCuffQc%2F21jO4DkC3nalWhXW5jAcAnTLlzKWsAxm%2FYJLfRYzeAOHa%0Amgv9nt%2FuDfwf0GasJw0cEeNq0A%3D%3D%0A%3D9hbX%0A-----END%20PGP%20PUBLIC%20KEY%20BLOCK-----
            filesystem: root
            mode: 420
            path: /etc/pki/icp4a-pubkey1.gpg
        - contents:
            source: >-
                data:,-----BEGIN%20PGP%20PUBLIC%20KEY%20BLOCK-----%0AmQENBGChsgABCADZ1OhWUebPgUYn8V2GDYpWeTKu8Yq2ghAIgooas8mAqdK8Bxid%0AoA6X4KcPY+RwXvVGjIfaVfR2pAqw6ZwwwVZ5CEo1eTtf9gGfdchYE7+beTOGTuzk%0A5uhz86fpYvmq7TVki2SnpsF40LnqcHGkOyQ1Lqcys4J+6qAYSv43sgOWvlTr%2FGJS%0AnDbqpES0N%2F4Lk2s4nb2iPJqB4zpwj1dtWJXvxLReclV5KFgrdpikHTfUgrxt1HbU%0ANgRpXd8XLT8ovoP0I32Qc%2FayyUGHon%2FvdNOMwHDLyXstwkqB70SEU%2F772bsUA7e0%0Al+w7T4HubOEEvwoRWtsoNBXWFB++0PxLDurPABEBAAG0BWljcDRhiQE5BBMBCAAj%0ABQJgobIAAhsvBwsJCAcDAgEGFQgCCQoLBBYCAwECHgECF4AACgkQfFz5ejnxNlAc%0APwgAxA7Jh6a4IKzlkLtI5FXabjZMVu81HjtrgRd4ZxnjciOHwdtjPaNZLd8HoSko%0AMniMWlUdHsyzFiBAQG1ohSg2CzotzwJe5m0zH09bji7P6DLd39tWraolOaqbHdZS%0AgLhNf50xfqVcq8uw%2Fv%2FmFsc8eSczdrcxVH3wlWzczdmPGHFLnHsbhAlIJ%2FPLzN1l%0AH%2FNlm259peZ7V5uAIcq1wLLKvpRWYU0%2FweGXfcnQYKHkEPHWDNv+kRjD8Q89Vby+%0AiDbn11I2GoJQeWYzCA7CXGrdeXO57MHSDOULQh22Aioq3CxmV3CRUCmATMYHw9oT%0ARWIGtCYOx2BHh1HRAeB1vlOzIw%3D%3D%0A%3DSIpv%0A-----END%20PGP%20PUBLIC%20KEY%20BLOCK-----
            filesystem: root
            mode: 420
            path: /etc/pki/icp4a-pubkey2.gpg  
        - contents:
            source: >-
                data:,-----BEGIN%20PGP%20PUBLIC%20KEY%20BLOCK-----%0AmQINBGPJZX8BEADAO%2Fbfaez4vdjXIuZfNFqpOpAOHzs89EhBguxGVHUdx2mtGUZo%0ANEZB3%2FFWVO+IlmW5clZrNSvoBDCF1oV63UDBiZUcoE1lS0HsKQJuhEKxZqBURZOB%0A5E12EjfVbS6xn+R3EubdepBwlNwv1rCq2un4KDhxY7phl0iwA1uWuxn4yU0LKQ%2FB%0A%2FJ%2F6jZL%2FecSjlzITYNsbfOwmCFeRhjmeSxuMobzWd9A%2FcLA6sPh7sDTzSmyJp%2F27%0A6ch3MijuxHLAdEFdR%2FoWvyh4XK04dRRQh2ecsJ2m5+EsS1DeYbFhwdgvMGtBVz6f%0AfDKK7BBMt%2FcsgT9wZX4BD97KDPFdAsANNC55ipYIxMKiDDrsuHJ1eD1UqaUGdTOn%0AMuT+AC1Rfsjcbxwl0FItfdQ0rBUFmHEw1qTScDNa+WSKflj386lPV5hWneOG58UG%0Au1vQuGHJchwcGYRIDvgeYC+lw%2Fq%2FjECqgeLrnJx9JVcMUmkTbDxfTDGe82mIqbiw%0AB38%2FboAujKCpCkvZFhP5OIylEmyCfRCZ%2F0ul8hvzS3kCjG5QSjBVcHolK75++CXb%0A6yYNawmQYVjPk1KuNe6Y+TVl0nsYqtSEjnknO4LRsKX2ZHxkASimFqJCjbAEQiEx%0A0B0mZ3RTUXR92Y%2FUy7XXtusymGleCkW+bHs2F0+9i32l9Nuxgl%2FD7g1WywARAQAB%0AtC9JQk0gQ2xvdWQgUGFrIGZvciBBdXRvbWF0aW9uIDxwc2lydEB1cy5pYm0uY29t%0APokCOgQTAQgAJAUCY8llfwIbDwULCQgHAgYVCgkICwIEFgIDAQIeAQUJA8Jm%2FwAK%0ACRBxj1JAiOfS1LE1EAC+EnV5Mx3etxyOQT6rgaWlyfoiSmXaxUOZwY5EWt0Zu5P4%0AmJ30KOdlqBjlLs43uFwxrXY7tjUpcSOpvK18SE4Z5UO3MB0WqKynN4bX2CDuDPuY%0AltDFsr2+hPpaicKkVw3uSHjxlaX67o%2Fc3Hw9xBpgl1TfBXqjreYzmlCvzER6MZQx%0AR7I+ZmiFqTWAdwfZnvUMmEsfXPpkOFBaVLgDaOjKYBTk0ddz8vf%2F7rdvTaKizg1j%0AiBrai2JsILI%2F%2FPh+xHlh9GejAkbkP%2F59YVmu%2F1rVr86WkuWplYjMkiU8eJz2ob52%0AomzGqRWY6Z2HwT7vV8ffQ1Uo4dKAUqzqoIBVcX58UkC27uMON3%2FDcTzpk+xjlcvu%0AIxJ4j3vKcaZlgXI55Hd1BLhhj668gYoH8eGTFRBfM8V41sadB5ZL8NnNMPPntcHx%0AZlljbKkxay44OPGa6Fs%2FdMkfp4rIFkzriaVkW8s9tCNwZGIS8sI9mQYUzV5Dmurn%0ANVAa0JnoZYgJmk9HjEJVBOOdHcJA%2FGQkF2tvKSmkFMUsUOTeLaytiG9btOnvf6fz%0AAEFoJLzQldqvba10uT9XxVxEENn7qDO4Nihtk%2FaDuPQcUeHqvDGvNSqaXq9Dq4T4%0AESeuzJRr1X2AKu1WFZdhFSCKr5nF4iChCIj05iAiUar3LqlT3OJxvcAOdWKJzg%3D%3D%0A%3DCUKh%0A-----END%20PGP%20PUBLIC%20KEY%20BLOCK-----
            filesystem: root
            mode: 420
            path: /etc/pki/icp4a-pubkey3.gpg 
        - contents:
            source: >-
                data:,%7B%0A%20%20%22default%22%3A%20%5B%0A%20%20%20%20%7B%0A%20%20%20%20%20%22type%22%3A%20%22insecureAcceptAnything%22%0A%20%20%20%20%7D%0A%20%20%5D%2C%0A%20%20%22transports%22%3A%20%7B%0A%20%20%20%20%22docker%22%3A%20%7B%0A%20%20%20%20%20%20%22cp.icr.io%2Fcp%2Fcp4a%22%3A%20%5B%0A%20%20%20%20%20%20%20%20%7B%0A%20%20%20%20%20%20%20%20%20%20%22type%22%3A%20%22signedBy%22%2C%0A%20%20%20%20%20%20%20%20%20%20%22keyType%22%3A%20%22GPGKeys%22%2C%0A%20%20%20%20%20%20%20%20%20%20%22keyPaths%22%3A%20%5B%22%2Fetc%2Fpki%2Ficp4a-pubkey1.gpg%22%2C%20%22%2Fetc%2Fpki%2Ficp4a-pubkey2.gpg%22%2C%20%22%2Fetc%2Fpki%2Ficp4a-pubkey3.gpg%22%5D%0A%20%20%20%20%20%20%20%20%7D%0A%20%20%20%20%20%20%5D%0A%20%20%20%20%7D%0A%20%20%7D%0A%7D
            filesystem: root
            mode: 420
            path: /etc/containers/policy.json

With a URL decoder, you can decode the files into clear text. Apply the MachineConfig resource:


oc apply -f machine-config.yaml

You can watch worker nodes being rebooted to apply the updated policy:


oc get mcp

If you are running starter pattern, PodDisruptionBudgets on some pods might prevent a node from restarting gracefully. You can force deletion of pods on this node by first identifying a node for which scheduling is disabled:


oc get node

Use the node name to delete pods on this node:


node=...
oc delete pod --field-selector="spec.nodeName=$node" --all-namespaces

top

Cleaning up local images and caches

Before any test or use of the image signature, you must clean up the container images and the local cache, even if your image pull policy is "always". If an image is cached locally, it is not pulled again, and the image signature verification does not take place.


for node in $(oc get no -l node-role.kubernetes.io/worker --no-headers -o name); do
    oc debug $node -- chroot /host sh -c "podman images | grep -e 'cp.icr.io/cp/cp4a' | awk '{print \$3}' | xargs podman rmi -f "
done

top

Signature validation in Linux command-line tools

skopeo

When it comes to inspecting and transporting images, skopeo is a useful tool as it does not need a docker or a daemon. It can be used easily in continuous integration (CI) pipelines to copy images between two registries, provide credentials for secured registries, or to promote images from a development registry into production.

Verifying a container image signature

If you pull the images from the IBM Entitled Registry with skopeo, you can enable the container image signature verification. The icp4a-pubkey1.gpg, icp4a-pubkey2.gpg, and icp4a-pubkey3.gpg files that you created can be used to verify the images under a certain repository and path.

In the following example, images are pulled from cp.icr.io/cp/cp4a and verified with the GPG public key that is in the icp4a-pubkey2.gpg file. All images are rejected, except the signed images in the cp4a folder.

The keyPaths array is not supported in podman and skopeo. Instead, you have to point to a specific key file by using keyPath: icp4a-pubkey2.gpg

policy-2.json


    {
        "default": [
          {
            "type": "reject"
          }
        ],
        "transports": {
          "docker": {
            "cp.icr.io/cp/cp4a": [
              {
                "type": "signedBy",
                "keyType": "GPGKeys",
                "keyPath": "icp4a-pubkey2.gpg"
              }
            ]
          }
        }
      }

Note: If cp.icr.io is specified, all of the images that are not signed under this folder are rejected. The skopeo command has the useful option --policy policy-2.json, which sets a specific policy file instead of using the default /etc/containers/policy.json file.

The following sample pulls one image into the local file system and validates its signature.

skopeo --policy ./policy-2.json copy docker://cp.icr.io/cp/cp4a/ban/navigator:21.0.3-IF018-amd64 dir:./ban

When you pull images by using podman, you can provide a --signature-policy policy1.json option to point to a policy file.

Referencing the correct public key for signature validation, images can be pulled.


podman pull --signature-policy policy-2.json cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64
Trying to pull cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64...
Getting image source signatures
Checking if image destination supports signatures
...

Pulling images fails when the policy file references another public key.


podman pull --signature-policy policy-1.json cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64
Trying to pull cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64...
None of the signatures were accepted, reasons: Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"7C5CF97A39F13650", Status:gpgme.Error{err:0x7000009}, Timestamp:time.Time{wall:0x0, ext:63812637354, loc:(*time.Location)(0x55fc881421a0)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x55fc881421a0)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"7C5CF97A39F13650", Status:gpgme.Error{err:0x7000009}, Timestamp:time.Time{wall:0x0, ext:63812637429, loc:(*time.Location)(0x55fc881421a0)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x55fc881421a0)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}
Error: error pulling image "cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64": unable to pull cp.icr.io/cp/cp4a/ums/ums:21.0.3-IF018-amd64: unable to pull image: Source image rejected: None of the signatures were accepted, reasons: Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"7C5CF97A39F13650", Status:gpgme.Error{err:0x7000009}, Timestamp:time.Time{wall:0x0, ext:63812637354, loc:(*time.Location)(0x55fc881421a0)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x55fc881421a0)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}; Invalid GPG signature: gpgme.Signature{Summary:128, Fingerprint:"7C5CF97A39F13650", Status:gpgme.Error{err:0x7000009}, Timestamp:time.Time{wall:0x0, ext:63812637429, loc:(*time.Location)(0x55fc881421a0)}, ExpTimestamp:time.Time{wall:0x0, ext:62135596800, loc:(*time.Location)(0x55fc881421a0)}, WrongKeyUsage:false, PKATrust:0x0, ChainModel:false, Validity:0, ValidityReason:error(nil), PubkeyAlgo:1, HashAlgo:8}

top

Verifying key material

This step is optional. You can verify the public keys referenced in this documentation once, but you do not need to repeat this process when you apply policies to multiple clusters.

If you want to verify the icp4a-pubkey3.gpg file, which is used to sign images since March 2023.

Create a file icp4a-cert3.pem and add the following public certificate in the PEM format.

Create a file icp4a-issuer-cert3.pem and add the following issuer public certificate in the PEM format.

Run the following commands to verify the GPG key and its issuer with the icp4a-cert3.pem and icp4a-issuer3.pem files.

Table 1. Commands to verify certificate issuance and validity for icp4a-pubkey3.gpg

Key verification
Command	Description
`openssl x509 -text -in icp4a-cert3.pem`	Displays the IBM Cloud Pak for Business Automation public certificate. Verify that the "Subject" line is IBM, and the "Issuer" is www.digicert.com. The icp4a-cert3.pem certificate is signed by Digicert.
`gpg2 -v --list-packets icp4a-pubkey3.gpg`	Displays the GPG public key. Verify that pkey[0] is the same as the "Modulus" of icp4a-cert3.pem. The command validates that icp4a-pubkey3.gpg is the public key (in GPG format) for IBM Cloud Pak for Business Automation.
`openssl ocsp -no_nonce \ -issuer icp4a-issuer3.pem \ -cert icp4a-cert3.pem \ -VAfile icp4a-issuer3.pem \ -text -url http://ocsp.digicert.com`	Verifies that the certificate icp4a.pem comes from Digicert by using the Online Certificate Status Protocol (OCSP).

Optional: If you want to verify the icp4a-pubkey2.gpg file, which was used to sign images starting with 21.0.1-IF004 and before March 2023.

Create a file icp4a-cert2.pem and add the following public certificate in the PEM format.

Create a file icp4a-issuer2.pem and add the following issuer public certificate in the PEM format.

Run the following commands to verify the GPG key and its issuer with the icp4a-cert2.pem and icp4a-issuer2.pem files.

Table 2. Commands to verify certificate issuance and validity for icp4a-pubkey2.gpg

Key verification
Command	Description
`openssl x509 -text -in icp4a-cert2.pem`	Displays the IBM Cloud Pak for Business Automation public certificate. Verify that the "Subject" line is IBM, and the "Issuer" is www.digicert.com. The icp4a-cert2.pem certificate is signed by Digicert.
`gpg2 -v --list-packets icp4a-pubkey2.gpg`	Displays the GPG public key. Verify that pkey[0] is the same as the "Modulus" of icp4a-cert2.pem. The command validates that icp4a-pubkey2.gpg is the public key (in GPG format) for IBM Cloud Pak for Business Automation.
`openssl ocsp -no_nonce \ -issuer icp4a-issuer2.pem \ -cert icp4a-cert2.pem \ -VAfile icp4a-issuer2.pem \ -text -url http://ocsp.digicert.com`	Verifies that the certificate icp4a.pem comes from Digicert by using the Online Certificate Status Protocol (OCSP).

Optional: If you want to verify the icp4a-pubkey1.gpg file, which was used to sign images before 21.0.1-IF004.

Create a file icp4a-cert1.pem and add the following public certificate in the PEM format.

Create a file icp4a-issuer1.pem and add the following issuer public certificate in the PEM format.

Run the following commands to verify the GPG key and its issuer with the icp4a-cert1.pem and icp4a-issuer1.pem files.

Table 3. Commands to verify certificate issuance and validity for icp4a-pubkey1.gpg

Key verification
Command	Description
`openssl x509 -text -in icp4a-cert1.pem`	Displays the IBM Cloud Pak for Business Automation public certificate. Verify that the "Subject" line is IBM, and the "Issuer" is www.digicert.com. The icp4a-cert1.pem certificate is signed by Digicert.
`gpg2 -v --list-packets icp4a-pubkey1.gpg`	Displays the GPG public key. Verify that pkey[0] is the same as the "Modulus" of icp4a-cert1.pem. The command validates that icp4a-pubkey1.gpg is the public key (in GPG format) for IBM Cloud Pak for Business Automation.
`openssl ocsp -no_nonce \ -issuer icp4a-issuer1.pem \ -cert icp4a-cert1.pem \ -VAfile icp4a-issuer1.pem \ -text -url http://ocsp.digicert.com`	Verifies that the certificate icp4a.pem comes from Digicert by using the Online Certificate Status Protocol (OCSP).

top

Scanning for vulnerabilities

All of the Cloud Pak container images pass rigorous image vulnerability scans during the development lifecycle, but new vulnerabilities are discovered almost every day. It is likely that most of the vulnerabilities you find are related to the Linux® kernel or to a few embedded packages. IBM tracks these vulnerabilities and provides fixes for them in fix packs or subsequent releases. To find out more, you can contact IBM support.

top

Related Information

IBM Docs (22.0.2) Verifying container image security

IBM Docs (21.0.3) Verifying container image security

icp4a-image-signature-validation-files-v1.zip

[{"Type":"MASTER","Line of Business":{"code":"LOB45","label":"Automation"},"Business Unit":{"code":"BU059","label":"IBM Software w\/o TPS"},"Product":{"code":"SSBYVB","label":"IBM Cloud Pak for Business Automation"},"ARM Category":[{"code":"a8m0z0000001gWWAAY","label":"Other-\u003ECloudPak4Automation Platform"}],"ARM Case Number":"","Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"21.0.3;22.0.2"}]

Tips