secure_build_docker.ipynb

{
 "cells": [
  {
   "cell_type": "markdown",
   "id": "isolated-defense",
   "metadata": {},
   "source": [
    "# IBM Cloud Hyper Protect Virtual Servers Secure Build lab (with Docker Hub)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "large-leisure",
   "metadata": {},
   "source": [
    "This lab will introduce you to securely building applications on the IBM Cloud Hyper Protect Virtual Servers for VPC service.\n",
    "\n",
    "The _Secure Build_ feature lets you build, and digitally sign, a Docker image within an HPVS instance running an IBM-provided _secure build server_ that offers the confidentiality, integrity and auditability protections inherent in IBM Cloud Hyper Protect Virtual Servers for VPC.  \n",
    "\n",
    "In this lab you will:\n",
    "\n",
    "1. Deploy the secure build server in your own HPVS instance.\n",
    "2. You will use this secure build server to securely create and digitally sign a Docker image that contains a sample application. For this lab you will use a sample _secure bitcoin wallet application_ provided by IBM for demonstration purposes.\n",
    "3. You will deploy this Docker image that you've built in a second HPVS instance and then run the sample secure bitcoin wallet application contained within the image. You will configure your HPVS instance to use an **_IBM Cloud Hyper Protect Crypto Services_** (HPCS) instance for key generation.  The HPCS instance provides the security of a _FIPS 140-2 level 4_-certified _Hardware Security Module_, which is the strongest level of FIPS 140-2 certification commercially available.\n",
    "\n",
    "You will be using an open-source application called _Jupyter Notebook_ to run this lab. Jupyter Notebook allows you to enter commands and see the results of these commands. You are likely reading this within Jupyter Notebook right now.  You will also open a terminal within Jupyter and enter some commands from the terminal. The large majority of the commands will be run from within the Jupyter notebook while a small number of commands will be run from the terminal. Those commands that prompt for user input are run from the terminal, while the vast majority, which don't prompt for user input, are run from within Jupyter Notebook."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d08e150c",
   "metadata": {
    "jp-MarkdownHeadingCollapsed": true,
    "tags": []
   },
   "source": [
    "## Secure Build overview\n",
    "\n",
    "The diagram below provides an overview of the major components involved in the secure build process that you will be working with in this lab. An explanation of each numbered annotation is provided below the diagram.\n",
    "\n",
    "![Secure Build architecture](images/sbsarch.png)\n",
    "\n",
    "1. The IBM Cloud command line interface (CLI) will be used throughout this lab.  It has already been installed for you in the lab environment.\n",
    "\n",
    "2. You will be using your IBM Cloud account during the lab.\n",
    "\n",
    "3. The _secure build_ CLI is a separate CLI used exclusively for the Secure Build process.  You will download this CLI in _Step 5.1_ of this lab and will use it throughout the remainder of the lab.\n",
    "\n",
    "4. You will be building a container image from an application whose source code is in a GitHub repository. The GitHub repository is specified for you in the configuration file you will build in _Step 5.5_ of this lab.  It is the value of the _GITHUB\\_URL_ key given for you in _Step 5.5_. \n",
    "\n",
    "5. The container image that you build will be pushed to the _Docker Hub_.\n",
    "\n",
    "6. The secure build server runs inside a Hyper Protect Virtual Servers instance in IBM Cloud that you will create in _Step 5.11_ of the lab.\n",
    "\n",
    "7. Your secure build server contains a snapshot of its state.  You can download this _secure build state_ from the server and use it to rebuild the secure build server if necessary.  Although we won't be using this downloaded state in the lab, you will perform the command to download it in _Step 6.10_ of the lab.\n",
    "\n",
    "**Note:** It is also possible to save the _secure build state_ to _IBM Cloud Object Storage_, but we will not be doing that in this lab.\n",
    "\n",
    "Okay, let's get started!!"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "endless-fellowship",
   "metadata": {},
   "source": [
    "## Initial login to IBM Cloud via the _ibmcloud_ command line interface (CLI)\n",
    "\n",
    "### Step 1.1 Open a terminal with the Jupyter Launcher\n",
    "\n",
    "In the browser tab in which you are accessing the Jupyter Notebook to take this lab, you should see a workspace with two tabs:\n",
    "\n",
    "    1. The tab you are using right now to read this lab.\n",
    "    2. The Jupyter launcher tab.\n",
    "\n",
    "Go to the Jupyter Launcher tab.  Click the *Terminal* tile at the bottom left and the Launcher tab will be replaced with a terminal window that you will use to enter a small number of commands from this lab that require interactive user input.\n",
    "\n",
    "![Choose Terminal](images/opennewterminaliniksd.png)\n",
    "\n",
    "When you have done that, come back here to continue with the instructions.\n",
    "\n",
    "---\n",
    "\n",
    "### Step 1.2 Use the terminal tab to log in to IBM Cloud\n",
    "\n",
    "Navigate to your terminal tab, and from there, enter the command `ibmcloud login -r YOUR-REGION --sso`, substituting one of the following regions for YOUR-REGION:  `us-east`, `ca-tor`, `br-sau`, `eu-gb`, or `jp-tok` which are for United States (East), Toronto, Canda, Sao Paulo, Brazil, London, England, and Tokyo,Japan respectively.  \n",
    "\n",
    "For your convenience the proper command for each region is listed. From the five commands listed below, copy the one applicable for your region, and paste it into the terminal tab and run the command:\n",
    "\n",
    "`ibmcloud login -r us-east --sso`\n",
    "\n",
    "`ibmcloud login -r ca-tor --sso`\n",
    "\n",
    "`ibmcloud login -r br-sao --sso`\n",
    "\n",
    "`ibmcloud login -r eu-gb --sso`\n",
    "\n",
    "`ibmcloud login -r jp-tok --sso`\n",
    "\n",
    "---\n",
    "\n",
    "### Step 1.3 Follow the prompts to complete the login\n",
    "\n",
    "Follow the instructions to log in to your IBM Cloud account.  The login process from the terminal should be like this:\n",
    "\n",
    "You will first be given a *Y/n* prompt to open the URL to get a one-time passcode, reply *n*. The reason to reply *n* is because in your lab environment your server does not have graphics capabilities and cannot open the URL.\n",
    "\n",
    "In order to overcome this, you must copy the URL given in the command output and paste it into another browser tab or window. The goal is to obtain a temporary one-time code for you.\n",
    "In order to get this code to use to log in with the CLI, you may need to log in to the IBM Cloud Web UI with your browser. If so, follow any necessary login prompts. You should eventually be given a page with a one-time code.  Click on that code to put it in your clipboard, and paste it at the input prompt back in your terminal tab.\n",
    "\n",
    "When successful, your terminal window will look like this, but with your account information of course: \n",
    "\n",
    "```\n",
    "\n",
    "API endpoint:      https://cloud.ibm.com\n",
    "Region:            us-east\n",
    "User:              silliman@us.ibm.com\n",
    "Account:           Barry Silliman's Account (1e963a246cc69a44df65e277e14239d5) <-> 1996902\n",
    "Resource group:    No resource group targeted, use 'ibmcloud target -g RESOURCE_GROUP'\n",
    "CF API endpoint:\n",
    "Org:\n",
    "Space:\n",
    "```\n",
    "\n",
    "When that is complete, come back to this tab and continue in this notebook. Leave the terminal tab open, you will need it later.\n",
    "\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "00ad14ba-3ad4-4337-b298-6fd85b5edbbd",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 1.4 Save your region into a variable\n",
    "\n",
    "Save the region you used above such as us-east into an environment variable for later use by double-clicking on the code cell below and filling in your region and then running it. For example, before running if you are using the us-east region your code cell would look like `%set_env region=us-east`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "332f983b-91c6-4db5-91dc-7a2cb1f2e865",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env region="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "gothic-bacteria",
   "metadata": {},
   "source": [
    "### Step 1.5 Target the default resource group\n",
    "\n",
    "---\n",
    "\n",
    "#### Jupyter Notebook tip\n",
    "\n",
    "The text you are reading now is in a type of Jupyter notebook cell called _markdown_.  It is intended for instructions, and includes text and possibly images.\n",
    "\n",
    "Commands that you will enter (with the exception of the small number of commands, such as the `ibmcloud login -r YOUR-REGION --sso` above, that are run in the terminal tab) will be in a second type of Jupyter notebook cell called _code_.  At the top of this page you can see a dropdown box that will show you whether or not you are in a markdown cell or a code cell. The below screen snippet shows where this dropdown box is located:\n",
    "\n",
    "![Choose Terminal](images/celltypeindication.png)\n",
    "\n",
    "---\n",
    "\n",
    "You can see from the output from _Step 1.3_ that no _resource group_ is targeted when you log in. The command in the code cell below will target the _default_ resource group. Resource groups are logical buckets that you can define in order to categorize your IBM Cloud resources as you wish.  We will simply use the _default_ resource group which exists already.\n",
    "\n",
    "Click on the code cell below that contains the command `ibmcloud target -g default`. You should see _code_ in the dropdown box at the top. \n",
    "\n",
    "Now that you have the code cell below highlighted, click the _Run_ button from the menu above—it is the triangle icon—and that command will be run, and its output will be shown.\n",
    "\n",
    "This will target your _default_ resource group. See the debugging tip below the code cell if this command does not work for you."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "eastern-population",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud target -g default"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "continuous-fossil",
   "metadata": {},
   "source": [
    "#### Debugging tip\n",
    "\n",
    "Some IBM Cloud users may not have a _default_ group but instead have a _Default_ group, with an uppercase _D_.  If the above command fails, try using *Default* instead of *default*.  You can do that by just clicking in the code cell above and changing the _d_ to _D_ in default.  Then run the code cell again. If that still doesn't work, ask an instructor for help.\n",
    "\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "fleet-domain",
   "metadata": {},
   "source": [
    "### A note about running Jupyter Notebook code cells\n",
    "\n",
    "Observe that to the left of the code cells are square brackets with empty contents. When you run a code cell, an asterisk (*\\**) appears between the square brackets.  (If the command runs fast enough you may not even notice the appearance of the asterisk). When the command finishes, a number appears between the square brackets.  During this lab, some of the commands may take several seconds to run, but no command in this lab should take too long. Each time that you run a code cell, ensure that you wait for that code cell to complete execution before continuing with the lab. If the asterisk remains in between the square brackets for more than thirty seconds, ask an instructor for help—none of the commands in this lab should take that long.\n",
    "\n",
    "The number shown between the square brackets upon command completion is incremented by one each time you run a code cell.  The numbers are helpful in ensuring that you have run each code cell in the correct order.\n",
    "\n",
    "---"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "similar-green",
   "metadata": {},
   "source": [
    "## Create an ssh key for the lab and add it to your GitHub account\n",
    "\n",
    "### Step 2.1 Create an ssh key pair in your lab system\n",
    "\n",
    "As part of this lab, you will need to create a key pair that you will then define in your personal GitHub account settings so that this key pair can be used to clone GitHub repositories.\n",
    "\n",
    "**Note:** If you are an experienced GitHub user and already have ssh keys defined to your GitHub account, you should still create a new key for this lab and remove it from your account when the lab is over, for security reasons. **What is the security concern?** The lab instructors have access to your lab system in order to be able to help with debugging.  If the lab instructors were malicious, they could copy your ssh key, including the private key portion of the key pair.  They are not malicious—they are well-intentioned and kind. But to be completely secure, you should create a new key per the instructions in this step, and then remove it from your GitHub account when you have completed the lab. (The cleanup section of this lab helps you with the key removal from your GitHub account).\n",
    "\n",
    "Run the code cell below to create a key pair in your lab workspace."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "neural-indication",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ssh-keygen -t rsa -b 4096 -f '/home/jovyan/.ssh/id_rsa' -N ''"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "immune-hygiene",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 2.2 Copy your public key to the clipboard and add it to your GitHub account\n",
    "\n",
    "The above command created a key pair (a private part that you keep secret and a public part that can be shared safely with the world).  You need to add the public part to your GitHub account settings, so that this key pair can be used to do a clone of the GitHub repository of the sample secure bitcoin wallet application from within the Secure Build Server container.\n",
    "\n",
    "Run the code cell below to list the public key, and copy this public key into your clipboard:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "incorporated-office",
   "metadata": {},
   "outputs": [],
   "source": [
    "! cat ~/.ssh/id_rsa.pub"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "laughing-duration",
   "metadata": {},
   "source": [
    "Copy all of the output from the above `cat` command into the clipboard, and go to [this link](https://github.com/settings/ssh/new) to add this key to your GitHub account. When you get to that page (you may have to log in to GitHub first), put anything you want in the _Title_ field and paste the above output (which is your public key) into the _Key_ field and then click *Add SSH key*.  \n",
    "\n",
    "**Note:** if you use a password manager and need to use copy and paste to log in to your GitHub account, go ahead and log in and then copy and paste the above output."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "consistent-statement",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 2.3 Add the GitHub public keys to your _known\\_hosts_ file\n",
    "\n",
    "Run the following code cell which gathers the public SSH keys of github.com and puts them in your lab workspace's _known\\_hosts_ file. This is done only to eliminate a prompt about trusting the github.com host in the code cell after this one."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "wired-softball",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ssh-keyscan -H github.com >> \"${HOME}/.ssh/known_hosts\""
   ]
  },
  {
   "cell_type": "markdown",
   "id": "unsigned-decrease",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 2.4 Verify you have added the key to your GitHub account correctly\n",
    "\n",
    "Run the code cell below to verify that you have correctly added your SSH key pair to your GitHub account.  You should receive a message that says _Hi \\<your GitHub username\\>! You've successfully authenticated, but GitHub does not provide shell access._  If you received this message, continue in the lab.  If not, ask an instructor for help.  "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "spread-truck",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ssh -T git@github.com"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eleven-neighbor",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Create a Docker Hub account if you do not already have one\n",
    "\n",
    "You will need a Docker Hub account in order to do this lab, because the secure image that you build will be stored in Docker Hub under your account.\n",
    "\n",
    "### Step 3.1 Sign up for a free Docker Hub account if necessary\n",
    "\n",
    "If you already have a Docker Hub account, you can skip this step.\n",
    "\n",
    "Sign up for a free Docker Hub account by going to [https://hub.docker.com/signup](https://hub.docker.com/signup) and following the instuctions.\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "guided-wiring",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Create a Docker Access Token\n",
    "\n",
    "In order to store the image that you will build into your Docker Hub account, you will need a Docker Access Token. This section will guide you through this process.\n",
    "\n",
    "You could use your Docker Hub account password instead of a Docker Access Token, but this is not a good practice. By providing a Docker Access Token that you create just for this lab, you can delete this token at the end of the lab- thus you will not have to change your password to remain secure.\n",
    "\n",
    "### Step 4.1 Log in to your Docker Hub account\n",
    "\n",
    "If you are not yet logged in to your Docker Hub account, click [https://hub.docker.com](https://hub.docker.com) and click the **Sign In** link.\n",
    "Follow any instructions or prompts necessary to complete the signin process.\n",
    "\n",
    "### Step 4.2 Create a Docker Access Token\n",
    "\n",
    "Follow [these instructions](https://docs.docker.com/docker-hub/access-tokens/#create-an-access-token) to create a new Docker Access Token.\n",
    "Save the value of your access token in a safe place- you will not be able to retrieve the value later.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "trying-uruguay",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Create your Secure Build Server HPVS for VPC instance\n",
    "\n",
    "### Step 5.1 Download the Secure Build command line interface (CLI):\n",
    "\n",
    "In order to set up your own Secure Build Server within an HPVS instance, you will use a command line interface (CLI) that is provided by IBM.  This CLI is implemented in Python and is publicly available (including source code) in a GitHub repository, which you will download now into your lab environment when you run the following code cell:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "pending-butler",
   "metadata": {},
   "outputs": [],
   "source": [
    "! git clone git@github.com:ibm-hyper-protect/secure-build-cli.git"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ultimate-objective",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.2 Change the working directory for the remainder of the lab\n",
    "\n",
    "Up to now, your notebook has been running from the _/home/jovyan/labdir_ directory. For the remainder of the lab, we want to work from the directory that was just created by the _git clone_ command from the prior code cell.  Our new desired working directory is a subdirectory of our current working directory.\n",
    "\n",
    "Run the next code cell in order to change directories to the _secure-build-cli_ directory that was created by the `git clone` command that you just ran."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "exceptional-allen",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd secure-build-cli"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "infrared-privacy",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.3 Install Python packages required by the Secure Build CLI\n",
    "\n",
    "There are some python packages required by the Secure Build CLI, and running the following code cell will install these packages using *pip3*, the Python 3.x-based package installer:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "decimal-seller",
   "metadata": {},
   "outputs": [],
   "source": [
    "! pip3 install -r requirements.txt"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "developmental-language",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.4 Create the Secure Build Server workload section\n",
    "\n",
    "Part of the Hyper Protect Virtual Server for VPC process involves creating a contract to deploy the workload running under Secure Execution for Linux. The Secure Build Server has been created and distributed by IBM who provides the ready-made encrypted contract for your use.\n",
    "\n",
    "This file is posted publicly on the public documentation page for IBM Cloud Hyper Protect Virtual Servers for VPC, but the Secure Build CLI repository on GitHub does not contain it.  That's why you are creating it now.  This file is encrypted, and only the Hyper Protect Virtual Servers key located on the IBM Z can decrypt it.  IBM Cloud administrators cannot access your secure build server at all, and you can only access it through the Secure Build CLI, which limits your access to specific functions. Therefore, by design, the decrypted contents of this file cannot be obtained by any human.\n",
    "\n",
    "**Note:** The code cell below will not produce any output, because it copies the encrypted message into a file.  But you know the command ended if a sequence number is placed within the square brackets to the left of the code cell. "
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "presidential-exclusion",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat <<EOF > workload.yaml\n",
    "hyper-protect-basic.UxkAbpIPPLZB2LNybZ8PedWbaJkMzJz/taoVf/ybKySkgpJ55GeHkNgQPeoLEJUPG54wLyRJ4AIqn96qQDAmoiPqIy8e9ucV3MCUu0Ed5bphbJjWzDvCFOtHh7VutLVZbMdzDDMfCblkc2kJ8uVbXUdY1cktwqnM2FnNwJXX98xlNfljtc69JnVhAcUWpDCNYwALjcxyHcKWxeKRetDrMnCo66rMN7W85DnExUM17wjNh1WVw1w2UTURwApnKRtbDjJ2xkYDyovJqyJiWlBeeX1WWEOb014ft/XacbGjWuA7WZbStggxrR9U2dO06HnmvgrpwpGhlSHOT3j7BJaSz0me+ZBCvdmLDDZozbXynn1JRK6WIgR/aMdO7lCkteh6PfOES/vjhFCTQn8Yw+Padu9E3Ye8yQweqsXnpB1STL5TAuZk11y4Lhs4xvqrXHgCDuek1SSIe6wdV4UoEXjVZfBypxEvXjMfYkz8N2WmPyoRB3VW18YuPEk+RSe6tQyeur/jc0rNMQDeYdXUn1Aao0xXnQj7NO7b73qBJZfRyvgKFxib94CCyazjykmzRNKZPyci2SGkmNCKAnk0V+o7GqrO78IV1rvmwS2GTqKKSTh35ovDkXAijn/7+kWX+Ka7Jc888AnRapy45fy41LXQ4nxkVk+jELegPkWBwK4lCDY=.U2FsdGVkX19xkuUH3lUtrPHALCFCRnp68NI+RbzK44H4e0z91AAlbRAIJmDBKsi3CwIP2mbPMVhE0okoOR4Ni0Xi5KMLMV9ODBMu8JvkLCnhVosKbviqK2wTkKSi9mbNAOyj8qoS5Ejtw+HFd/X+/RWaNYZbgsSoRfEdlft1nP9luT0HSCSCGQrhwTw1M8A77D4UWK4UxHosIqTWPMh+dZrRROTVpRLDiOeKYTIoBiKxV+iD00r8wJ9BhrxLxeb5Sm0oh6iRk3ffbJhN++Kmy3g+YY7gLfoy6qXIBn/quxiW0efkSZsiR3dyBp5yK9hVcLPPxrcwXaE/gQh0XNCLjpFUe7gMdtAx4SYfjbLXGqClLd0j8UX5fHsmxQkUz3ZfE4qkWQVc/5nySzq3erDKUJBwtO+S68bl5BU/8d4JjZ/qJQ5WeJCs2nlPOcBQcknb1hWzzorrwqAbLNKwo4qTpd0cKRLlZYvLez4bJrB+A/zvcYd6/pjJysEu+fvN7iBduN4S3K670p2Mk8R5P9gprGWquMj3GubV/u6graX/7Rq8agFQfYU3MKtIxYkwtRs2eR+Q9tARiZNLAE0pVh7L7yS9zEG+HkbHBDyiUxsS1MmXhxZoA4pVy5EkczrY0wH3GtZDlXAG4QLRZtzDlVzlSxoUb9hsYSPEXDuxEc27Q/Q94O15843xop6cH2tXP4QnDq8pLtxTjisMhKbZT1FsgAFWqBRQQGQYfgwiwJVx6e3YvRiqGirq69rjj2UrDj1+85SoJoglkZeqCqmurD3MWmbUWToPaO5KfU1pZVDym6h3S207Fsj/kT8xHbmiPnkshuCPRm7jy9nuLSH7u2L7NVhlVNvMGyS5QYffx6VEVk178ZoSnsoBX0MepMhzsri0ft1rfYxJby1Pt6ax0cxzSWM44XDxzYQV38/H0Cr22BQ1gLc73gQhQ53GetJSEcbVjYWKq5eeIy6sSQJCFazgLRPMvt9/4NdlJZEgaUr6L21K1xQEdX9GpWUlLfdCYHT12w7l3X2+gJQ3CMuIXLuevfGcYhEdA6nAgsAN9QcUKFIapQdQ6mC8H98Io6RKyKl7/nb/kIlzuovLxhdTmTBrPW5X/CGxoQ4j+uVrjCt8fZLQCLurC75D5YQr5bfRErhsWLpCnchP4Q3gPZh9O8zG/TAjHsoHpB8HA4d2zSXzAscB2p9w/as1m37GOHGF8lm2QAUSjJq22/MqAQ6OBwSrSwx2HOLbgxL+eam/2HLinIuIYk55V7mA0ZGdjj3LZtFXJ3hVw8rb0jhizq18G7nDoG6u1tClwQLHzCEAYvlpaCEuOOkEX9Km2dyKK/f9Cs/NmWgNfvRJdHB8iUNuYDD2b9ZdOPgn94ewAY+cuKF6sNj0Xvl5+w93Aij2YzmRZbwjyLZmnJtAipfFIyQw7WrHC0SPsUK2L8x1v9j0Hb3lRas25LWtK1apMo3RuGl2alvh9jFxZOi9MUn5VhconFAlfGoou+0LmJN91dq43NLyiutGj1tMu5EOyWMTh2Vokf4+k0017sj4u9DEm4RafFUeAd9wLVS1sXOyWYV+W7R+bhu5GtLQsTLwYYHCbVIjOClWIqY7/dZHmAhsIHJTLV5ozXCZ87NR+Umoh0s2Kw1MP70FfWM2W15VIVsMR009+ytxqI98HM3/EYeKhropTsH887arUkqqT7+SwUYtql3AQr0lGNpU71erT6IWiL8QeSLKUZkTFrnmqDqwAs3JA//ZGdns3jgUJNwh52rfJx8D6X7ZkkcRpieeTIHzYNMjYutjeHp4JqvqoDjfsPFG7rpdL1WXy6r7EesUZuouCf+xKsHg1hPlR/mpzUZW80SuAndotCFXAJGeug9xdtV1oPUfVTAgxef6brUjA8rBLx6YJ6X6EbqEou1lzr8CCAOURRQ38Gr4lvrphz7LpVNFFsu4qj8xhFGJz1c+tbh++7nDnpiyMJu+PpwVWP+sxkGgv3Jh9LIt6Jm8hd1fx7LfY+ssHxUwsSQt0ZV2iwq9RAH8E/AWKo70SCruENxCXXO6EOXG/6BT9G1Y+PNwc+ByaFferP5xAW5ND8fpXaL5rXnDcwh9h9nqbq0QuSW1+luyl+e4Q22aMSeBQRIWhs9c9SQhX0rgcr4xAJU7VhpnubixB0o7CpuBMLbLTIYZnznDaAqC1oPe2MdNfUAPGsMbojq3MCzRquCsG8l3LK+Twr+3H8tEwQg+aeUqzCpqknvIIFx8UP9F4EDJ3F7PEYgGuAo514UHdV+eEyGQ4xetuF1H7ZPAIzIkLLY+mkkBVvimrcc8JS0HaMyKkSgjbVmNaGkOlpYUlhtH6/U8Hh+6bpsIL3z7F199jKPqvoEnbT5PvyaDCLzp77SeXjHAFfZ8AYLemb+SpHRpfa8+adHqEHjvwekysBbDw3CtOE4bjs7txpzr0RYPOU5Lb5Cz1Nn9t+tE8JjhsZYqIMDM4R0tUqxzLvGKqeW1+RAlJ+T0G3JZDmdPOOVka9IgMZBFmZ7ob4qxp/w3CoJbjCp5iAsldslj9f3KRZ2zpguCc/nWpT8g0DZFGxNzjpgR1LIyNwTZ50decjaMV6mbAcCHuSg0OPvJGj0qeRkkATUVi4Vq1fR6ic4vDuzyApRNx0WX74BE5fXhLlH5POMNFVmIsdHfbFOsH5bmJzdURyy7UcGHilbPzat+i7fRtdCy0ZaHs4ujAKBziFrWwlMvhnqvazqRKZ/k8V1VtVoeXKenKpoqWn7EBAonfDxV8BOUqTp5KinDCeKvl28miNebZl9QHP0tiad+wFFcZ7WBFh/EnQhvvhZz2kwt3Jx2E9kzXCWYhZYgO9nU0PFD68viOj+Qdsna4W1JZ61RqLTzlJ+OIIHfEB4xvD8jtfhbO/CYE+kg1wjN4OgVWpObO9O0iy2l8QFtLR9mUMqzt2cOeCeMOSIpYUa0/FQXaOEoFhBT6Scyd+BDrz6eT3AVcxc+ZR70cmzPmv2ibPI0VmaIFpUpn8XVfCMBzQ+L+hZJSOd6QNDjjshOwtQEHWi19wrzIFQ5BSiBNEPd81UWFuzZOuI13huHD++xfi0ahCpZlsNvbsSk9msGPm9I2lFwSdY1yKpIn+kGp2oxjDTYA3uWp33m+zwz7Y4RSK6XCvlXYQ/u4kxMooA+AHQstvVIK2H8tXKPOl7zs/+YgiBSI1Lb2R+p/ajp9GujsEPaoN/GZSvQNCgsDmTSbGfT2c/oyjhVf49LV/ux9opPx/Z7dRLf7pKExqf1ehauwaNp7378xNXqbB6xs/H/nCIY8fKyNuXCVPD+fHA+Roqav5MZxUpIZQ9lGxaSn4hZl3gLbbR6RZ9HcmdO8E/IM40qvVjSoKYMDzJBcvlkyzvsZQzLU4T48DfIZrWPXEyL+EceWV48PeyeouSjjoMTdp3UY+tzEWW/rUSke2VzqgVhocPnbRFJ0SdPJcNra3FOZNgp4R7b8aeuOXFqlOHTPvSJ+ZHtIRgmkgrjjUahamwUasEFuReWqhsOmdOajLADj3Idj9us8E7kAwh7rXA6j2EFhLaI0EC1xBP0IOrk38cmFXN/Viy64HP+m9FupJov3leEpKPPKUKrWcWjCcjo9tEsAJdexUWewWDoy2wUQpBSCPr66GeOHr1Ns3e3dkAtk3BLjtwtYbFTI3hi6oO6LqiUqVd0avYI3WyBe2Jd0spFv/IskVC+VCRSQ8s0d6aMwaXvgiZTukcboKgbKuB0oPaOUxwtqXVAl+NMkBOoTodFrLiqZwjTzW1/E43cwwGepc489IRQYv8vqCyOPpqS/nggnLoNtGYTZFGZndMF4RPEnW0xZ+yoaUG1Fz/cVP9kCGxLi3wfaXhYHqTt5Jbyp2ik7iz5gVkVpYlmvZRRj1GcxXPD+Ar6SmhlCConlphL4PWpEB2pCZwJ5ZbtkFAJP7ApyqPxVytpVUPIJJx26HZzzpCZ1H1Llj0bg3RZxICScAKI22+9rtSndUmkQ8GWOgBMYk6dH8PAakmoQ9euXgmK2bJJ2O6ZDDM8EQjrJLpevvNKjAAxVYZ5SPFd3grrNEVvxlNjRC3Qd2Qd6ogZE18D5o/arC59t25WPlu1KO0FolZEffbX5lHJmjqwPZb0Jkx2K/DbncdV4g3mGFs8sNnFXfKlMMKswpVjzZ/FMTKRD0m1nWAMq7ysLqv2WlkA6CMTPtklZCQ/rtqBI4NeJF35NAK6ENJ/p0NvgOKOG3h/Jf7vnhprU83/k2WEA7JTUgwwWJwjk+i8pQkuKyOsWt/wd1wC2VbieVhdgt+7FnCLodfuTd3vPLiwmugczrhb8H0ghajzJcCtAD0aN5lw5/LWWPO6pO2bClo3wGDPmOlWcM7aX5x3AoecKjmNwO3A+ncFWQ7uM3J0FLoTwmnwDBrLxp3gmgbP/pL8aqk+k/EQF7YRoWRI+MYaSEQhmfnzFviB3aWySP2IUhstQFa/ENVqZW2+MhE3uZmssfjG28rGDKrRC578DbB7u6JxRVLcKxd16E85wcgebRvzODNf4C/E6TcO7w08a1CjA1KSRznPmpIHPpa7CP93hIrumHm85+VxED1w26Lmf4OrjTvMMO+GZN7+2Efke8ZWd+kpIf+6hAb7zcsxxvOVfcaYxA76LIAPkqc02tm1blb1kWivBQ+Lj6SD2IZfbvSEpuOhH0s9WZJjrF0DhxLxko99dySQfD0pnRc1Y8byFedEXjuI/5bHhwAB2wgu7DUps2a96hQgAtCKOAhev5/tATY1giKmliutHjSY+GxQpjBjPIikffEcahT8wlpRKsUALu+GOlrI52t7i7INwtgA/tpgaVWWNlzrSm3d5faHs9k5yJE5ZoVuiOPNdbHU9jgLJcabyrZZE5PjIRIQim4ROGL/k2k5TG3mKfA3A3y/hWwY8GuNnu5tGIX7vGoEJ4TUQp7uI87/1KeNlJIIfVoBKlVcEmKVYnr/TUoE5nWmcTYG7vj4Kre5P47TE7bF4F9lKDgJsIj0y2Qsg91m5B1iWJibN1lEpxTAehcuX0ljHM0C3VDQnSB5hPZUBuLZzxAqepjhbgfek6tz/27zLDv/kOfuSa7LtS+gpWohTN4oByauaA+YQTGo0eyvN2cOdCMcvq/ytCv1FKZgSm9kzAWoCy17NeKlMCbZte+xEw6n25t2LsAiGTspOv7unOV3IXGZOUDX8NC4mhfNBTHrtApbS13d+DVwFtVNqvQb56Fpz1FSUMU+Jog2u9z37iSah6eV98kEyobPaC8QmmpcvLID1EQV6rmhTHlTSLFezYxvra+kpKxpvIrp85hUNCggNNFBQqcC7ZulApjdM0caRf846fblQIPQ7fqy1+D00JLFD0J2TbpV/eUxDeSDsgDcyXQki6MWr8i0CFdDIN/stOvUwsMAfoYRVkEpcgRNetwEd1lCW6EZAsgj/npt1HTv65vPMYvYBvdJPIq9LXxfWWLXsPknnnQMlH0zI1B+uCEeAznz7O3clSRaJzgH/t/3Qjnt5eFBC7elmC/GvFPSSe62hRcQm/E7oestVt1vxfewS1jikU/TWJOTEskxv1X7qZUXFrU7V0INx5PBRid3cXWXi2erQuyRrW7+FCf4C30unWQ1oX9Nt94evWJ9yVAs2+XqGXz1XzZV9Tjg2/xul/HO8bN5o8AwcPs/H54w+LqszI0DlktXdMfw2JkTRvn/zfaahPum0cB8Dlce7QULuym96Prlol2iQDCGlTAEJR3UScoL3BfKHW7vTNJjSEL4ZBqhn9/6BHjpLw45ag8VJqN9MSdLtpuLW09a2BdJydw+He0MmM+RdinUyfJv3n00qhRKN+LkCSyFgD4yup7zgtkzcilp5W1pClztXMXMSOa+Azey3JOKChPxIp0nFHllcqVlCr95DqQeE+IuE1egEvCY3pZu0j4mWls05eAsT8I/lcSB/xFq42MjrYQqkJ2dHwEX8KS5A2N7hkq2Ny/PF7HkOFS0Y0DYjQd5X5u6zLXn1KZpAiLF9NdFFREsJEcvQj39Z6VbnPdN5rvLS6B5Zsej3qr+GpUynK038/8SkXrCXuk/HRlV7YWFpIamWJ0Kko5sTokLIaau4vNetdUlW3InpXBEo2BL7efkuKRfyCgQ7QjDfODIDDFIPnWcg0xP8EEhi9PNxwn2BagEZKDH8I0f+5CNTetTWnuAe/mOFoUecVHZhRUeQisf0Fpu62fG1NGHGDKOxu+dcouUmH0CDuZv80HjQhqRo8pPAIBUd21VH7GLjMn3+j6IaVQphuvS98qI0aGMm9RAy4enPy7VUUSMmGbw654fIqUVIvJFlRRFvLNoAdO6Xa8q2C5bIQtRtg3+R9JRXd40KADtW4Ql/CWZBQirxxgVLgtaPSEwKM8Opuz72Kou+hT+4ctYLhfbOOCRnkRSXoiB2RpbNLVtRx/rI5IRs9z8OfPuYzwyhsuta2VkkU0BSaFxJFi8jeykW8gZqX343f5S2cONlPoWFYVmZ/aGsMP9q/UXmgUazzb/vtDAgjSsKpT0SNofnYkznz0E5EkC7coHqSe3efH5NVLfopPyAsoE1anAtF9KuQk2AWQN68OCsNahMavWFg8m2oBoF+1o0yIsBUVfMM/91l29lpFcKL37gVJVFAcQJhFEd5JNFd7kKv/fukl+WEF1gNXrnhFEb/ckC04QbqTGVlAfBL2K9K+I8rcGfzgYhG9N3Q8+sTMzFqwgmBUoycTHZyAIIQDhKjgp43FRsJqJlDFWqmRfnJqYaiI5/zjZ4BUdlMJZJ9Ku2asFij/lBf7i1XKk0R8T2RuINSkoyGdHOwOC9d3niVxm3P2zkpIaF6oQuKcO7+pEprl2jteKay83pMS5qY9LrSDfHZM04lt9Db0n57HbjyOnE5TMaSr4EkD9qJMuQ6fo1GH0KffRQgyy1kp3owwgekdIihDPVWIkqX6p+4snepzmUpwwiy7MpGCmH2oFpoUDWT+FahqjCACBruE4KS//9MnydJE6SFOfNiSwh43doWLZs/G2e6F79bLmZ6asg19VGr1ja2E4HgxUN4kWCiPBLshgiU0M5SIpgNKaGf5DE9pNhUwDo1r3Rujnf1hWlFQBeoDmvuqCDSY6kryMDMtN/DCNchI6J/3K57RlnJKwsDM/mDNaKxI2pKQkS74dpKtjYDgpi9IhgNpeM3Y9xu7TdeJgFSHbqLPprpmzU4V5UP2njg4T6Au+rGhFvP97DcC+zIcZcpCgjYNz8kjmnTr0ZNYnCBwu1939jhn0Qq+Gc7mwQS/Dqxj+p4NcIte8KK3qdLTied5j5sB+XLD+OBRccvpnDW9e1ltv6ND+Q0JyECCOuqBsME57+xYyUKKlQjFe+iEVLrEtC78TXjsGiPkdSKeo+HNt+gkwJEANkvKGMu6TrkSoHuxb84lyfRS10LskCNGMbnw4Rf8RcGRIuKNJZm3+YYgJcm0N0uLIwFBDbdgUXAwyPmq0CYTw+8rwPi1O3ylug/LGzpW80K9FmlxfDY8ZLuDSeJ4sja0j6wIuZdMY5CE79E5SouJSAJWZRfbEwxPSwuET2R8hI2ICoN487RfG86Qr/VBUBA50uPKXRh5fUsAOlaKUfIbKxpbeyNbxqWK459Nd/KoZEfHvLuwUYdO2RZZauBpFVaSpC3XKZr+eO9hYWp+MAgBdoUNsIO0Zbxp7XegWg0zEl8z9sVlLxSK4U0Vo+Lxy8fMquJM3lrSSs2rwjiRKNbGffg4jV24jph5bqV4TzUfIaBc/HEZYLj0/9MAIC/JdZasBvZEegsO+qUmjLwGmXKTVPUAIZlYC2o4/TK0X5JwmTWRoC0PFNcT/x0r9LzP9Rfoy7NDZC4BQgAA42cupElIEQNLtSLo2ZLPVd+9+EW9dNfX+AsWZiLvTVS06zxZf6YZvb6XZYnkS+bJq9soOQ6KCRxehYTzvJdv3s06X4QHfrY8PdVMoxqPXqe2RPMQsOmNodoWv3MZha0Bjkhl2g7hRl8colS0fTvmQcR/ES6crYyw6BTANXTkCfWLBHmznkJPtCeFi0hCJ5z2WuCQFM7OUikkeH/W4HG+Rg3bzhsqluyqW/gWXNYQ/tcHCLZHgyG4K0EIv/f/6U9PLKx6vxekkFWxBIo0+0FKk64mABPH6pnmpmowHcPtaMAlG2CAnSzY578xZnq+2lx1LuyfH/M8SivD2nTRPZdGyv2Ir4Dsgu4MWno2PwvY8w76+WgsqW1DHYJzo9mJK5VfjOM5wv6fmqDw76a09xvO5JDQhgMZ+Ai7pxlYsYSHyjcYUrReVZjmmt+bYXNzQh+3dJQisOJqPAj1G3j8+B6sIpdy6+OHk9pF839viYgogw+ZoL0B9KEk8YP1S2jh5PjaYLb65/c6uG/F3QnXGLADE8xU3B1tbTJHTLr605+TKcVMrBx0eSTWOdOXmx0LGWkHtEJJuJ7wo1b3D5d6Mjk8rlwEqpfD/8BRV541qmyBnDXNnY9ndvRxFafP8sUrssl4ljgruoYS3pAvJhy81Cs0MFg59j+kEipL5SRJ0cuFIf7NyjO6Ktx0xYTGL04JYh3hmPrc9nYv+jrzZqWSH82AdrbQqQBk7erb1dZLYgF58slTf1XlbpOuo3txACQ+Pj3blO14o4Mpn1O/Oh6oEKn8BTKyahjRGBKeDV1m8tttBM4Eb7yggjeidEYqJvilc5eEI6KDpzjn+Z+iicAWklrCnuuZ2+Zh/jOg0t4YeN4zEvZrZCgsAqPZvc/GLy7n9aTrh0kjiP63NMHSzFyumTcoCYSm85RjCTz5pqqW2QWS0DNomgpmRJI33+OVSDbXBUwRa33lPcRXNe64RRZYL58bdVCffQ00BTm2JK4QH3m5Qdw1UCptEhqQBWXOmt7mYnOMP/U9SiRygQ02JpcoUAo9CsonAnV9TKX+ae/AYOdJAjMyswKsxj4CmfoT+OmBgv37z92/Vl01sGSyeeM/tMISVgfSPzi3eXp83x2seEMX6hDSkyzcyqMaRFyNuhJwcvzwM2b1SrdyzfQjRe98NLWW3DzJvQxhOYhJKXgPYnrUotGTPQodQViIjLFHfDNAfPhMOk+xwh+zNEQ1lAyekbcN5YyY8XNCXYQpr+d/FdNUNkN5LjOjvvgvcBguSOJYmCbDiM/WXmt1XxBaMWLatI8r7ceKh7TW9zmMN5XoWXjTBJQ6d1I0/lkksp4HOBj+QV2x2kC8McCRDRmPM4Ft8GhTCGiLH2cF1TjCgy4X10l2DXiujsIdagNehr36MWU9q98TjmFcpZaoHsFUpiq6LlpyuMV+tHRGQmC2oJ0g/X2rRx4tzhc2DUUSRtxKB/7iGNPS3N+9A/0ja9JwxF0cCE5uL0OoABFWF9G7BOsX6FQaBcC3zLEzDZWjjsw7ILbcOQAbsRawguayj4FuGDkM69eJrMI8kBzmdD21MoUGDKcUtAttZph2MSnhIsmszBEKarHM3xT8tF+6mw5/5sj/6BsGW3mUh7l2KLunIIpKkwsaKShiLmKmhqaxJid3ZTvB7rc884/wQJWFKdB6fSo1dPcQ2V6e5x3DZLt6SeYbjqQGGNJmfGQXSTg1nJfBVYttH7SFALQcZ1XAZzTBBKQEGs6l3KW95HlcRDlXfjCr461WXGISJ6dKCJPRJgtO5Zn33pUVyxBfl+zYqrL8t7bylzIzfuxfAJrglxfXzwnRULGvunLaarXjOmt3bMAgWVjr9xakxXl+53zVoEmjH+kdeCuYh5BMbtScg1/v855XFm/NfabaYvR81vl1UoDdw9sgLJtP+gZaSDGvkTVnW9/HvNAEbpJylmh3IBBoc2OTJnEOqOtKt529TXRD+K272rowbs539VbpX3GTThqVmAAm/h1J+kmTgRknD76w8QPZWd/lqRuhahwGm4FcnC6EktvZkiag89U5MfXm/Ni2n7cvEOyWivEz3J5ksjvoaFcUUI5HiNi+yYKvBNSpqJFf7W3scI7hDyOv7ykTO9vHK+foEflcL9szoDpZcU6OzfvkGULwe7SJdvZt6u/z3jDmv/c5WlrxlBStTAx79Y9sJxCO/EegsiWqk7gZEjGFjSW1NnAtzNxYL0ThtnMcbF1femxNZq5UxNw/jqgbUlglQIMpOYFWN8nlPQILfFMr0StOKLr5Nh8dJQzC4J819VkFCp2M+Qp/K78rhA8dmdwS9Z1Pui1iWy7eRQZPE9JqViFJDR+SAjOVWp3eO46MDbTRvhunwHN2Mw2/Ux332GnVFKZQcc6nwaCxFNm7eopHeTnIE+kAUC4er2zzlAjiZdwvPG4D74K/xz/55Eqz6sYq4MT4HdoFMEwD7qnOFo8jkB/UwWN4cnXobCDH+xWSse7aXCUaDbuj8ULEiMXH0SHt484HvG9Pkddi1UtJt7jYVKkYTopVbUzhxq0FAKdBa2ijAaLr4YbvNW9LlMNnKqNzerSx6OKN8NnL8VDZnryt41C3djc2a1P590W25kxbEXxss9M6rYmBAEMvM21MdbajvJ2dt1hlgHxI3AkSGS29aDWotpRqElJ0OyYoDMSpltB9oTsjdZYiFY4ZIibnURYnSaLp7H5AD9N0gE+49++B6kal0KBHV68OREoI9B3v8pPzV5DcgAympK6/Fxnm7c8hmUlmJyDW6KwJ1LQLc+PJha2Jnip+AMViRBTvVpdNAhVWt/kg+KdCHKQc67vlZX/Q5fh82MshZhTXKgXDC+zcORJDKp3xm6Uk6qBMVAYJvpLhJbcGre3gg9KgPuuJYr4PW0kUtwufQF7u+d5Vg2/cliO/aYnjmy6cp9UzWv+YkgQn8p2HAWDJVQw1Upu7dHOVuk9lsabnMG4I+SeebeCmXd2+eGP5wnPQF9ozZjs1aISwp2zuCWhGT++QngLcZEu7DWRKv/Lx65ZbTjig5PrwLM00mKXG/AE/P+yWXKbkESK0jjGAtUz4/n6e848YDzDccX49+KIFhAynplNP6jdfj3Mx492Q6DoM9Susjoo9r7EBBfR0Q1ilMJgaXcE2UbRjG7KRCtvHj+SOO6oo8Q6nLSD67JJhuPv/J+u8zHwRbc4L4yBtUvyznyynGN5Z5L3hUClmABh5CPxUAOPzTtXskxLlA5t8UZJRCEQw15h9Tmak0IClKga3EVTlG6Vocrl3wOQ6cYpoF4FZB1zm0V+VJlFrYEZrNQ8O/AHE3bHPu+tXkN3R4wY08OOeX9M5jtPnkdStRh6KIGjHIZLzWVDOz7HMRcLQ7IUBxxBfQ5PSo3XNWLnAIpOOopeTNA7JqaYC+Ge2FerZXkY3M409VgwZaxJ1Zm/BxkcgkdGJfRHP/Xo4zURedUjxpcOmg+k91zSLTRawUaiHY32YcH69Raag/fL5y2rYfMz8kd6mmWN/6fEqVZ+uYQXj0om773KpuulHPCgyk9t2RDFzqJUKyuGjQZ6kdPgTUPiKQjlZ1VDa+fc6FEgpuuHMVxBkxCVoUBOHyn2c8O/BHmiCEyHK3hf8CSkQHz0KZ0qvRgRCPvdh3PIjewowSnbJfUd/6xZqSh3PhDWOC8DUfApBPw//Hzf19fHY1cWAlAGrUzVtaNkKxwMVAdJwhDc1rXhN0Wv2w1AAoEMoDnrE0YXuUI4n63IlcsjvCvD6QEyDtdbQrne8PdqXVbPhVO4j/65YqkSUL1X5kTSjJvR7tiHGrVw5Bg/hehzNYsEhe0pZ5AczXwPzprmEYciU0Uxkt/7QFRWOsDmFPRuyElRxoZ/GpuCI7OssTPA1UG0NhzzsdgrtOe8QXo33FdX371dnnO/AuRrQB8mklLUh4pQREDH4k0x37bZbsqSlG1KYnde2ovYqTVXhxYgkYCcdYEGkxwpjD84LmK6dGqHcI4iBC/tlu9u65tv5ziqcF8K7tatrtWxqHT7ZJiDfgM9af154ktzo/hUVIdZ7SX8/6oaRcW/Mq/+/py0o6kivG3vZSsgOEsBF7gfCfORFMCrgwsKkBbOVVGtBj82NS8ll4aLNeG+daeGlTsgFDSU+9TeVjEWLTMR7rW5WIxjvORW9oBnLbB0rvi6T7ZZ8M6x61HyTmapwQYkNncoNYmUGHWTsdmFyTmNF1p7eToMlf00rUFxXt0w==\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "09998903-5324-461b-af94-8373b842dd42",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.5 Set environment variables for your Docker Hub username and token\n",
    "\n",
    "For your username, paste your username after the = sign of docker_username= and then run the code cell. For your token, paste your Docker Hub token in the 2nd code cell after the = sign of docker_token"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "cea2ffd3-d762-4a7a-beb3-878ff2f2e494",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env docker_user="
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5ce762f3-4149-4322-b622-224b44bae7bf",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env docker_token="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "greek-external",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.5 Create your secure build server custom configuration\n",
    "\n",
    "Anybody who uses the secure build feature of HPVS will use the same Secure Build Server image, but that image is deployed to that person's individual HPVS instance, and that individual instance is uniquely customized through a configuration file. This ensures that your Secure Build Server can only build the application you specify, and push it only to the registry that you specify in the configuration file which is created by the below code cell.\n",
    "\n",
    "**Note:** This code cell also does not produce any output within the Jupyter Notebook for the same reason as the previous code cell."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "variable-advancement",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat <<EOF > sbs-config.json\n",
    "{\n",
    "    \"HOSTNAME\": \"sbs.example.com\",\n",
    "    \"CICD_PORT\": \"443\",\n",
    "    \"RUNTIME_TYPE\": \"vpc\",\n",
    "    \"IMAGE_TAG\": \"1.3.0.11\",\n",
    "    \"CONTAINER_NAME\": \"SBContainer\",\n",
    "    \"GITHUB_KEY_FILE\": \"~/.ssh/id_rsa\",\n",
    "    \"GITHUB_URL\": \"git@github.com:ibm-wsc/secure-bitcoin-wallet.git\",\n",
    "    \"GITHUB_BRANCH\": \"master\",\n",
    "    \"IMAGE_TAG_PREFIX\": \"s390x-v1\",\n",
    "    \"DOCKER_REPO\": \"${docker_user}/secure-bitcoin-wallet\",\n",
    "    \"DOCKER_USER\": \"${docker_user}\",\n",
    "    \"DOCKER_PASSWORD\": \"${docker_token}\",\n",
    "    \"DOCKER_CONTENT_TRUST_BASE\": \"False\",\n",
    "    \"DOCKER_CONTENT_TRUST_BASE_SERVER\": \"\",\n",
    "    \"ENV_WHITELIST\":  [\"ZHSM\", \"APIKEY\"],\n",
    "    \"ARG\": {\n",
    "    }\n",
    "  }\n",
    "EOF\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "mighty-decimal",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.6 Verify your custom configuration file\n",
    "\n",
    "You can run the code cell below to display the contents of the file you just created to ensure it looks good.  If you made a typo, you can probably fix it by going back to the above code cell and running it again. \n",
    "\n",
    "The code cell below pipes the output of the _cat_ command to a utility called _jq_ (for _JSON query_) which expects well-formed JSON (JavaScript Object Notation) data. If you made a mistake while updating the file that causes a JSON syntax error, the _jq_ utility will detect it and print an error message.  \n",
    "\n",
    "If you put in a wrong value that doesn't cause a JSON syntax error, _jq_ will not catch that, so inspect the output of the code cell carefully."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "amber-execution",
   "metadata": {},
   "outputs": [],
   "source": [
    "! cat sbs-config.json | jq ."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "narrow-investigator",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.7 Generate client certification authority and client certificate\n",
    "\n",
    "Secure communication between you and your secure build server is achieved by using mutual Transport Layer Security (TLS). TLS is the same security protocol that protects most Web traffic today, but most Web interactions only require the server to be authenticated.  Mutual TLS refers to the situation where not only does the client want to ensure that the server is legitimate, but the server also wants to authenticate the identity of the client.  Your Web browser is constantly receiving server certificates and verifying them while you surf the web. Client certificates are what are used when the server wants to verify the client.  \n",
    "\n",
    "Create the client certificate and client certification authority (CA) by running the code cell below. You should receive two lines of output, with the second line being `INFO:root:client_certificate: generating client CA and certificate`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "digital-cholesterol",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py create-client-cert --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ae85b02f",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.8 Generate server certificate and server key\n",
    "\n",
    "Create the server certificate and server key by running the code cell below. You should receive four lines of output, with the fourth line being `INFO:root:server_certificate: Successfully generated server certificate`"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1bf15c36",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py create-server-cert --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "incident-jacob",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.9 Display your environment which shows your client certificate and CA and your server certificate and key\n",
    "\n",
    "The next code cell will copy the client certificate, the client certification authority, the server certificate and the server key, all in base64-encoding to a file for later use.\n",
    "\n",
    "If you already know about _base64-encoding_, go ahead and run the code cell.  If you don't, read the next paragraph if you're curious about what base64-encoding is.  \n",
    "\n",
    "Base64-encoding is a means of encoding any data, including binary data, into human-readable characters.  It takes groups of 6 bits, converts these six bits into a number from 0 to 63  (2 to the 6th power is 64), and replaces these 6 bits with one of 64 human-readable characters.  Which 64 human-readable characters were chosen?  Lowercase alphabetic characters a-z for 26, uppercase alphabetic characters A-Z for 26 more, the digits 0-9 for 10 more, which gives us 62.  Then `+` and `/` were chosen to make 64!  It should be noted that base64-encoding should not be confused with encryption.  It is easy to convert a base64-encoded string back to its original format.\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "completed-monkey",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py instance-env --env sbs-config.json | grep -A1000 -m1 -e 'CLIENT_CRT' | ( SPACES=$'    ' ; sed \"s/^/$SPACES/\" ) > cert-env.env"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "83f043ed-cfc3-4c8e-8a40-ffa12c8925cc",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.10 Create an environment variable for the vpc\n",
    "\n",
    "Set your vpc name into an environment variable to reuse it by running the following code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6d118428-718b-4339-b021-6fde8cf59fc7",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env vpc=secure-build-vpc"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "650a6059-e9a9-4788-b708-1976b6c075e1",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.11 Create your vpc\n",
    "\n",
    "This lab uses its own vpc to keep things neat and tidy for the end user. Now it's time to create that vpc and save its ID into an environment variable"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "controlling-palmer",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is vpc-create $vpc"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2cf29a26-a5e9-4815-91e6-1c6a96a06c3f",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.12 List the environment prefixes for your vpc\n",
    "\n",
    "Use the vpc variable you saved before to find the address prefixes for your vpc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5e5abcc6-3755-4553-ad9b-31c1384d900a",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is vpc-address-prefixes $vpc "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bf0e626f-e081-471a-9b2c-0ac7d6e977d1",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.13 Set your subnet as an environment variable\n",
    "Set your subnet as an environment variable by running the following code block"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b0e22ff4-0de7-407a-8f89-99eb2eb73efe",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env subnet=secure-build-subnet"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "83adbf18-679e-443d-bfaf-06c20eb36839",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.14 Create your subnet\n",
    "\n",
    "Use the address CIDR from the previous command to create a subnet for your VPC using one of the zones in your region.\n",
    "\n",
    "For example given the following output:\n",
    "    \n",
    "```\n",
    "Listing address prefixes of vpc r014-03b31802-8605-41a7-82c0-ce7f46ad39a7 under account IBM as user Garrett.Lee.Woodworth@ibm.com...\n",
    "ID                                          Name                                CIDR block        Zone        Has subnets   Is default   Created   \n",
    "r014-d1592cfb-d65b-4691-acfc-40317d366312   passover-flyable-entitle-goodness   10.241.0.0/18     us-east-1   false         true         2023-08-22T16:51:29-07:00   \n",
    "r014-cdb78388-ecca-48a5-a7e1-f1f56aeae87d   pretender-deputize-pushup-cover     10.241.64.0/18    us-east-2   false         true         2023-08-22T16:51:29-07:00   \n",
    "r014-64686aeb-3fb3-4cd5-997b-e30d9cb9c9e9   dropbox-unfold-elite-strategy       10.241.128.0/18   us-east-3   false         true \n",
    "```\n",
    "\n",
    "I could create a subnet for us-east-1 with cidr block 10.241.0.0/24. Fill in the CIDR block for your zone with /18 replaced with /24 and run the commands below similar to the following example:\n",
    "\n",
    "```\n",
    "zone=us-east-1\n",
    "```\n",
    "\n",
    "```\n",
    "cidr_block=10.241.0.0/24\n",
    "```"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d4f1121c-7ab8-490e-8af6-680fcecc8472",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env zone="
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "33081c36-ad00-485d-892c-a892f429dd4d",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env cidr_block="
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f2db0bb2-8594-4e3d-bead-6c63eb38941d",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is subnet-create $subnet $vpc $zone --ipv4-cidr-block \"$cidr_block\""
   ]
  },
  {
   "cell_type": "markdown",
   "id": "08a846fb-8fd1-4169-bd0c-f7f9fcdd8ee9",
   "metadata": {
    "tags": []
   },
   "source": [
    "---\n",
    "\n",
    "### Step 5.15 Set your gateway as an environment variable\n",
    "\n",
    "Set your gateway as an environment variable by running the following code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "d7a5dd4b-a037-4370-888a-cfd2e912df0d",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env gateway=secure-build-gateway"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "06cb6fe0-9c98-4660-ad37-b412e15f46c1",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.16 Create your public gateway\n",
    "\n",
    "Create a public gateway to access your instance"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e7503b18-6d80-4e3f-afd9-a0d302d93141",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is public-gateway-create $gateway $vpc $zone"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "9e4048f1-0322-4718-9cbf-646b11b1d7e0",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.16 Link your subnet to the new gateway\n",
    "\n",
    "Link the gateway you just created to your subnet"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fcd65a72-1907-47e4-804b-3066fd0f40f8",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is subnet-update $subnet --pgw $gateway"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4c93616a-4bdd-46bb-95dd-f67b6128fc78",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### 5.17 Save your security group ID for later use\n",
    "\n",
    "Run a command to get your vpc's security group ID and then save it by pasting it into the code box below after the = sign and running the code box below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3c5df4e0-2b82-41a6-a3e6-87fe6af728d7",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is vpc-sg $vpc"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "66d781ed-1be6-4c8b-b27d-8f6c94e5a948",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env sg="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "525f92f1-b81f-429c-a88c-d01179552863",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.18 Open port 443 on your security group\n",
    "\n",
    "Next, you will open port 443 to public traffic to use it to communicate with the secure build server."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a77ed162-894a-4a75-b85d-0be5445f14cc",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is sg-rulec $sg inbound tcp --port-min=443 --port-max=443"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "895f7e4f-374a-4b72-b7fb-6cf53e22ef4e",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.19 Create Logdna Logging instance\n",
    "\n",
    "You will need a logdna instance to use for logging from your Hyper Protect Virtual Servers for VPC. Thankfully, you can get a lite instance for free if you don't already have one. Since you can only have one lite instance, if you already have one you can reuse that one for this. However, if you don't create it with the command below:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "038145fe-7304-4fcf-a81e-d47192b3916a",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud resource service-instance-create secure-build-logdna logdna lite $region -p '{\"private_endpoints_only\": false}'"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f626a128-56ae-4952-bf7c-9d2b716a477f",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.20 Retrieve your IBM Log Analaysis instance's ingestion key\n",
    "\n",
    "Navigate to the IBM Cloud UI (signing in if necessary) via [this link](https://cloud.ibm.com/observe/logging) which will take you to your logging instances.\n",
    "\n",
    "Click the blue **Open Dashboard** button in the upper right for the logDNA instance you are using for this lab.\n",
    "\n",
    "Click the *Install instructions* icon (that looks like a question mark) in the lower left of your IBM Log Analysis dashboard:\n",
    "\n",
    "<img src=\"images/log040.png\" width=\"470\" height=\"952\" />\n",
    "\n",
    "In the window that opens up, click the icon highlighted below in order to copy your IBM Log Analysis instance's ingestion key into your clipboard.  Paste it into the code cell below and run it to set an environment variable for use later in the lab.  **Treat this ingestion key with care like you would a password, _especially if you are using an already existing IBM Log Analysis instance_**. (You do have the ability to return to this screen to retrieve it later if you lose track of where you paste it).  See the below screen snippet:\n",
    "\n",
    "<img src=\"images/log050.png\" width=\"936\" height=\"186\" />"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "56d6aeeb-1965-42ff-9509-e1dead1049d2",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env logdna_ingestion_key="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e9f6a58d-ad68-4cb3-b33b-d8c85b94dbaf",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.21 Retrieve your IBM Log Analysis instance's host name\n",
    "\n",
    "1. Scroll down on this same window and choose **rsyslog**\n",
    "2. Use copy and paste to save the information that corresponds to the information highlighted in the screen snippet below.  (This information will not be highlighted on your screen until you select it as we did prior to taking this screenshot). You will be using this information later in the labs.  This information does not have to be kept secret.\n",
    "\n",
    "<img src=\"images/log060.png\" width=\"802\" height=\"671\" />\n",
    "\n",
    "You do not have to follow the instructions that the popup window is giving you, you only needed to copy the information as directed here in the lab. You can click the **X** in the upper right corner of the popup window or just click outside of the popup window so that it goes away. Paste the hostname into the code cell below and then run it to set an environment variable for use later in the lab. Keep this tab open to see your logs when you launch the server (since the lite plan doesn't save logs so you have to have the instance loaded in your browser when the logs occur to see your logs.)"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ba6c76d5-39b1-4c13-ab6b-65d5df21eaae",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env logdna_hostname="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a71188ef-d9f0-4790-98a7-3887bc5f37c1",
   "metadata": {},
   "source": [
    "---\n",
    "### Step 5.22 Prepare the environment section of your contract\n",
    "\n",
    "Time to create the environment section of your contract with all of the information you collected before"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0a038732-f32e-4981-9f2f-1dd1d753ec52",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat <<EOF > env.yaml.initial\n",
    "  type: env\n",
    "  logging:\n",
    "    logDNA:\n",
    "      hostname: $logdna_hostname\n",
    "      ingestionKey: $logdna_ingestion_key\n",
    "      port: 6514\n",
    "  auths:\n",
    "    docker.io:\n",
    "      username: '${docker_user}'\n",
    "      password: '${docker_token}'\n",
    "  volumes:\n",
    "    hpsb:\n",
    "      seed: \"testing\"\n",
    "  env:\n",
    "    registry: \"docker.io/gmoney23/secure-docker-build\"\n",
    "$(cat cert-env.env)\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a819ba4b-d516-473f-9ebc-8197a5efa9df",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.23 View your newly created environment section\n",
    "\n",
    "Check on the environment section of your contract to check on your work"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5ef82da0-7036-4973-9627-06be66350010",
   "metadata": {},
   "outputs": [],
   "source": [
    "cat env.yaml.initial"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eaf39cef-e988-4160-863e-43207dadc2f6",
   "metadata": {},
   "source": [
    "----\n",
    "\n",
    "### Step 5.24 Create a script to encrypt the environment section of the contract\n",
    "\n",
    "Create a convenience script to automate encrypting the environment section of the contract\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b8c4db39-b765-42cb-be51-07a610d0b646",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat <<-EOF > short-flow.env\n",
    "# Create the env section of the contract and add the contents in the env.yaml file.\n",
    "\n",
    "#\n",
    "# This specifies a file will be encrypted and signed and is the primary output of this script.  \n",
    "# It is combined with the encrypted and signed workload section that is created by \n",
    "# another script (flow.signature which is one directory level higher)\n",
    "# Note: this file will also wind up one directory level higher\n",
    "#\n",
    "ENV_INITIAL=\"env.yaml.initial\"\n",
    "ENV_PLAIN=\"env.yaml.plaintext\"\n",
    "ENV=\"env.yaml\"\n",
    "\n",
    "#\n",
    "# This command adds the public signing key to the plaintext environment yaml.  This key is used inside \n",
    "# the Hyper Protect Container Runtime image to verify the signature over workload and environment sections of\n",
    "# the contract. \n",
    "#\n",
    "cat \\${ENV_INITIAL} ./pubSigningKey.yaml > \\${ENV_PLAIN}\n",
    "\n",
    "# Download certificate to encrypt contract for Hyper Protect Container Runtime:\n",
    "HPCR_rev=11\n",
    "CONTRACT_KEY=./ibm-hyper-protect-container-runtime-1-0-s390x-\\${HPCR_rev}-encrypt.crt\n",
    "curl https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-\\${HPCR_rev}-encrypt.crt > \\${CONTRACT_KEY}\n",
    "\n",
    "#\n",
    "# This variable holds a random password:\n",
    "#\n",
    "PASSWORD_ENV=\"\\$(openssl rand 32 | base64 -w0)\"\n",
    "\n",
    "#\n",
    "# This variable holds the output of the command pipe that\n",
    "# takes your plaintext environment yaml (\\$ENV_PLAIN) and encrypts it using the password that \n",
    "# was generated above (\\$PASSWORD_ENV) and then base64 encodes this encrypted environment yaml\n",
    "#\n",
    "# As long as nobody else knows your random password (\\$PASSWORD_ENV) your data is safe.  \n",
    "# But, the Hyper Protect Container Runtime has to encrypt it, so it needs your password. \n",
    "# How will it get that password securely?  Read the next set of comment lines to find out.\n",
    "#\n",
    "ENCRYPTED_ENV=\"\\$(echo -n \"\\$PASSWORD_ENV\" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in \"\\$ENV_PLAIN\" | base64 -w0)\"\n",
    "\n",
    "#\n",
    "# This variable provides secure passage for your random password.  How?  \n",
    "# It encrypts it with the encryption key of the Hyper Protect Container Runtime (HPCR).\n",
    "# (A key that is encrypted by another key is often called a wrapped key).\n",
    "# Only the HPCR image has the private key which can decrypt this. It is protected from \n",
    "# access from any administrators.  So, malicious actors cannot do anything with this\n",
    "# wrapped key, even if they were able to get a hold of it.\n",
    "#\n",
    "ENCRYPTED_ENV_PASSWORD=\"\\$(echo -n \"\\$PASSWORD_ENV\" | base64 -d | openssl rsautl -encrypt -inkey \\$CONTRACT_KEY -certin | base64 -w0 )\"\n",
    "\n",
    "#\n",
    "# Use the following command to get the encrypted environment section of the contract:\n",
    "# This variable holds the output of a concatenation of a header, \"hyper-protect-basic\",\n",
    "# Your wrapped key, and your encrypted environment yaml.. \n",
    "#\n",
    "ENV_ENCRYPTED=\"hyper-protect-basic.\\${ENCRYPTED_ENV_PASSWORD}.\\${ENCRYPTED_ENV}\"\n",
    "#\n",
    "# The above variable writes the encrypted environment section to the directory one level above\n",
    "#\n",
    "echo \"\\$ENV_ENCRYPTED\" > \\$ENV\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "605876f8-d5d2-445c-8268-e34848e32b7c",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.25 Create a script to generate a signing key\n",
    "\n",
    "Create a convenience script that will generate a key to sign the contract"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "6ea01b31-ba36-402f-aeab-cd991c95d817",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.prepare\n",
    "# Use the following command to generate key pair to sign the contract \n",
    "openssl genrsa -aes128 -passout pass:test1234 -out private.pem 4096\n",
    "openssl rsa -in private.pem -passin pass:test1234 -pubout -out public.pem\n",
    "\n",
    "# The following command is an example of how you can get the signing key:\n",
    "key=\\$(awk -vRS=\"\\n\" -vORS=\"\\\\\\\\\\n\" '1' public.pem)\n",
    "# echo \"  signingKey: \\\"\\${key%\\\\\\\\n}\\\"\" > environment/pubSigningKey.yaml\n",
    "printf \"%s\" \"  signingKey: \\\"\\${key%\\\\\\\\n}\\\"\" > pubSigningKey.yaml\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e8b18b9b-d6a8-4abe-81e1-570934e0ca03",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.26 Create a script to sign the encrypted contract\n",
    "\n",
    "Create a convenience script to automate signing the encypted contract"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fd179c5a-05a9-4b5b-aa06-c533c5801715",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.signature\n",
    "# combine workload and environment\n",
    "cat workload.yaml env.yaml | tr -d '\\n' > contract.yaml\n",
    "\n",
    "# Sign the combination from workload and env being approved\n",
    "echo \\$( cat contract.yaml | openssl dgst -sha256 -sign private.pem -passin pass:test1234 | openssl enc -base64) | tr -d ' ' > signature.yaml\n",
    "\n",
    "# Create user data and add signature:\n",
    "echo \"workload: \\$(cat workload.yaml)\n",
    "env: \\$(cat env.yaml)\n",
    "envWorkloadSignature: \\$(cat signature.yaml)\" > user_data.yaml\n",
    "\n",
    "echo \"\"\n",
    "echo \"import `pwd`/user_data.yaml into User Data or copy and paste from below:\"\n",
    "echo \"\"\n",
    "\n",
    "cat user_data.yaml\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "6e89ca44-2fbe-4f7d-9e0b-75111ef575b8",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.27 Create a script to produce the encrypted and signed contract\n",
    "\n",
    "Create a convenience script that will create an encrypted and signed contract using the prior scripts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "3198dd3f-b9c4-439f-81bf-e0d529020e61",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > makeContract\n",
    ". ./flow.prepare\n",
    ". ./short-flow.env\n",
    ". ./flow.signature\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e394b865-c38a-49b7-b622-919de57c5ac3",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.28 Create the encrypted and signed contract\n",
    "\n",
    "Use the script to create the encrypted and signed contract"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "82064e45-005c-46c5-a201-b63386d2cffa",
   "metadata": {
    "scrolled": true,
    "tags": []
   },
   "outputs": [],
   "source": [
    "! . ./makeContract"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b062511b-facc-417c-a902-69cc43c706e9",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.29 Display your signed contract\n",
    "\n",
    "See your signed contract that will use to deploy your secure build server"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "5677ee62-2967-483d-863f-3ee4cefcc11b",
   "metadata": {
    "scrolled": true,
    "tags": []
   },
   "outputs": [],
   "source": [
    "! cat user_data.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "d6d640eb-043d-4401-bda5-fecc0d0442b8",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.30 Set your instance name via a variable\n",
    "\n",
    "Set your HPVS for VPC instance name as a variable for later use by running the below code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "793f7468-e2a3-4f88-a0b2-42c020ce73e6",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env instance=secure-build-server"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b6091af0-ad4a-4382-add9-254ea289d2ed",
   "metadata": {},
   "source": [
    "### Step 5.31 Get the hyper protect container runtime image\n",
    "\n",
    "Run the following code block to get the hyper protect container runtime image for your region."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9d0a3c1a-cc6a-47e8-b586-720524c8a7ef",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is images | grep ibm-hyper-protect-container-runtime-1-0-s390x-11 | cut -d \" \" -f1 > hpcr_image.env"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "44dc4313-53c0-4718-a6e5-3117bd63e457",
   "metadata": {
    "tags": []
   },
   "source": [
    "---\n",
    "\n",
    "### Step 5.32 Deploy the Hyper Protect Virtual Servers for VPC Secure Build Server\n",
    "\n",
    "Use your encrypted and signed contract to deploy a secure-execution enabled guest using Hyper Protect Virtual Servers for VPC"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b3f566a8-01f7-414a-9bc4-5171d29b364c",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-create $instance $vpc $zone bz2e-1x4 $subnet --image $(cat hpcr_image.env) --volume-attach '[{\"volume\": {\"name\":\"secure-build-volume\", \"capacity\":10, \"profile\": {\"name\": \"general-purpose\"},\"user_tags\": [\"secure-build\"]}}]' --user-data @user_data.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2b77299d-b008-47de-b17a-54b327a436ec",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.33 Check the status of your Secure Build Server HPVS for VPC Instance\n",
    "\n",
    "Check the status of your secure build instance by checking the logs of your deployment in LogDNA. \n",
    "\n",
    "If you have for some reason closed your LogDNA instance, navigate to the IBM Cloud UI (signing in if necessary) via [this link](https://cloud.ibm.com/observe/logging) which will take you to your logging instances. Then, click the blue **Open Dashboard** button in the upper right for the logDNA instance you are using for this lab.\n",
    "\n",
    "Wait a few minutes for logs to appear and see the container come up in the logs before moving on to the next step.\n",
    "\n",
    "If there are issues with your deployment such as no logs appearing after 5 minutes contact an instructor for help getting unraveled."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f290d281-35f9-481b-b314-151860d58ed0",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.34 Get the network interface card (nic) ID for your instance\n",
    "\n",
    "Get the network interface card ID for your instance and save it as a variable by entering it into the next code block after the = sign and running the code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "353ec1ca-a1b6-4534-84af-e90b503b51c8",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-network-interfaces $instance"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "92c43eb9-a897-447a-96e7-e908df757ecf",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env nic="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f444c312-796b-46b6-ad2f-1e926186f469",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.35 Create a dedicated IP for your instance\n",
    "\n",
    "Create a floating IP to access your instance with using the following command."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "1fac8f50-0725-42fb-900f-7a40ed3bca14",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is floating-ip-reserve secure-build-fip --nic $nic"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b59f009e-c458-4e5a-a7a9-27367eaf34d0",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.36 Save your IP as a variable\n",
    "\n",
    "Save the `Address` field of the above command's output (your floating ip address) as a variable for later use by pasting it after the = sign in the code block below and then running the code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "55b2edc2-91f2-4e16-8cea-6427957ded55",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env sb_ip="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58e52530-8624-439f-bf9c-a233f5dbc39c",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 5.37 Set your IP address to the hostname of your secure build container\n",
    "\n",
    "Map your secure build container's IP to hostname in /etc/hosts"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "acfe5a30-fe9a-49da-92f5-756a521ba125",
   "metadata": {},
   "outputs": [],
   "source": [
    "! echo \"$sb_ip sbs.example.com\" | sudo tee -a /etc/hosts"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "detailed-monte",
   "metadata": {},
   "source": [
    "## Securely Build the Bitcoin Wallet Application\n",
    "---\n",
    "\n",
    "### Step 6.1 Check the status of your Secure Build Server\n",
    "\n",
    "Run the following command to check the status of your Secure Build Server instance. The value of the _status_ field in the output should be empty, i.e., `\"status\": \"\"`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "jewish-italy",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py status --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "numeric-sacramento",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.2 Initialize the configuration for your Secure Build Server instance\n",
    "\n",
    "Run the following code cell to initialize the configuration for your Secure Build Server instance. The status of the output should be `OK`:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "aggregate-combine",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py init --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "insured-material",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.3 Start the build of your sample secure bitcoin wallet application image\n",
    "\n",
    "The code cell below will start the build of your application image. The command returns quickly, as soon as it submits the request to start the build.  Your status message from the command output should say `OK: async build started`, which indicates that the build of your image has been started up on your Secure Build Server container. The command does not wait for the build to complete. The build will take about twenty minutes. Try to check out the next two steps before you take a break.\n",
    "\n",
    "Run the below code cell to start the your build:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "irish-advocate",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py build --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "thermal-plasma",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.4 Check the status of your application image build\n",
    "\n",
    "Check the status of your build by running the code cell below. You can check it periodically—your build should take about twenty minutes to complete. You can run this code cell periodically, as well as the command in the subsequent code cell (_Step 6.5_) which displays the log messages from the build.  For now, check the status by running the code cell below.  Your build has completed successfully once the output of the code cell has the value of *success* in the *status* field:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "widespread-skirt",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py status --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "complete-passing",
   "metadata": {},
   "source": [
    "In the above code cell, until the build completes, you may see several different statuses, including:\n",
    "\n",
    "_cleaned up_   This status can appear at the beginning of the build but you may not see it as the status quickly changes to _github cloned_.\n",
    "\n",
    "_github cloned_  This status appears most of the time as this status remains until the image build is complete, and this takes the largest amount of the entire build time.\n",
    "\n",
    "_image built_  Once the image is built, but before the push of the image into your Docker Hub account is complete, you may see this status.\n",
    "\n",
    "_image pushed_ Once the image has been pushed to your Docker Hub account, you may see this status, but usually the build completes very soon afterwards, so you may not see this status, as it should hopefully quickly change to _success_ status.\n",
    "\n",
    "_success_ Once the secure build process has completed successfully, you will see this status. Once you see this status, you are free to move on (Step 6.10). Remember, you can run the command to display the build log periodically (Step 6.9) while you are waiting for this _success_ status. \n",
    "\n",
    "---\n",
    "\n",
    "### Step 6.5 View the log from your application image build\n",
    "\n",
    "Your secure image build will produce a lot of output in its log. \n",
    "\n",
    "You can check the log of your build by running the below code cell. \n",
    "\n",
    "**Jupyter Notebook tip 1:** In some environments this output may be placed in a scrollable window, but in other environments all of the log output may be placed into the notebook, which makes navigating to the rest of the Notebook more difficult.  If this happens to you, you can enable scrolling by clicking in the output, then right-click and choose _Enable Scrolling for Outputs_. This will place the output into a scrollable window. \n",
    "\n",
    "**Jupyter Notebook tip 2:** Additionally, you can clear the output of this command from your Jupyter Notebook by clicking within the output, then right-click and choose _Clear Outputs_.  (The build logs are retained on the Secure Build Server and can be retrieved at any time).\n",
    "\n",
    "**Jupyter Notebook tip 3:** Running a code cell clears the output from any previous execution of the code cell, so if you want to view the log more than once, you don't need to clear the output as described in the tip given in the preceding paragraph."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "finnish-azerbaijan",
   "metadata": {
    "scrolled": true,
    "tags": []
   },
   "outputs": [],
   "source": [
    "! ./build.py log --log build --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "primary-chaos",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.6 Download the state image of your Secure Build Server (After build has finished)\n",
    "\n",
    "Run the code cell below to download the state image, which is a backup of the state of your Secure Build Server instance. This can be used to recreate your Secure Build Server if necessary. This backup also contains the logs of any builds you run on your Secure Build Server."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "burning-stage",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py get-state-image --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "incorporated-sleeve",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.7 Verify the manifest file from your build\n",
    "\n",
    "The Secure Build Server creates a signed manifest file for each successful build. The manifest file is useful for audit purposes. You can verify the source and integrity of the build and the built image or you can pass the manifest file to an auditor to do so. Run the below code cell to download and verify the manifest file:"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "general-persian",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py get-manifest --env sbs-config.json  --verify-manifest"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4888febf-f0d6-4e55-9a26-a562e836fbdf",
   "metadata": {},
   "source": [
    "The above command downloads the manifest file and verifies the digital signature on it.  In the last line of output from the above code cell you should see *verify=OK* which indicates that the digital signature is valid and is proof that the manifest file has not been tampered with.\n",
    "\n",
    "---\n",
    "\n",
    "### Step 6.8 Download image digest\n",
    "\n",
    "Download the digest of your image to use in your docker-compose file later."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e9de941f-d327-4111-9bca-bf54e851d3ce",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py get-digest --env sbs-config.json | cut -d \":\" -f2-3 | cut -d \" \" -f2 > sbw_image.env"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "bc4d0042-4368-4ac6-aa87-c2db9fafe868",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 6.9 Download signed image public key\n",
    "\n",
    "Download the public key used to sign your image during the secure build process for later use."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0d35ddff-c68d-4fee-9c01-dfb8c62cb7c5",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ./build.py get-signed-image-publickey --env sbs-config.json"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "industrial-inquiry",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Create HPVS for VPC using the image that you just built\n",
    "\n",
    "### Step 7.1 Create a new working directory\n",
    "\n",
    "Create a new working directory for your work creating your secure bitcoin wallet contract."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "f04518ee-dfab-4d8e-90db-ab98951cb68f",
   "metadata": {},
   "outputs": [],
   "source": [
    "! mkdir -p secure-bitcoin-wallet"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0aa9d51b-6030-42b7-af42-142276ecccc4",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd secure-bitcoin-wallet"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "065558b9-cf91-4329-8aa5-b5149eaf0a3c",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.2 Create a compose subdirectory\n",
    "\n",
    "Create a subdirectory for your work setting up your contract and change into it"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9a750bfd-a479-498d-9081-f978ad9f3155",
   "metadata": {},
   "outputs": [],
   "source": [
    "! mkdir -p {environment,workload/compose}"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "366acf14-adab-41f9-9c44-ae3780746e8e",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd workload/compose"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "8af3d6c7-defb-47fa-942a-95eef8e70bc8",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.3 Create your Docker Compose file\n",
    "\n",
    "Create the Docker Compose file for the secure bitcoin wallet application."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "621103b6-cb90-419d-9fac-00ef8f6f5873",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > docker-compose.yml\n",
    "services:\n",
    "  wallet:\n",
    "    image: $(cat ../../../sbw_image.env)\n",
    "    ports:\n",
    "      - \"443:443\"\n",
    "    environment:\n",
    "      - WALLET_NAME=general\n",
    "      - ZHSM=\\${ZHSM}\n",
    "      - APIKEY=\\${APIKEY}\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a11d51b1-93dd-401b-be10-f16d2f71536d",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.4 Check the contents of your Docker compose file\n",
    "\n",
    "Check on the Docker Compose file you just created with the following code box."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "069d9e7f-9488-4807-8807-9989d5698549",
   "metadata": {},
   "outputs": [],
   "source": [
    "! cat docker-compose.yml"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "58fb6b70-68d8-4eca-91d9-58bb507c1551",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.5 Move to the main workload directory\n",
    "\n",
    "Move back a directory to the main workload directory"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b553ff84-79e0-43c2-ae27-09902a49b50b",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd .."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "a7b89c83-6f08-4071-955a-798cca1f7029",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.6 Create a script to encrypt the workload section of the contract\n",
    "\n",
    "Create a a convenience script to automate creating the encrypted workload section of the contract."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "373bb98b-f542-49a9-af07-7ebb1f2c8961",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.workload\n",
    "# Create the workload section of the contract and add the contents in the workload.yaml file.\n",
    "\n",
    "WORKLOAD_PLAIN=./workload.yaml.plaintext\n",
    "WORKLOAD=workload.yaml\n",
    "\n",
    "echo \"  type: workload\n",
    "  compose:\n",
    "    archive: \\$(tar -czv -C compose . | base64 -w0)\n",
    "  images:\n",
    "    dct:\n",
    "      \\$(cat ../../sbw_image.env | cut -d \"@\" -f1):\n",
    "        notary: https://notary.docker.io\n",
    "        publicKey: \\$(cat ../../docker.io-${docker_user}-secure-bitcoin-wallet-public.key)\" > \\${WORKLOAD_PLAIN}\n",
    "\n",
    "# Download certificate to encrypt contract for Hyper Protect Container Runtime:\n",
    "HPCR_rev=11\n",
    "CONTRACT_KEY=./ibm-hyper-protect-container-runtime-1-0-s390x-\\${HPCR_rev}-encrypt.crt\n",
    "curl https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/ibm-hyper-protect-container-runtime-1-0-s390x-\\${HPCR_rev}-encrypt.crt > \\${CONTRACT_KEY}\n",
    "\n",
    "\n",
    "# Use the following command to create a random password:\n",
    "PASSWORD_WORKLOAD=\"\\$(openssl rand 32 | base64 -w0)\"\n",
    "\n",
    "# Use the following command to encrypt password with the Hyper Protect Container Runtime Contract Encryption Key:\n",
    "ENCRYPTED_WORKLOAD_PASSWORD=\"\\$(echo -n \"\\$PASSWORD_WORKLOAD\" | base64 -d | openssl rsautl -encrypt -inkey \\$CONTRACT_KEY -certin | base64 -w0)\"\n",
    "\n",
    "# Use the following command to encrypt the workload.yaml file with a random password:\n",
    "ENCRYPTED_WORKLOAD=\"\\$(echo -n \"\\$PASSWORD_WORKLOAD\" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in \"\\$WORKLOAD_PLAIN\" | base64 -w0)\"\n",
    "\n",
    "# Use the following command to get the encrypted section of the contract:\n",
    "WORKLOAD_ENCRYPTED=\"hyper-protect-basic.\\${ENCRYPTED_WORKLOAD_PASSWORD}.\\${ENCRYPTED_WORKLOAD}\"\n",
    "\n",
    "echo \"\"\n",
    "echo \"See `pwd`/workload.yaml.plaintext to see what was encrypted for the workload section of your contract\"\n",
    "echo \"\"\n",
    "\n",
    "echo \"\\$WORKLOAD_ENCRYPTED\" > ../\\$WORKLOAD\n",
    "EOF\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "200a2d97-02b2-4e12-924f-36be8a59fff5",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.7 Move to the environment directory\n",
    "\n",
    "Move to the environment directory to begin working on the environment section of the contract."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "e3b10f30-de9f-49a9-97c0-2a4024f47e56",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd ../environment"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "439b4e2c-80ba-445d-a48f-49c8dec810b8",
   "metadata": {},
   "source": [
    "--- \n",
    "\n",
    "### Step 7.8 Set the instructor-provided API key and HSM URL\n",
    "\n",
    "Set the instructor-provided API Key by pasting it to the right of the = sign in the code cell below and then running the code cell."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "359cbbb5-0c92-4142-9a15-a6a8d59f39c4",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env api_key="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4731d24c-0bbb-41f6-a677-7bd3213fc71d",
   "metadata": {},
   "source": [
    "Set the instuctor-provided HSM URL by pasting it to the right of the = sign in the code cell below and then running the code cell."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "002080cf-35fb-4810-b7fb-0f498d7d53fe",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env hsm_url="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2a059ee2-4e4c-4875-8edd-c1ed011429fa",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.9 Create a script to encrypt the environment section of the contract\n",
    "\n",
    "Create a convenience script to automate creating the encrypted environment section of the contract."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "7035062b-e3c3-4b26-ba4d-6233e54680a5",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.env\n",
    "# Create the env section of the contract and add the contents in the env.yaml file.\n",
    "ENV_PLAIN=\"./env.yaml.plaintext\"\n",
    "ENV=\"env.yaml\"\n",
    "\n",
    "echo \"  type: env\n",
    "  logging:\n",
    "    logDNA:\n",
    "      hostname: \\${logdna_hostname}\n",
    "      ingestionKey: \\${logdna_ingestion_key}\n",
    "      port: 6514\n",
    "  env:\n",
    "    ZHSM: ${hsm_url}\n",
    "    APIKEY: ${api_key}\" > \\${ENV_PLAIN}\n",
    "\n",
    "cat ./pubSigningKey.yaml >> \\${ENV_PLAIN}\n",
    "\n",
    "# Download certificate to encrypt contract for Hyper Protect Container Runtime:\n",
    "HPCR_rev=11\n",
    "CONTRACT_KEY=./ibm-hyper-protect-container-runtime-1-0-s390x-\\${HPCR_rev}-encrypt.crt\n",
    "curl https://cloud.ibm.com/media/docs/downloads/hyper-protect-container-runtime/\\$CONTRACT_KEY > \\$CONTRACT_KEY\n",
    "\n",
    "\n",
    "# Use the following command to create a random password:\n",
    "PASSWORD_ENV=\"\\$(openssl rand 32 | base64 -w0)\"\n",
    "\n",
    "#  Use the following command to encrypt password with the Hyper Protect Container Runtime Contract Encryption Key:\n",
    "ENCRYPTED_ENV_PASSWORD=\"\\$(echo -n \"\\$PASSWORD_ENV\" | base64 -d | openssl rsautl -encrypt -inkey \\$CONTRACT_KEY -certin | base64 -w0 )\"\n",
    "\n",
    "# Use the following command to encrypt env.yaml with a random password:\n",
    "ENCRYPTED_ENV=\"\\$(echo -n \"\\$PASSWORD_ENV\" | base64 -d | openssl enc -aes-256-cbc -pbkdf2 -pass stdin -in \"\\$ENV_PLAIN\" | base64 -w0)\"\n",
    "\n",
    "# Use the following command to get the encrypted section of the contract:\n",
    "ENV_ENCRYPTED=\"hyper-protect-basic.\\${ENCRYPTED_ENV_PASSWORD}.\\${ENCRYPTED_ENV}\"\n",
    "\n",
    "echo \"\"\n",
    "echo \"See `pwd`/env.yaml.plaintext to see what was encrypted for the env section of your contract\"\n",
    "echo \"\"\n",
    "\n",
    "echo \"\\$ENV_ENCRYPTED\" > ../\\$ENV\n",
    "EOF\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "61a8bf0d-9f8e-42ac-a52a-150c24e7081a",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.10 Move back to the main directory\n",
    "\n",
    "Move back to the secure-bitcoin-wallet main directory"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "0dd0c9ef-e28c-40a3-92b4-42208110d994",
   "metadata": {},
   "outputs": [],
   "source": [
    "%cd .."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "1ac00ce4-9f89-4fd6-bb53-7f0c240d0430",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.11 Create scripts for signing the contracts\n",
    "\n",
    "Create a script for generating keys and one for signing the contracts by running the code cells below."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "7f77d16e-4a93-4a28-852c-f9b32799c3c6",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.prepare\n",
    "# Use the following command to generate key pair to sign the contract \n",
    "openssl genrsa -aes128 -passout pass:test1234 -out private.pem 4096\n",
    "openssl rsa -in private.pem -passin pass:test1234 -pubout -out public.pem\n",
    "\n",
    "# The following command is an example of how you can get the signing key:\n",
    "key=\\$(awk -vRS=\"\\n\" -vORS=\"\\\\\\\\\\n\" '1' public.pem)\n",
    "# echo \"  signingKey: \\\"\\${key%\\\\\\\\n}\\\"\" > environment/pubSigningKey.yaml\n",
    "printf \"%s\" \"  signingKey: \\\"\\${key%\\\\\\\\n}\\\"\" > environment/pubSigningKey.yaml\n",
    "EOF"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "56de48f7-c14f-4f60-9631-3e270bde369d",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > flow.signature\n",
    "# combine workload and environment\n",
    "cat workload.yaml env.yaml | tr -d '\\n' > contract.yaml\n",
    "\n",
    "# Sign the combination from workload and env being approved\n",
    "echo \\$( cat contract.yaml | openssl dgst -sha256 -sign private.pem -passin pass:test1234 | openssl enc -base64) | tr -d ' ' > signature.yaml\n",
    "\n",
    "# Create user data and add signature:\n",
    "echo \"workload: \\$(cat workload.yaml)\n",
    "env: \\$(cat env.yaml)\n",
    "envWorkloadSignature: \\$(cat signature.yaml)\" > user_data.yaml\n",
    "\n",
    "echo \"\"\n",
    "echo \"import `pwd`/user_data.yaml into User Data or copy and paste from below:\"\n",
    "echo \"\"\n",
    "\n",
    "cat user_data.yaml\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "eaead540-52fa-4d86-95af-666061ea3ec8",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.12 Create a script to run the other scripts\n",
    "\n",
    "Create a main script to launch the various different scripts, automating the entire process of creating the contract."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "66712d39-42d8-4605-b2e4-7422cb0faf3c",
   "metadata": {},
   "outputs": [],
   "source": [
    "%%bash\n",
    "cat << EOF > makeContract\n",
    ". ./flow.prepare\n",
    "cd workload\n",
    ". ./flow.workload\n",
    "cd ../environment\n",
    ". ./flow.env\n",
    "cd ..\n",
    ". ./flow.signature\n",
    "EOF"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "7541bf19-b419-4b00-901d-0ec06bcc5cdc",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.13 Create the contract\n",
    "\n",
    "Create the contract by running the contract creation automation script."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "78837276-5a9e-42ac-9a56-e9b1a2da8898",
   "metadata": {},
   "outputs": [],
   "source": [
    "! . ./makeContract"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "e1c898ae-870e-425b-8bcd-bb248e4ecd3a",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.14 Set an environment variable for your HPVS for VPC Instance\n",
    "\n",
    "Set an environment variable with your HPVS for VPC instance name"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "15e056e8-8774-4adb-9dc3-3b35f1e766e5",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env sbw_instance=secure-bitcoin-wallet"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "nuclear-seven",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.15 Launch your HPVS for VPC Instance\n",
    "\n",
    "Create your HPVS for VPC Instance with the following command"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "continent-chapter",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-create $sbw_instance $vpc $zone bz2e-1x4 $subnet --image $(cat ../hpcr_image.env) --user-data @user_data.yaml"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "unlimited-reggae",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.16 Check the status of your HPVS for VPC Instance\n",
    "\n",
    "Check the status of your secure bitcoin wallet instance by checking the logs of your deployment in LogDNA. \n",
    "\n",
    "If you have for some reason closed your LogDNA instance, navigate to the IBM Cloud UI (signing in if necessary) via [this link](https://cloud.ibm.com/observe/logging) which will take you to your logging instances. Then, click the blue **Open Dashboard** button in the upper right for the logDNA instance you are using for this lab.\n",
    "\n",
    "If there are issues with your deployment contact an instructor for help unraveling them. "
   ]
  },
  {
   "cell_type": "markdown",
   "id": "10ece690-d397-4607-9901-7fcc698ea5da",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.17 Find the nic for your newly created HPVS for VPC instance\n",
    "\n"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b3f20a6f-c84c-4be9-9711-fe6a493d5571",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-network-interfaces $sbw_instance"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "b49aca37-4e40-4753-94c4-f7c7001b218c",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.18 Set nic based on above output\n",
    "\n",
    "Set an environment variable for your nic based on the above output by pasting the above ID into the code block below after the `=` sign and then running the code block."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "887cee01-9648-4921-abab-9e2689561c15",
   "metadata": {},
   "outputs": [],
   "source": [
    "%set_env sbw_nic="
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ed08072b-9548-4db5-880e-40f14fa0db49",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.19 Create a floating IP for the HPVS for VPC instance\n",
    "\n",
    "Create a floating IP for the HPVS for VPC Instance to access it via an IP"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "9e2b505a-4b98-4f6b-8872-9c0666e90d9d",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is floating-ip-reserve bitcoin-wallet-fip --nic $sbw_nic"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "optimum-singer",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 7.20 Edit this markdown cell to create a clickable link to get to your sample application\n",
    "\n",
    "Once your instance is active, note the value of the _Address_ field from the output from _Step 7.19_.  \n",
    "\n",
    "Double-click anywhere within this paragraph to go into _edit_ mode of this markdown cell.  Then, in the final line of this markdown cell, change `xx.xx.xx.xx` to your public IP address.  The actual URL is on the right side of the line (between parentheses). The text of the link is on the left side of the line in between square brackets.  You may as well change both occurrences of `xx.xx.xx.xx` for clarity, but the one that matters is the link on the right side.   (If you don't see both sides you haven't succesfully got into edit mode—keep trying or ask an instructor for help).  After you have made the change, run this markdown cell by clicking the *Run* icon in the Jupyter Notebook menu above. This will render the markdown and present you with the properly formatted link. Click the link and you will bring up your sample secure bitcoin wallet application.\n",
    "\n",
    "[Change the xxx.xxx.xxx.xxx to your public IP and then click here](https://xxx.xxx.xxx.xxx/electrum)"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "european-analyst",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Running the Secure Bitcoin Wallet Application in your HPVS for VPC instance\n",
    "\n",
    "### Overview\n",
    "\n",
    "This application is a secure [Electrum](https://electrum.org/#home) Bitcoin wallet found at [this GitHub repository](https://github.com/IBM/secure-bitcoin-wallet). You can use it to store the identities necessary to transact on the Bitcoin public blockchain network. While this version of the wallet is just a proof of concept, running this type of wallet on Hyper Protect enables you to protect your digital assets from bad actors such as malicious server administrators.\n",
    "\n",
    "*This Electrum Bitcoin wallet functions regularly, while inheriting the security benefits of the Hyper Protect Virtual Server for VPC platform. This ensures that a legitimate version of the application is running (Secure Image Build process) and that administrators cannot compromise the application (Hyper Protect Virtual Server for VPC deployment).*\n",
    "\n",
    "Here is an overview diagram of the _sample secure bitcoin wallet application_ that you built in this lab: \n",
    "\n",
    "![Secure Bitcoin Overview](images/sampleapparch.png)\n",
    "\n",
    "The application, by default, uses software cryptography in order to generate keys, but it can also be configured to use _Hyper Protect Crypto Services_ in order to generate keys more securely, which is what you have done earlier in this lab when you specified the _ZHSM_ and the _APIKEY_ environment variables in _Step 7.2_.\n",
    "\n",
    "\n",
    "### Step 8.1 Account Registration\n",
    "\n",
    "Registering a fake account for lab purposes.\n",
    "\n",
    "1. Choose `Register` since you won't have an existing account on the newly deployed server.\n",
    "\n",
    "    ![Secure Bitcoin Wallet Welcome](Bitcoin_Wallet_Images/Bitcoin_Wallet_Homepage.png)\n",
    "\n",
    "2. Enter the registration details you desire.\n",
    "\n",
    "    ![User Registration](Bitcoin_Wallet_Images/Wallet_register_info.png)\n",
    "\n",
    "\n",
    "*Do not worry about the information you enter on the registration page (shown below) as it won't map to anything critical to the real world.  You just need your password to log back in if you log out of the application.*\n",
    "\n",
    "### Step 8.2 Wallet initialization\n",
    "\n",
    "It's time to set up your Secure Electrum Bitcoin wallet itself!\n",
    "\n",
    "1. Bring up the wallet screen\n",
    "\n",
    "    ![Wallet Start](Bitcoin_Wallet_Images/Click_Wallet_Start.png)\n",
    "\n",
    "2. Enter in a `password` for your wallet and click `Create Wallet`\n",
    "\n",
    "    ![Create Wallet](Bitcoin_Wallet_Images/Create_Wallet.png)\n",
    "\n",
    "3. Load your newly created wallet to enable it\n",
    "\n",
    "    ![Load Wallet](Bitcoin_Wallet_Images/Load_Wallet.png)\n",
    "\n",
    "4. Reload the page\n",
    "\n",
    "    ![Initialized Wallet](Bitcoin_Wallet_Images/Reload_new_wallet.png)\n",
    "\n",
    "5. Your wallet is ready for use in all of its glory\n",
    "\n",
    "    ![Locked and Loaded Wallet](Bitcoin_Wallet_Images/Loaded_Wallet_Time.png)\n",
    "\n",
    "### Step 8.3 Receiving Bitcoins\n",
    "\n",
    "A wallet without currency is blasphemy, so it's time to fill it on up with fake bitcoins.\n",
    "\n",
    "1. Go to the `Receive` section of the wallet and get the bitcoin wallet address.  \n",
    "\n",
    "    ![Wallet receiving bitcoin](Bitcoin_Wallet_Images/Receiving_bitcoin.png)\n",
    "\n",
    "    *This is the address whose alloted bitcoins you lay claim to.*\n",
    "\n",
    "2. Open [this bitcoin test faucet site](https://testnet-faucet.com/btc-testnet/) [click on the link] and use it to transfer bitcoin value to the `Receiving address` in your wallet **from step 1 above**.\n",
    "\n",
    "    ![Transfer Bitcoins](Bitcoin_Wallet_Images/Send_bitcoins_to_wallet.png)\n",
    "\n",
    "    *Instead of transacting on the \"real\" bitcoin blockchain network, we are using a [testnet](https://medium.com/myetherwallet/understanding-blockchain-changes-testnets-and-mainnets-c2171a8e835f). This means that the network participants agree that the assets on the network have no value. Testnets are used for testing changes to the network, testing applications and introducing new users to the technical aspects of network. There are testnets for many of the public blockchain networks including of course bitcoin and ethereum. Test faucets (like the one we are using) act as distributors of tokens to other users on the testnet.*\n",
    "\n",
    "3. Switch back to your wallet tab and go to the `History` section and then reload the page.\n",
    "\n",
    "    ![Check History](Bitcoin_Wallet_Images/Check_History_Receive_Transaction.png)\n",
    "\n",
    "4. You should now see your wallet address as the recipient of a `pending transaction` from the bitcoin testnet faucet.\n",
    "\n",
    "    ![First Transaction History](Bitcoin_Wallet_Images/Transaction_History_no_confirmations.png)\n",
    "\n",
    "5. After clicking for more information you get a detailed transaction overview\n",
    "\n",
    "    ![Receive Transaction 0 Confirmations](Bitcoin_Wallet_Images/0_confirmations_block_details.png)\n",
    "\n",
    "    *The number of [confirmations](https://en.bitcoin.it/wiki/Confirmation) a block receives is the number of blocks deep the block that has included the blockchain transaction is. In other words, `1 confirmation` means that the current head block includes the transaction. `2 confirmations` means that the current head block's parent block contains the transaction and so on. The deeper the transaction is (more confirmations it has) the more mining power it would take to \"reverse history\" and undo the transaction.*\n",
    "\n",
    "    Since there are `0 confirmations` in the picture above, it means that the transaction is not yet included in a block. This is why it has no timestamp yet and its block number is listed as `0`.\n",
    "\n",
    "6. After waiting anywhere from a minute to a few minutes (depending on the current testnet traffic) you should see a confirmation on your transaction.\n",
    "\n",
    "    *You will need to keep reloading the page for it to update. It doesn't update automatically.*\n",
    "\n",
    "    ![1 Confirmation Received](Bitcoin_Wallet_Images/1_Confirmation_Received.png)\n",
    "\n",
    "    There is now a timestamp and a block number!\n",
    "\n",
    "    *As time passes more confirmations will accumulate. You can check on the `confirmations` again at the end of the lab to show yourself this (Given enough time has passed for one or more additional confirmations to occur).*\n",
    "\n",
    "### Step 8.4 Returning Bitcoins\n",
    "\n",
    "Since you are feeling charitable you decide to transfer your testnet value back to the faucet's address.\n",
    "\n",
    "1. Go back to [the faucet site](https://testnet-faucet.com/btc-testnet/) and get its bitcoin address\n",
    "\n",
    "    ![Faucet Address](Bitcoin_Wallet_Images/testnet_faucet_address.png)\n",
    "\n",
    "2. Send bitcoins to faucet using `Send` section of wallet\n",
    "\n",
    "    ![Send Bitcoins to Faucet](Bitcoin_Wallet_Images/Send_bitcoins_back_to_faucet.png)\n",
    "\n",
    "3. Once sent you will see the `Signed transaction` information filled out on your wallet page.\n",
    "\n",
    "    ![Bitcoins Sent Back to Faucet](Bitcoin_Wallet_Images/bitcoin_send_transaction_output.png)\n",
    "\n",
    "4. You can go back to the [bitcoin faucet site](https://bitcoinfaucet.uo1.net/send.php) (you may have to refresh the page) and see the transaction as green there with a sender of your address and a transaction ID matching the one you sent.\n",
    "\n",
    "    ![Bitcoins returned to faucet](Bitcoin_Wallet_Images/transaction_giving_coins_back_to_faucet.png)\n",
    "\n",
    "5. You can view both the initial received transaction and the newly sent transaction in the `History` tab of your bitcoin wallet.\n",
    "\n",
    "    *You have to keep reloading the page for it to update with new confirmations. If you wait long enough, eventually these transactions will gain confirmations as in the picture below*\n",
    "\n",
    "    ![Both transactions with 1 confirmation](Bitcoin_Wallet_Images/both_confirmed_transactions.png)\n",
    "\n",
    "6. You can continue to play around with the electrum wallet before moving on.\n",
    "\n",
    "### Summary\n",
    "\n",
    "You have participated in the bitcoin testnet using a securely built electrum bitcoin wallet powered by a Hyper Protect Virtual Server. Congratulations!!! \n",
    "\n",
    "Now, it's time to clean up.."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "talented-lexington",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## Clean up when you are done with the lab"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "complete-quick",
   "metadata": {},
   "source": [
    "This section describes important cleanup steps to perform when you have completed the lab. It will guide you through deleting the following artifacts that you created during the lab:\n",
    "\n",
    "1. The Secure Build Server HPVS for VPC instance you created\n",
    "2. The Secure Build Server volume you created\n",
    "3. The Sample Secure Bitcoin Wallet Application HPVS for VPC instance you created\n",
    "4. The subnet you created for this lab\n",
    "5. The public gateway you created for this lab\n",
    "6. The 2 floating ips you creataed for this lab\n",
    "7. The VPC you created for this lab\n",
    "8. The logDNA instance you created for this lab (skip if using existing instance)\n",
    "9. The Secure Bitcoin Wallet Application container image that you created for this lab\n",
    "10. The Docker Access Token that you created for this lab\n",
    "11. The GitHub ssh key you created for this lab\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "critical-fellowship",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.1 Delete your Secure Build Server HPVS for VPC instance\n",
    "\n",
    "Run the following code block to delete your secure build Server HPVS for VPC instance."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "suspended-upgrade",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-delete $instance --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "2975e9eb-d86f-4960-92dd-d0493ef5a552",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.2 Delete your Secure Build Server volume\n",
    "\n",
    "Run the following code block to delete your secure build server volume."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "2473409a-9e3d-4139-9d36-a23ead085fb5",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is volume-delete secure-build-volume --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "prescribed-consultancy",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.3 Delete your sample Secure Bitcoin Wallet Application HPVS for VPC instance\n",
    "\n",
    "Running the following code cell to delete your secure bitcoin for application."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "selected-water",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is instance-delete $sbw_instance --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4bcaacc9-fee5-4937-b5de-8b048b93b52a",
   "metadata": {},
   "source": [
    "### Step 9.4 Delete the subnet for your VPC\n",
    "\n",
    "Run the following code block to delete the subnet you created for this lab. If you get a failed to delete you may need to wait a minute or so for the instances to be fully deleted before re-running this command."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "b806fbbd-bdb1-4812-942b-8c4b13228f08",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is subnet-delete $subnet --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "aaa9e448-8dfa-46a5-8333-bfe9027d262f",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.5 Delete your public gateway\n",
    "\n",
    "Run the following code block to delete the public gateway you created for this lab."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "a04e16d4-c971-4246-bbd6-11052020474d",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is public-gateway-delete $gateway --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "97883967-b216-4c39-8bc2-ee4d7919586d",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.6 Deleting the Floating IPS you created for this lab\n",
    "\n",
    "Run the following two code blocks to delete the floating IPs you created for this lab."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "c1931274-d77c-46ee-940a-ab357ddb7e79",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is floating-ip-release secure-build-fip --force"
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "8da54cc0-aa62-4766-bee3-2a9ea1ce02f4",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is floating-ip-release bitcoin-wallet-fip --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "ab4123a5-8320-496d-ad56-85e1dff9aafd",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.7 Delete the VPC you created for this lab\n",
    "\n",
    "Run the following code block to delete the VPC you created for this lab."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "fc34b812-b174-48d1-a90e-d4b3f4b01e8d",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud is vpc-delete $vpc --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "f0eaba7b-4143-4715-88ea-f6ef961a772b",
   "metadata": {
    "tags": []
   },
   "source": [
    "---\n",
    "\n",
    "### Step 9.8 Delete the logDNA instance you created for this lab\n",
    "\n",
    "Run the following code block to delete the logDNA instance you created for this lab."
   ]
  },
  {
   "cell_type": "code",
   "execution_count": null,
   "id": "ed4fa5e8-098d-4db0-ae51-8fcaedd2029e",
   "metadata": {},
   "outputs": [],
   "source": [
    "! ibmcloud resource service-instance-delete secure-build-logdna --force"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "advisory-typing",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.9 Delete your sample secure bitcoin wallet application secure image from Docker Hub\n",
    "\n",
    "While logged in to your Docker Hub account, follow these steps from the Docker Hub web UI in order to delete the image you created in this lab:\n",
    "\n",
    "1. Click the *Repositories* link in the banner at the top of the page.\n",
    "2. Click the image that you created in the lab.\n",
    "3. Click the _Settings_ link.\n",
    "4. Scroll down to the _Delete Repository_ section and click the _Delete repository_ button.\n",
    "5. Enter your image name as confirmation–copy and paste is your friend here– for confirmation and click the _Delete_ button.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "collectible-appeal",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.10 Delete the Docker Access Token you created for this lab\n",
    "\n",
    "Follow [these instructions](https://docs.docker.com/docker-hub/access-tokens/#modify-existing-tokens) to delete the Docker Access Token you created earlier in the lab.\n",
    "\n"
   ]
  },
  {
   "cell_type": "markdown",
   "id": "danish-village",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "### Step 9.11 Remove the ssh key you created for this lab from your GitHub account\n",
    "\n",
    "Delete the ssh key you added for the lab from your GitHub account by following steps 1-3 of [these instructions](https://docs.github.com/en/github/authenticating-to-github/reviewing-your-ssh-keys), choosing the _Delete_ button for the ssh key you want to get rid of.  If you were an existing GitHub user prior to this lab, be careful not to delete any other ssh keys you may have added for other purposes."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "4a20bb50-20e9-4a27-84d7-3ef554fbfb30",
   "metadata": {},
   "source": [
    "---\n",
    "\n",
    "## You have reached the end of the lab!\n",
    "\n",
    "Thank you for taking this lab, and please feel free to provide feedback, either by opening a GitHub issue on the lab repo at https://github.com/ibm-wsc/ibm-cloud-hpvs-sbs-byoi-lab or by sending an email directly to either, Barry Silliman, at \"silliman at us dot ibm dot com\" or Garrett Woodworth at \"garrett dot lee dot woodworth at ibm dot com  (the email spammers will never figure out our real email addresses from that, but you will).\n",
    "\n",
    "---\n",
    "\n",
    "## Acknowledgements\n",
    "\n",
    "Our esteemed colleague Jin VanStee also made significant contributions to this lab."
   ]
  },
  {
   "cell_type": "markdown",
   "id": "tested-amber",
   "metadata": {},
   "source": [
    "## References\n",
    "\n",
    "This lab is based largely on publicly available material on IBM's website, especially [Tutorial: Using Secure Build Server with a digital wallet](https://cloud.ibm.com/docs/hp-virtual-servers?topic=hp-virtual-servers-tutorial_secure_build_server)\n",
    "\n",
    "Additional information about using the Secure Build Server CLI can be found [here](https://github.com/ibm-hyper-protect/secure-build-cli)  \n",
    "\n",
    "Here is the [GitHub repo for the sample secure bitcoin wallet application](https://github.com/IBM/secure-bitcoin-wallet)"
   ]
  }
 ],
 "metadata": {
  "kernelspec": {
   "display_name": "Python 3 (ipykernel)",
   "language": "python",
   "name": "python3"
  },
  "language_info": {
   "codemirror_mode": {
    "name": "ipython",
    "version": 3
   },
   "file_extension": ".py",
   "mimetype": "text/x-python",
   "name": "python",
   "nbconvert_exporter": "python",
   "pygments_lexer": "ipython3",
   "version": "3.11.4"
  },
  "metadata": {
   "interpreter": {
    "hash": "31f2aee4e71d21fbe5cf8b01ff0e069b9275f58929596ceb00d14d90e3e16cd6"
   }
  }
 },
 "nbformat": 4,
 "nbformat_minor": 5
}