Merge branch 'jcf-760-cr' into 'development'

Jcf 760 cr

See merge request !12

.gitignore

+# Default ignored files
+/shelf/
+/workspace.xml
+*.pyc
+*.lock
+*.idea
+*config.json
+*nohup.out
+node_modules
+package-lock.json
+*.eslintcache
\ No newline at end of file

.gitlab/issue_templates/Application - Initial.md

@@ -26,7 +26,7 @@ If this application is owned by a Contributor or Vendor (identifed as `Owner::Co
 ## Definition of Done
 
 Hardening:
-- [ ] Hardening manifest is created and adheres to the schema (https://repo1.dsop.io/ironbank-tools/ironbank-pipeline/-/blob/master/schema/hardening_manifest.schema.json)
+- [ ] Hardening manifest is created and adheres to the schema (https://repo1.dso.mil/ironbank-tools/ironbank-pipeline/-/blob/master/schema/hardening_manifest.schema.json)
 - [ ] Container builds successfully through the Gitlab CI pipeline
 - [ ] Branch has been merged into `development`
 - [ ] Project is configured for automatic renovate updates (if possible)
@@ -50,7 +50,7 @@ Note: If the above approval process is kicked back for any reason, the `Approval
 
 ### Continuous Monitoring
 
-Once a container is approved, the `Approved` label will be applied to this issue and it will be closed. You will be able to find your applications on http://ironbank.dsop.io and https://registry1.dsop.io.
+Once a container is approved, the `Approved` label will be applied to this issue and it will be closed. You will be able to find your applications on http://ironbank.dso.mil and https://registry1.dso.mil.
 
 In addition to the above, your application will now be subscribed to continuous monitoring. This means that any new findings discovered as part of this will need justifications. To satisfy this process, any new findings will trigger a new Gitlab issue in this project with the label `Container::New Findings`. All members listed in the `maintainers` section of the `hardening_manifest.yaml` file will automatically be assigned. It is your responsibility as a Contributor or Vendor to monitor for this and provide justifications in a timely fashion. This newly created issue will have all the instructions necessary to complete the process. Failure to provide justifications could result in the revocation of the application's approval status.
 

.gitlab/issue_templates/Application - Update.md

@@ -31,7 +31,7 @@ If this application is owned by a Contributor or Vendor (identifed as `Owner::Co
 
 ## Definition of Done
 Hardening:
-- [ ] Hardening manifest has been updated and adheres to the schema (https://repo1.dsop.io/ironbank-tools/ironbank-pipeline/-/blob/master/schema/hardening_manifest.schema.json)
+- [ ] Hardening manifest has been updated and adheres to the schema (https://repo1.dso.mil/ironbank-tools/ironbank-pipeline/-/blob/master/schema/hardening_manifest.schema.json)
 - [ ] Container builds successfully throughthe Gitlab CI pipeline
 - [ ] Branch has been merged into `development`
 - [ ] Project is configured for automatic renovate updates (if possible)
@@ -59,7 +59,7 @@ Note: If the above approval process is kicked back for any reason, the `Approval
 
 ### Continuous Monitoring
 
-Once a container is approved, the `Approved` label will be applied to this issue and it will be closed. You will be able to find your applications on http://ironbank.dsop.io and https://registry1.dsop.io.
+Once a container is approved, the `Approved` label will be applied to this issue and it will be closed. You will be able to find your applications on http://ironbank.dso.mil and https://registry1.dso.mil.
 
 In addition to the above, your application will now be subscribed to continuous monitoring. This means that any new findings discovered as part of this will need justifications. To satisfy this process, any new findings will trigger a new Gitlab issue in this project with the label `Container::New Findings`. All members listed in the `maintainers` section of the `hardening_manifest.yaml` file will automatically be assigned. It is your responsibility as a Contributor or Vendor to monitor for this and provide justifications in a timely fashion. This newly created issue will have all the instructions necessary to complete the process. Failure to provide justifications could result in the revocation of the application's approval status.
 

Dockerfile

+ARG BASE_REGISTRY=registry1.dso.mil
+ARG BASE_IMAGE=ironbank/redhat/openjdk/openjdk11
+ARG BASE_TAG=1.11
+
+FROM bitnami/redis:6.0.4 as base
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG} as staging
+ARG BITNAMI_HOME=/opt/bitnami
+USER 0
+RUN mkdir /staging
+COPY --from=base ${BITNAMI_HOME} /staging
+RUN rm -rf /staging/java
+
+FROM ${BASE_REGISTRY}/${BASE_IMAGE}:${BASE_TAG}
+ARG PKG=redis
+ARG BITNAMI_HOME=/opt/bitnami
+ARG REDIS_HOME=${BITNAMI_HOME}/redis
+
+ARG REDIS_USER_ID="1001"
+ARG REDIS_USER_NAME=${PKG}
+
+ENV REDIS_CONFIG_DIR=${REDIS_HOME}/config \
+    REDIS_SERVER_HOME=${REDIS_HOME} \
+    REDIS_BROKER_ID=0 \
+    REDIS_LOG_DIRS=/tmp/redis-logs \
+    REDIS_OFFSETS_TOPIC_REPLICATION_FACTOR=1 \
+    REDIS_TRANSACTION_STATE_LOG_REPLICATION_FACTOR=1 \
+    REDIS_TRANSACTION_STATE_LOG_MIN_ISR=1 \
+    BITNAMI_APP_NAME=redis \
+    PATH="${REDIS_HOME}/bin:/opt/bitnami/common/bin:$PATH"
+
+USER 0
+
+RUN dnf update -y --nodocs && \
+    dnf clean all && \
+    rm -rf /var/cache/dnf && \
+    mkdir -p ${BITNAMI_HOME} && \
+    mkdir /docker-entrypoint-initdb.d
+
+COPY --from=staging /staging ${BITNAMI_HOME}
+COPY scripts ${BITNAMI_HOME}/scripts
+
+RUN ln -s ${BITNAMI_HOME}/scripts/redis/entrypoint.sh /entrypoint.sh && \
+    ln -s ${BITNAMI_HOME}/scripts/redis/run.sh /run.sh && \
+    useradd -u ${REDIS_USER_ID} -g 0 -M -d ${REDIS_HOME} ${REDIS_USER_NAME} && \
+    chown -R ${REDIS_USER_NAME}:0 ${REDIS_HOME}
+
+USER ${REDIS_USER_ID}
+
+WORKDIR ${REDIS_HOME}
+
+EXPOSE 6379
+
+HEALTHCHECK NONE
+
+ENTRYPOINT [ "/opt/bitnami/scripts/redis/entrypoint.sh" ]
+CMD [ "/opt/bitnami/scripts/redis/run.sh" ]

LICENSE

+Copyright (c) 2015-2021 Bitnami
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.

hardening_manifest.yaml

+---
+apiVersion: v1
+
+# The repository name in registry1, excluding /ironbank/
+name: "bitnami/redis"
+
+# List of tags to push for the repository in registry1
+# The most specific version should be the first tag and will be shown
+# on ironbank.dso.mil
+tags:
+- "6.0.4"
+
+# Build args passed to Dockerfile ARGs
+args:
+  BASE_IMAGE: "redhat/openjdk/openjdk11"
+  BASE_TAG: "1.11"
+
+# Docker image labels
+labels:
+  org.opencontainers.image.title: "redis"
+  ## Human-readable description of the software packaged in the image
+  org.opencontainers.image.description: "Apache Redis® is a distributed streaming platform."
+  ## License(s) under which contained software is distributed
+  org.opencontainers.image.licenses: "Apache-2.0"
+  ## URL to find more information on the image
+  org.opencontainers.image.url: "https://bitnami.com/stack/redis/containers"
+  ## Name of the distributing entity, organization or individual
+  org.opencontainers.image.vendor: "Bitnami"
+  org.opencontainers.image.version: "6.0.4"
+  ## Keywords to help with search (ex. "cicd,gitops,golang")
+  mil.dso.ironbank.image.keywords: "dataflow,streaming"
+  ## This value can be "opensource" or "commercial"
+  mil.dso.ironbank.image.type: "opensource"
+  ## Product the image belongs to for grouping multiple images
+  mil.dso.ironbank.product.name: "Redis"
+
+# List of resources to make available to the offline build context
+resources:
+- tag: bitnami/redis:6.0.4
+  url: docker://docker.io/bitnami/redis@sha256:95846af0d76358b676b6d76dc05831572d62d5f8f25e43d28daf4756dee30dd7
+
+# List of project maintainers
+maintainers:
+- name: "Chris Recla"
+  username: "crecla"
+  email: "chrisrecla@seed-innovations.com"
+  cht_member: false
\ No newline at end of file

scripts/libbitnami.sh

+#!/bin/bash
+#
+# Bitnami custom library
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+
+# Constants
+BOLD='\033[1m'
+
+# Functions
+
+########################
+# Print the welcome page
+# Globals:
+#   DISABLE_WELCOME_MESSAGE
+#   BITNAMI_APP_NAME
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+print_welcome_page() {
+    if [[ -z "${DISABLE_WELCOME_MESSAGE:-}" ]]; then
+        if [[ -n "$BITNAMI_APP_NAME" ]]; then
+            print_image_welcome_page
+        fi
+    fi
+}
+
+########################
+# Print the welcome page for a Bitnami Docker image
+# Globals:
+#   BITNAMI_APP_NAME
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+print_image_welcome_page() {
+    local github_url="https://github.com/bitnami/bitnami-docker-${BITNAMI_APP_NAME}"
+
+    log ""
+    log "${BOLD}Welcome to the Bitnami ${BITNAMI_APP_NAME} container${RESET}"
+    log "Subscribe to project updates by watching ${BOLD}${github_url}${RESET}"
+    log "Submit issues and feature requests at ${BOLD}${github_url}/issues${RESET}"
+    log ""
+}
+

scripts/libcomponent.sh

+#!/bin/bash
+#
+# Library for managing Bitnami components
+
+# Constants
+CACHE_ROOT="/tmp/bitnami/pkg/cache"
+DOWNLOAD_URL="https://downloads.bitnami.com/files/stacksmith"
+
+# Functions
+
+########################
+# Download and unpack a Bitnami package
+# Globals:
+#   OS_NAME
+#   OS_ARCH
+#   OS_FLAVOUR
+# Arguments:
+#   $1 - component's name
+#   $2 - component's version
+# Returns:
+#   None
+#########################
+component_unpack() {
+    local name="${1:?name is required}"
+    local version="${2:?version is required}"
+    local base_name="${name}-${version}-${OS_NAME}-${OS_ARCH}-${OS_FLAVOUR}"
+    local package_sha256=""
+    local directory="/opt/bitnami"
+    
+    # Validate arguments
+    shift 2
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -c|--checksum)
+                shift
+                package_sha256="${1:?missing package checksum}"
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    echo "Downloading $base_name package"
+    if [ -f "${CACHE_ROOT}/${base_name}.tar.gz" ]; then
+        echo "${CACHE_ROOT}/${base_name}.tar.gz already exists, skipping download."
+        cp "${CACHE_ROOT}/${base_name}.tar.gz" .
+        rm "${CACHE_ROOT}/${base_name}.tar.gz"
+        if [ -f "${CACHE_ROOT}/${base_name}.tar.gz.sha256" ]; then
+            echo "Using the local sha256 from ${CACHE_ROOT}/${base_name}.tar.gz.sha256"
+            package_sha256="$(< "${CACHE_ROOT}/${base_name}.tar.gz.sha256")"
+            rm "${CACHE_ROOT}/${base_name}.tar.gz.sha256"
+        fi
+    else
+	curl --remote-name --silent "${DOWNLOAD_URL}/${base_name}.tar.gz"
+    fi
+    if [ -n "$package_sha256" ]; then
+        echo "Verifying package integrity"
+        echo "$package_sha256  ${base_name}.tar.gz" | sha256sum --check -
+    fi
+    tar --directory "${directory}" --extract --gunzip --file "${base_name}.tar.gz" --no-same-owner --strip-components=2 "${base_name}/files/"
+    rm "${base_name}.tar.gz"
+}

scripts/libfile.sh

+#!/bin/bash
+#
+# Library for managing files
+
+# Functions
+
+########################
+# Replace a regex in a file
+# Arguments:
+#   $1 - filename
+#   $2 - match regex
+#   $3 - substitute regex
+#   $4 - use POSIX regex. Default: true
+# Returns:
+#   None
+#########################
+replace_in_file() {
+    local filename="${1:?filename is required}"
+    local match_regex="${2:?match regex is required}"
+    local substitute_regex="${3:?substitute regex is required}"
+    local posix_regex=${4:-true}
+
+    local result
+
+    # We should avoid using 'sed in-place' substitutions
+    # 1) They are not compatible with files mounted from ConfigMap(s)
+    # 2) We found incompatibility issues with Debian10 and "in-place" substitutions
+    del=$'\001' # Use a non-printable character as a 'sed' delimiter to avoid issues
+    if [[ $posix_regex = true ]]; then
+        result="$(sed -E "s${del}${match_regex}${del}${substitute_regex}${del}g" "$filename")"
+    else
+        result="$(sed "s${del}${match_regex}${del}${substitute_regex}${del}g" "$filename")"
+    fi
+    echo "$result" > "$filename"
+}
+
+########################
+# Remove a line in a file based on a regex
+# Arguments:
+#   $1 - filename
+#   $2 - match regex
+#   $3 - use POSIX regex. Default: true
+# Returns:
+#   None
+#########################
+remove_in_file() {
+    local filename="${1:?filename is required}"
+    local match_regex="${2:?match regex is required}"
+    local posix_regex=${3:-true}
+    local result
+
+    # We should avoid using 'sed in-place' substitutions
+    # 1) They are not compatible with files mounted from ConfigMap(s)
+    # 2) We found incompatibility issues with Debian10 and "in-place" substitutions
+    if [[ $posix_regex = true ]]; then
+        result="$(sed -E "/$match_regex/d" "$filename")"
+    else
+        result="$(sed "/$match_regex/d" "$filename")"
+    fi
+    echo "$result" > "$filename"
+}
+
+########################
+# Appends text after the last line matching a pattern
+# Arguments:
+#   $1 - file
+#   $2 - match regex
+#   $3 - contents to add
+# Returns:
+#   None
+#########################
+append_file_after_last_match() {
+    local file="${1:?missing file}"
+    local match_regex="${2:?missing pattern}"
+    local value="${3:?missing value}"
+
+    # We read the file in reverse, replace the first match (0,/pattern/s) and then reverse the results again
+    result="$(tac "$file" | sed -E "0,/($match_regex)/s||${value}\n\1|" | tac)"
+    echo "$result" > "$file"
+}

scripts/libfs.sh

+#!/bin/bash
+#
+# Library for file system actions
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+
+# Functions
+
+########################
+# Ensure a file/directory is owned (user and group) but the given user
+# Arguments:
+#   $1 - filepath
+#   $2 - owner
+# Returns:
+#   None
+#########################
+owned_by() {
+    local path="${1:?path is missing}"
+    local owner="${2:?owner is missing}"
+
+    chown "$owner":"$owner" "$path"
+}
+
+########################
+# Ensure a directory exists and, optionally, is owned by the given user
+# Arguments:
+#   $1 - directory
+#   $2 - owner
+# Returns:
+#   None
+#########################
+ensure_dir_exists() {
+    local dir="${1:?directory is missing}"
+    local owner="${2:-}"
+
+    mkdir -p "${dir}"
+    if [[ -n $owner ]]; then
+        owned_by "$dir" "$owner"
+    fi
+}
+
+########################
+# Checks whether a directory is empty or not
+# arguments:
+#   $1 - directory
+# returns:
+#   boolean
+#########################
+is_dir_empty() {
+    local dir="${1:?missing directory}"
+
+    if [[ ! -e "$dir" ]] || [[ -z "$(ls -A "$dir")" ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Checks whether a mounted directory is empty or not
+# arguments:
+#   $1 - directory
+# returns:
+#   boolean
+#########################
+is_mounted_dir_empty() {
+    local dir="${1:?missing directory}"
+
+    if is_dir_empty "$dir" || find "$dir" -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" -exec false {} +; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Checks whether a file can be written to or not
+# arguments:
+#   $1 - file
+# returns:
+#   boolean
+#########################
+is_file_writable() {
+    local file="${1:?missing file}"
+    local dir
+    dir="$(dirname "$file")"
+
+    if [[ ( -f "$file" && -w "$file" ) || ( ! -f "$file" && -d "$dir" && -w "$dir" ) ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Relativize a path
+# arguments:
+#   $1 - path
+#   $2 - base
+# returns:
+#   None
+#########################
+relativize() {
+    local -r path="${1:?missing path}"
+    local -r base="${2:?missing base}"
+    pushd "$base" >/dev/null
+    realpath -q --no-symlinks --relative-base="$base" "$path" | sed -e 's|^/$|.|' -e 's|^/||'
+    popd >/dev/null
+}
+
+########################
+# Configure permisions and ownership recursively
+# Globals:
+#   None
+# Arguments:
+#   $1 - paths (as a string).
+# Flags:
+#   -f|--file-mode - mode for directories.
+#   -d|--dir-mode - mode for files.
+#   -u|--user - user
+#   -g|--group - group
+# Returns:
+#   None
+#########################
+configure_permissions_ownership() {
+    local -r paths="${1:?paths is missing}"
+    local dir_mode=""
+    local file_mode=""
+    local user=""
+    local group=""
+
+    # Validate arguments
+    shift 1
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -f|--file-mode)
+                shift
+                file_mode="${1:?missing mode for files}"
+                ;;
+            -d|--dir-mode)
+                shift
+                dir_mode="${1:?missing mode for directories}"
+                ;;
+            -u|--user)
+                shift
+                user="${1:?missing user}"
+                ;;
+            -g|--group)
+                shift
+                group="${1:?missing group}"
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    read -r -a filepaths <<< "$paths"
+    for p in "${filepaths[@]}"; do
+        if [[ -e "$p" ]]; then
+            if [[ -n $dir_mode ]]; then
+                find -L "$p" -type d -exec chmod "$dir_mode" {} \;
+            fi
+            if [[ -n $file_mode ]]; then
+                find -L "$p" -type f -exec chmod "$file_mode" {} \;
+            fi
+            if [[ -n $user ]] && [[ -n $group ]]; then
+                chown -LR "$user":"$group" "$p"
+            elif [[ -n $user ]] && [[ -z $group ]]; then
+                chown -LR "$user" "$p"
+            elif [[ -z $user ]] && [[ -n $group ]]; then
+                chgrp -LR "$group" "$p"
+            fi
+        else
+            stderr_print "$p does not exist"
+        fi
+    done
+}

scripts/libhook.sh

+#!/bin/bash
+#
+# Library to use for scripts expected to be used as Kubernetes lifecycle hooks
+
+# shellcheck disable=SC1091
+
+# Load generic libraries
+. /opt/bitnami/scripts/liblog.sh
+. /opt/bitnami/scripts/libos.sh
+
+# Override functions that log to stdout/stderr of the current process, so they print to process 1
+for function_to_override in stderr_print debug_execute; do
+    # Output is sent to output of process 1 and thus end up in the container log
+    # The hook output in general isn't saved
+    eval "$(declare -f "$function_to_override") >/proc/1/fd/1 2>/proc/1/fd/2"
+done

scripts/liblog.sh

+#!/bin/bash
+#
+# Library for logging functions
+
+# Constants
+RESET='\033[0m'
+RED='\033[38;5;1m'
+GREEN='\033[38;5;2m'
+YELLOW='\033[38;5;3m'
+MAGENTA='\033[38;5;5m'
+CYAN='\033[38;5;6m'
+
+# Functions
+
+########################
+# Print to STDERR
+# Arguments:
+#   Message to print
+# Returns:
+#   None
+#########################
+stderr_print() {
+    # 'is_boolean_yes' is defined in libvalidations.sh, but depends on this file so we cannot source it
+    local bool="${BITNAMI_QUIET:-false}"
+    # comparison is performed without regard to the case of alphabetic characters
+    shopt -s nocasematch
+    if ! [[ "$bool" = 1 || "$bool" =~ ^(yes|true)$ ]]; then
+        printf "%b\\n" "${*}" >&2
+    fi
+}
+
+########################
+# Log message
+# Arguments:
+#   Message to log
+# Returns:
+#   None
+#########################
+log() {
+    stderr_print "${CYAN}${MODULE:-} ${MAGENTA}$(date "+%T.%2N ")${RESET}${*}"
+}
+########################
+# Log an 'info' message
+# Arguments:
+#   Message to log
+# Returns:
+#   None
+#########################
+info() {
+    log "${GREEN}INFO ${RESET} ==> ${*}"
+}
+########################
+# Log message
+# Arguments:
+#   Message to log
+# Returns:
+#   None
+#########################
+warn() {
+    log "${YELLOW}WARN ${RESET} ==> ${*}"
+}
+########################
+# Log an 'error' message
+# Arguments:
+#   Message to log
+# Returns:
+#   None
+#########################
+error() {
+    log "${RED}ERROR${RESET} ==> ${*}"
+}
+########################
+# Log a 'debug' message
+# Globals:
+#   BITNAMI_DEBUG
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+debug() {
+    # 'is_boolean_yes' is defined in libvalidations.sh, but depends on this file so we cannot source it
+    local bool="${BITNAMI_DEBUG:-false}"
+    # comparison is performed without regard to the case of alphabetic characters
+    shopt -s nocasematch
+    if [[ "$bool" = 1 || "$bool" =~ ^(yes|true)$ ]]; then
+        log "${MAGENTA}DEBUG${RESET} ==> ${*}"
+    fi
+}
+
+########################
+# Indent a string
+# Arguments:
+#   $1 - string
+#   $2 - number of indentation characters (default: 4)
+#   $3 - indentation character (default: " ")
+# Returns:
+#   None
+#########################
+indent() {
+    local string="${1:-}"
+    local num="${2:?missing num}"
+    local char="${3:-" "}"
+    # Build the indentation unit string
+    local indent_unit=""
+    for ((i = 0; i < num; i++)); do
+        indent_unit="${indent_unit}${char}"
+    done
+    echo "$string" | sed "s/^/${indent_unit}/"
+}

scripts/libnet.sh

+#!/bin/bash
+#
+# Library for network functions
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+
+# Functions
+
+########################
+# Resolve IP address for a host/domain (i.e. DNS lookup)
+# Arguments:
+#   $1 - Hostname to resolve
+#   $2 - IP address version (v4, v6), leave empty for resolving to any version
+# Returns:
+#   IP
+#########################
+dns_lookup() {
+    local host="${1:?host is missing}"
+    local ip_version="${2:-}"
+    getent "ahosts${ip_version}" "$host" | awk '/STREAM/ {print $1 }' | head -n 1
+}
+
+#########################
+# Wait for a hostname and return the IP
+# Arguments:
+#   $1 - hostname
+#   $2 - number of retries
+#   $3 - seconds to wait between retries
+# Returns:
+#   - IP address that corresponds to the hostname
+#########################
+wait_for_dns_lookup() {
+    local hostname="${1:?hostname is missing}"
+    local retries="${2:-5}"
+    local seconds="${3:-1}"
+    check_host() {
+        if [[ $(dns_lookup "$hostname") == "" ]]; then
+            false
+        else
+            true
+        fi
+    }
+    # Wait for the host to be ready
+    retry_while "check_host ${hostname}" "$retries" "$seconds"
+    dns_lookup "$hostname"
+}
+
+########################
+# Get machine's IP
+# Arguments:
+#   None
+# Returns:
+#   Machine IP
+#########################
+get_machine_ip() {
+    local -a ip_addresses
+    local hostname
+    hostname="$(hostname)"
+    read -r -a ip_addresses <<< "$(dns_lookup "$hostname" | xargs echo)"
+    if [[ "${#ip_addresses[@]}" -gt 1 ]]; then
+        warn "Found more than one IP address associated to hostname ${hostname}: ${ip_addresses[*]}, will use ${ip_addresses[0]}"
+    elif [[ "${#ip_addresses[@]}" -lt 1 ]]; then
+        error "Could not find any IP address associated to hostname ${hostname}"
+        exit 1
+    fi
+    echo "${ip_addresses[0]}"
+}
+
+########################
+# Check if the provided argument is a resolved hostname
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_hostname_resolved() {
+    local -r host="${1:?missing value}"
+    if [[ -n "$(dns_lookup "$host")" ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Parse URL
+# Globals:
+#   None
+# Arguments:
+#   $1 - uri - String
+#   $2 - component to obtain. Valid options (scheme, authority, userinfo, host, port, path, query or fragment) - String
+# Returns:
+#   String
+parse_uri() {
+    local uri="${1:?uri is missing}"
+    local component="${2:?component is missing}"
+
+    # Solution based on https://tools.ietf.org/html/rfc3986#appendix-B with
+    # additional sub-expressions to split authority into userinfo, host and port
+    # Credits to Patryk Obara (see https://stackoverflow.com/a/45977232/6694969)
+    local -r URI_REGEX='^(([^:/?#]+):)?(//((([^@/?#]+)@)?([^:/?#]+)(:([0-9]+))?))?(/([^?#]*))?(\?([^#]*))?(#(.*))?'
+    #                    ||            |  |||            |         | |            | |         |  |        | |
+    #                    |2 scheme     |  ||6 userinfo   7 host    | 9 port       | 11 rpath  |  13 query | 15 fragment
+    #                    1 scheme:     |  |5 userinfo@             8 :...         10 path     12 ?...     14 #...
+    #                                  |  4 authority
+    #                                  3 //...
+    local index=0
+    case "$component" in
+        scheme)
+            index=2
+            ;;
+        authority)
+            index=4
+            ;;
+        userinfo)
+            index=6
+            ;;
+        host)
+            index=7
+            ;;
+        port)
+            index=9
+            ;;
+        path)
+            index=10
+            ;;
+        query)
+            index=13
+            ;;
+        fragment)
+            index=14
+            ;;
+        *)
+            stderr_print "unrecognized component $component"
+            return 1
+            ;;
+    esac
+    [[ "$uri" =~ $URI_REGEX ]] && echo "${BASH_REMATCH[${index}]}"
+}

scripts/libos.sh

+#!/bin/bash
+#
+# Library for operating system actions
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+. /opt/bitnami/scripts/libfs.sh
+
+# Functions
+
+########################
+# Check if an user exists in the system
+# Arguments:
+#   $1 - user
+# Returns:
+#   Boolean
+#########################
+user_exists() {
+    local user="${1:?user is missing}"
+    id "$user" >/dev/null 2>&1
+}
+
+########################
+# Check if a group exists in the system
+# Arguments:
+#   $1 - group
+# Returns:
+#   Boolean
+#########################
+group_exists() {
+    local group="${1:?group is missing}"
+    getent group "$group" >/dev/null 2>&1
+}
+
+########################
+# Create a group in the system if it does not exist already
+# Arguments:
+#   $1 - group
+# Flags:
+#   -s|--system - Whether to create new user as system user (uid <= 999)
+# Returns:
+#   None
+#########################
+ensure_group_exists() {
+    local group="${1:?group is missing}"
+    local is_system_user=false
+
+    # Validate arguments
+    shift 1
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -s|--system)
+                is_system_user=true
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    if ! group_exists "$group"; then
+        local -a args=("$group")
+        $is_system_user && args+=("--system")
+        groupadd "${args[@]}" >/dev/null 2>&1
+    fi
+}
+
+########################
+# Create an user in the system if it does not exist already
+# Arguments:
+#   $1 - user
+# Flags:
+#   -g|--group - the group the new user should belong to
+#   -h|--home - the home directory for the new user
+#   -s|--system - whether to create new user as system user (uid <= 999)
+# Returns:
+#   None
+#########################
+ensure_user_exists() {
+    local user="${1:?user is missing}"
+    local group=""
+    local home=""
+    local is_system_user=false
+
+    # Validate arguments
+    shift 1
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -g|--group)
+                shift
+                group="${1:?missing group}"
+                ;;
+            -h|--home)
+                shift
+                home="${1:?missing home directory}"
+                ;;
+            -s|--system)
+                is_system_user=true
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    if ! user_exists "$user"; then
+        local -a user_args=("-N" "$user")
+        $is_system_user && user_args+=("--system")
+        useradd "${user_args[@]}" >/dev/null 2>&1
+    fi
+
+    if [[ -n "$group" ]]; then
+        local -a group_args=("$group")
+        $is_system_user && group_args+=("--system")
+        ensure_group_exists "${group_args[@]}"
+        usermod -g "$group" "$user" >/dev/null 2>&1
+    fi
+
+    if [[ -n "$home" ]]; then
+        mkdir -p "$home"
+        usermod -d "$home" "$user" >/dev/null 2>&1
+        configure_permissions_ownership "$home" -d "775" -f "664" -u "$user" -g "$group"
+    fi
+}
+
+########################
+# Check if the script is currently running as root
+# Arguments:
+#   $1 - user
+#   $2 - group
+# Returns:
+#   Boolean
+#########################
+am_i_root() {
+    if [[ "$(id -u)" = "0" ]]; then
+        true
+    else
+	false
+    fi
+}
+
+########################
+# Get total memory available
+# Arguments:
+#   None
+# Returns:
+#   Memory in bytes
+#########################
+get_total_memory() {
+    echo $(($(grep MemTotal /proc/meminfo | awk '{print $2}') / 1024))
+}
+
+########################
+# Get machine size depending on specified memory
+# Globals:
+#   None
+# Arguments:
+#   None
+# Flags:
+#   --memory - memory size (optional)
+# Returns:
+#   Detected instance size
+#########################
+get_machine_size() {
+    local memory=""
+    # Validate arguments
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            --memory)
+                shift
+                memory="${1:?missing memory}"
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+    if [[ -z "$memory" ]]; then
+        debug "Memory was not specified, detecting available memory automatically"
+        memory="$(get_total_memory)"
+    fi
+    sanitized_memory=$(convert_to_mb "$memory")
+    if [[ "$sanitized_memory" -gt 26000 ]]; then
+        echo 2xlarge
+    elif [[ "$sanitized_memory" -gt 13000 ]]; then
+        echo xlarge
+    elif [[ "$sanitized_memory" -gt 6000 ]]; then
+        echo large
+    elif [[ "$sanitized_memory" -gt 3000 ]]; then
+        echo medium
+    elif [[ "$sanitized_memory" -gt 1500 ]]; then
+        echo small
+    else
+        echo micro
+    fi
+}
+
+########################
+# Get machine size depending on specified memory
+# Globals:
+#   None
+# Arguments:
+#   $1 - memory size (optional)
+# Returns:
+#   Detected instance size
+#########################
+get_supported_machine_sizes() {
+    echo micro small medium large xlarge 2xlarge
+}
+
+########################
+# Convert memory size from string to amount of megabytes (i.e. 2G -> 2048)
+# Globals:
+#   None
+# Arguments:
+#   $1 - memory size
+# Returns:
+#   Result of the conversion
+#########################
+convert_to_mb() {
+    local amount="${1:-}"
+    if [[ $amount =~ ^([0-9]+)(m|M|g|G) ]]; then
+        size="${BASH_REMATCH[1]}"
+        unit="${BASH_REMATCH[2]}"
+        if [[ "$unit" = "g" || "$unit" = "G" ]]; then
+           amount="$((size * 1024))"
+        else
+            amount="$size"
+        fi
+    fi
+    echo "$amount"
+}
+
+
+#########################
+# Redirects output to /dev/null if debug mode is disabled
+# Globals:
+#   BITNAMI_DEBUG
+# Arguments:
+#   $@ - Command to execute
+# Returns:
+#   None
+#########################
+debug_execute() {
+    if ${BITNAMI_DEBUG:-false}; then
+        "$@"
+    else
+        "$@" >/dev/null 2>&1
+    fi
+}
+
+########################
+# Retries a command a given number of times
+# Arguments:
+#   $1 - cmd (as a string)
+#   $2 - max retries. Default: 12
+#   $3 - sleep between retries (in seconds). Default: 5
+# Returns:
+#   Boolean
+#########################
+retry_while() {
+    local cmd="${1:?cmd is missing}"
+    local retries="${2:-12}"
+    local sleep_time="${3:-5}"
+    local return_value=1
+
+    read -r -a command <<< "$cmd"
+    for ((i = 1 ; i <= retries ; i+=1 )); do
+        "${command[@]}" && return_value=0 && break
+        sleep "$sleep_time"
+    done
+    return $return_value
+}
+
+########################
+# Generate a random string
+# Arguments:
+#   -t|--type - String type (ascii, alphanumeric, numeric), defaults to ascii
+#   -c|--count - Number of characters, defaults to 32
+# Arguments:
+#   None
+# Returns:
+#   None
+# Returns:
+#   String
+#########################
+generate_random_string() {
+    local type="ascii"
+    local count="32"
+    local filter
+    local result
+    # Validate arguments
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            -t|--type)
+                shift
+                type="$1"
+                ;;
+            -c|--count)
+                shift
+                count="$1"
+                ;;
+            *)
+                echo "Invalid command line flag $1" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+    # Validate type
+    case "$type" in
+        ascii)
+            filter="[:print:]"
+            ;;
+        alphanumeric)
+            filter="a-zA-Z0-9"
+            ;;
+        numeric)
+            filter="0-9"
+            ;;
+        *)
+        echo "Invalid type ${type}" >&2
+        return 1
+    esac
+    # Obtain count + 10 lines from /dev/urandom to ensure that the resulting string has the expected size
+    # Note there is a very small chance of strings starting with EOL character
+    # Therefore, the higher amount of lines read, this will happen less frequently
+    result="$(head -n "$((count + 10))" /dev/urandom | tr -dc "$filter" | head -c "$count")"
+    echo "$result"
+}
+
+########################
+# Create md5 hash from a string
+# Arguments:
+#   $1 - string
+# Returns:
+#   md5 hash - string
+#########################
+generate_md5_hash() {
+  local -r str="${1:?missing input string}"
+  echo -n "$str" | md5sum | awk '{print $1}'
+}

scripts/libpersistence.sh

+#!/bin/bash
+#
+# Bitnami persistence library
+# Used for bringing persistence capabilities to applications that don't have clear separation of data and logic
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/libfs.sh
+. /opt/bitnami/scripts/libos.sh
+. /opt/bitnami/scripts/liblog.sh
+. /opt/bitnami/scripts/libversion.sh
+
+# Functions
+
+########################
+# Persist an application directory
+# Globals:
+#   BITNAMI_ROOT_DIR
+#   BITNAMI_VOLUME_DIR
+# Arguments:
+#   $1 - App folder name
+#   $2 - List of app files to persist
+# Returns:
+#   true if all steps succeeded, false otherwise
+#########################
+persist_app() {
+    local -r app="${1:?missing app}"
+    local -a files_to_restore
+    read -r -a files_to_persist <<< "$2"
+    local -r install_dir="${BITNAMI_ROOT_DIR}/${app}"
+    local -r persist_dir="${BITNAMI_VOLUME_DIR}/${app}"
+    # Persist the individual files
+    if [[ "${#files_to_persist[@]}" -lt 0 ]]; then
+        warn "No files are configured to be persisted"
+        return
+    fi
+    pushd "$install_dir" >/dev/null
+    local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder
+    local -r tmp_file="/tmp/perms.acl"
+    for file_to_persist in "${files_to_persist[@]}"; do
+        if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then
+            error "Cannot persist '${file_to_persist}' because it does not exist"
+            return 1
+        fi
+        file_to_persist_relative="$(relativize "$file_to_persist" "$install_dir")"
+        file_to_persist_destination="${persist_dir}/${file_to_persist_relative}"
+        file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")"
+        # Get original permissions for existing files, which will be applied later
+        # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume
+        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file"
+        # Copy directories to the volume
+        ensure_dir_exists "$file_to_persist_destination_folder"
+        cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder"
+        # Restore permissions
+        pushd "$persist_dir" >/dev/null
+        if am_i_root; then
+            setfacl --restore="$tmp_file"
+        else
+            # When running as non-root, don't change ownership
+            setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file")
+        fi
+        popd >/dev/null
+    done
+    popd >/dev/null
+    rm -f "$tmp_file"
+    # Install the persisted files into the installation directory, via symlinks
+    restore_persisted_app "$@"
+}
+
+########################
+# Restore a persisted application directory
+# Globals:
+#   BITNAMI_ROOT_DIR
+#   BITNAMI_VOLUME_DIR
+#   FORCE_MAJOR_UPGRADE
+# Arguments:
+#   $1 - App folder name
+#   $2 - List of app files to restore
+# Returns:
+#   true if all steps succeeded, false otherwise
+#########################
+restore_persisted_app() {
+    local -r app="${1:?missing app}"
+    local -a files_to_restore
+    read -r -a files_to_restore <<< "$2"
+    local -r install_dir="${BITNAMI_ROOT_DIR}/${app}"
+    local -r persist_dir="${BITNAMI_VOLUME_DIR}/${app}"
+    # Restore the individual persisted files
+    if [[ "${#files_to_restore[@]}" -lt 0 ]]; then
+        warn "No persisted files are configured to be restored"
+        return
+    fi
+    local file_to_restore_relative file_to_restore_origin file_to_restore_destination
+    for file_to_restore in "${files_to_restore[@]}"; do
+        file_to_restore_relative="$(relativize "$file_to_restore" "$install_dir")"
+        # We use 'realpath --no-symlinks' to ensure that the case of '.' is covered and the directory is removed
+        file_to_restore_origin="$(realpath --no-symlinks "${install_dir}/${file_to_restore_relative}")"
+        file_to_restore_destination="$(realpath --no-symlinks "${persist_dir}/${file_to_restore_relative}")"
+        rm -rf "$file_to_restore_origin"
+        ln -sfn "$file_to_restore_destination" "$file_to_restore_origin"
+    done
+}
+
+########################
+# Check if an application directory was already persisted
+# Globals:
+#   BITNAMI_VOLUME_DIR
+# Arguments:
+#   $1 - App folder name
+# Returns:
+#   true if all steps succeeded, false otherwise
+#########################
+is_app_initialized() {
+    local -r app="${1:?missing app}"
+    local -r persist_dir="${BITNAMI_VOLUME_DIR}/${app}"
+    if ! is_mounted_dir_empty "$persist_dir"; then
+        true
+    else
+        false
+    fi
+}

scripts/libredis.sh

+#!/bin/bash
+#
+# Bitnami Redis library
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/libfile.sh
+. /opt/bitnami/scripts/liblog.sh
+. /opt/bitnami/scripts/libnet.sh
+. /opt/bitnami/scripts/libos.sh
+. /opt/bitnami/scripts/libservice.sh
+. /opt/bitnami/scripts/libvalidations.sh
+
+# Functions
+
+########################
+# Retrieve a configuration setting value
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   $1 - key
+# Returns:
+#   None
+#########################
+redis_conf_get() {
+    local -r key="${1:?missing key}"
+
+    if grep -q -E "^\s*$key " "${REDIS_BASE_DIR}/etc/redis.conf"; then
+        grep -E "^\s*$key " "${REDIS_BASE_DIR}/etc/redis.conf" | awk '{print $2}'
+    fi
+}
+
+########################
+# Set a configuration setting value
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   $1 - key
+#   $2 - value
+# Returns:
+#   None
+#########################
+redis_conf_set() {
+    local -r key="${1:?missing key}"
+    local value="${2:-}"
+
+    # Sanitize inputs
+    value="${value//\\/\\\\}"
+    value="${value//&/\\&}"
+    value="${value//\?/\\?}"
+    [[ "$value" = "" ]] && value="\"$value\""
+
+    replace_in_file "${REDIS_BASE_DIR}/etc/redis.conf" "^#*\s*${key} .*" "${key} ${value}" false
+}
+
+########################
+# Unset a configuration setting value
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   $1 - key
+# Returns:
+#   None
+#########################
+redis_conf_unset() {
+    local -r key="${1:?missing key}"
+    remove_in_file "${REDIS_BASE_DIR}/etc/redis.conf" "^\s*$key .*" false
+}
+
+########################
+# Get Redis version
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   None
+# Returns:
+#   Redis versoon
+#########################
+redis_version() {
+    "${REDIS_BASE_DIR}/bin/redis-cli" --version | grep -E -o "[0-9]+.[0-9]+.[0-9]+"
+}
+
+########################
+# Get Redis major version
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   None
+# Returns:
+#   Redis major version
+#########################
+redis_major_version() {
+    redis_version | grep -E -o "^[0-9]+"
+}
+
+########################
+# Check if redis is running
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   None
+# Returns:
+#   Boolean
+#########################
+is_redis_running() {
+    local pid
+    pid="$(get_pid_from_file "$REDIS_BASE_DIR/tmp/redis.pid")"
+
+    if [[ -z "$pid" ]]; then
+        false
+    else
+        is_service_running "$pid"
+    fi
+}
+
+########################
+# Check if redis is not running
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   None
+# Returns:
+#   Boolean
+#########################
+is_redis_not_running() {
+    ! is_redis_running
+}
+
+########################
+# Stop Redis
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_stop() {
+    local pass
+    local port
+    local args
+
+    ! is_redis_running && return
+    pass="$(redis_conf_get "requirepass")"
+    is_boolean_yes "$REDIS_TLS_ENABLED" && port="$(redis_conf_get "tls-port")" || port="$(redis_conf_get "port")"
+
+    [[ -n "$pass" ]] && args+=("-a" "$pass")
+    [[ "$port" != "0" ]] && args+=("-p" "$port")
+
+    debug "Stopping Redis"
+    if am_i_root; then
+        gosu "$REDIS_DAEMON_USER" "${REDIS_BASE_DIR}/bin/redis-cli" "${args[@]}" shutdown
+    else
+        "${REDIS_BASE_DIR}/bin/redis-cli" "${args[@]}" shutdown
+    fi
+}
+
+########################
+# Validate settings in REDIS_* env vars.
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_validate() {
+    debug "Validating settings in REDIS_* env vars.."
+    local error_code=0
+
+    # Auxiliary functions
+    print_validation_error() {
+        error "$1"
+        error_code=1
+    }
+
+    empty_password_enabled_warn() {
+        warn "You set the environment variable ALLOW_EMPTY_PASSWORD=${ALLOW_EMPTY_PASSWORD}. For safety reasons, do not use this flag in a production environment."
+    }
+    empty_password_error() {
+        print_validation_error "The $1 environment variable is empty or not set. Set the environment variable ALLOW_EMPTY_PASSWORD=yes to allow the container to be started with blank passwords. This is recommended only for development."
+    }
+
+    if is_boolean_yes "$ALLOW_EMPTY_PASSWORD"; then
+        empty_password_enabled_warn
+    else
+        [[ -z "$REDIS_PASSWORD" ]] && empty_password_error REDIS_PASSWORD
+    fi
+    if [[ -n "$REDIS_REPLICATION_MODE" ]]; then
+        if [[ "$REDIS_REPLICATION_MODE" =~ ^(slave|replica)$ ]]; then
+            if [[ -n "$REDIS_MASTER_PORT_NUMBER" ]]; then
+                if ! err=$(validate_port "$REDIS_MASTER_PORT_NUMBER"); then
+                    print_validation_error "An invalid port was specified in the environment variable REDIS_MASTER_PORT_NUMBER: $err"
+                fi
+            fi
+            if ! is_boolean_yes "$ALLOW_EMPTY_PASSWORD" && [[ -z "$REDIS_MASTER_PASSWORD" ]]; then
+                empty_password_error REDIS_MASTER_PASSWORD
+            fi
+        elif [[ "$REDIS_REPLICATION_MODE" != "master" ]]; then
+            print_validation_error "Invalid replication mode. Available options are 'master/replica'"
+        fi
+    fi
+    if is_boolean_yes "$REDIS_TLS_ENABLED"; then
+        if [[ "$REDIS_PORT_NUMBER" == "$REDIS_TLS_PORT" ]] && [[ "$REDIS_PORT_NUMBER" != "6379" ]]; then
+            # If both ports are assigned the same numbers and they are different to the default settings
+            print_validation_error "Environment variables REDIS_PORT_NUMBER and REDIS_TLS_PORT point to the same port number (${REDIS_PORT_NUMBER}). Change one of them or disable non-TLS traffic by setting REDIS_PORT_NUMBER=0"
+        fi
+        if [[ -z "$REDIS_TLS_CERT_FILE" ]]; then
+            print_validation_error "You must provide a X.509 certificate in order to use TLS"
+        elif [[ ! -f "$REDIS_TLS_CERT_FILE" ]]; then
+            print_validation_error "The X.509 certificate file in the specified path ${REDIS_TLS_CERT_FILE} does not exist"
+        fi
+        if [[ -z "$REDIS_TLS_KEY_FILE" ]]; then
+            print_validation_error "You must provide a private key in order to use TLS"
+        elif [[ ! -f "$REDIS_TLS_KEY_FILE" ]]; then
+            print_validation_error "The private key file in the specified path ${REDIS_TLS_KEY_FILE} does not exist"
+        fi
+        if [[ -z "$REDIS_TLS_CA_FILE" ]]; then
+            print_validation_error "You must provide a CA X.509 certificate in order to use TLS"
+        elif [[ ! -f "$REDIS_TLS_CA_FILE" ]]; then
+            print_validation_error "The CA X.509 certificate file in the specified path ${REDIS_TLS_CA_FILE} does not exist"
+        fi
+        if [[ -n "$REDIS_TLS_DH_PARAMS_FILE" ]] && [[ ! -f "$REDIS_TLS_DH_PARAMS_FILE" ]]; then
+            print_validation_error "The DH param file in the specified path ${REDIS_TLS_DH_PARAMS_FILE} does not exist"
+        fi
+    fi
+
+    [[ "$error_code" -eq 0 ]] || exit "$error_code"
+}
+
+########################
+# Configure Redis replication
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   $1 - Replication mode
+# Returns:
+#   None
+#########################
+redis_configure_replication() {
+    info "Configuring replication mode"
+
+    redis_conf_set replica-announce-ip "${REDIS_REPLICA_IP:-$(get_machine_ip)}"
+    redis_conf_set replica-announce-port "${REDIS_REPLICA_PORT:-$REDIS_MASTER_PORT_NUMBER}"
+    # Use TLS in the replication connections
+    if is_boolean_yes "$REDIS_TLS_ENABLED"; then
+        redis_conf_set tls-replication yes
+    fi
+    if [[ "$REDIS_REPLICATION_MODE" = "master" ]]; then
+        if [[ -n "$REDIS_PASSWORD" ]]; then
+            redis_conf_set masterauth "$REDIS_PASSWORD"
+        fi
+    elif [[ "$REDIS_REPLICATION_MODE" =~ ^(slave|replica)$ ]]; then
+        if [[ -n "$REDIS_SENTINEL_HOST" ]]; then
+            local sentinel_info_command
+            if is_boolean_yes "$REDIS_TLS_ENABLED"; then
+                sentinel_info_command="redis-cli -h ${REDIS_SENTINEL_HOST} -p ${REDIS_SENTINEL_PORT_NUMBER} --tls --cert ${REDIS_TLS_CERT_FILE} --key ${REDIS_TLS_KEY_FILE} --cacert ${REDIS_TLS_CA_FILE} sentinel get-master-addr-by-name ${REDIS_SENTINEL_MASTER_NAME}"
+            else
+                sentinel_info_command="redis-cli -h ${REDIS_SENTINEL_HOST} -p ${REDIS_SENTINEL_PORT_NUMBER} sentinel get-master-addr-by-name ${REDIS_SENTINEL_MASTER_NAME}"
+            fi
+            REDIS_SENTINEL_INFO=($($sentinel_info_command))
+            REDIS_MASTER_HOST=${REDIS_SENTINEL_INFO[0]}
+            REDIS_MASTER_PORT_NUMBER=${REDIS_SENTINEL_INFO[1]}
+        fi
+        wait-for-port --host "$REDIS_MASTER_HOST" "$REDIS_MASTER_PORT_NUMBER"
+        [[ -n "$REDIS_MASTER_PASSWORD" ]] && redis_conf_set masterauth "$REDIS_MASTER_PASSWORD"
+        # Starting with Redis 5, use 'replicaof' instead of 'slaveof'. Maintaining both for backward compatibility
+        local parameter="replicaof"
+        [[ $(redis_major_version) -lt 5 ]] && parameter="slaveof"
+        redis_conf_set "$parameter" "$REDIS_MASTER_HOST $REDIS_MASTER_PORT_NUMBER"
+    fi
+}
+
+########################
+# Disable Redis command(s)
+# Globals:
+#   REDIS_BASE_DIR
+# Arguments:
+#   $1 - Array of commands to disable
+# Returns:
+#   None
+#########################
+redis_disable_unsafe_commands() {
+    # The current syntax gets a comma separated list of commands, we split them
+    # before passing to redis_disable_unsafe_commands
+    read -r -a disabledCommands <<< "$(tr ',' ' ' <<< "$REDIS_DISABLE_COMMANDS")"
+    debug "Disabling commands: ${disabledCommands[*]}"
+    for cmd in "${disabledCommands[@]}"; do
+        if grep -E -q "^\s*rename-command\s+$cmd\s+\"\"\s*$" "$REDIS_CONF_FILE"; then
+            debug "$cmd was already disabled"
+            continue
+        fi
+        echo "rename-command $cmd \"\"" >> "$REDIS_CONF_FILE"
+    done
+}
+
+########################
+# Redis configure perissions
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_configure_permissions() {
+  debug "Ensuring expected directories/files exist"
+  for dir in "${REDIS_BASE_DIR}" "${REDIS_DATA_DIR}" "${REDIS_BASE_DIR}/tmp" "${REDIS_LOG_DIR}"; do
+      ensure_dir_exists "$dir"
+      if am_i_root; then
+          chown "$REDIS_DAEMON_USER:$REDIS_DAEMON_GROUP" "$dir"
+      fi
+  done
+}
+
+########################
+# Redis specific configuration to override the default one
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_override_conf() {
+  if [[ ! -e "${REDIS_MOUNTED_CONF_DIR}/redis.conf" ]]; then
+      # Configure Replication mode
+      if [[ -n "$REDIS_REPLICATION_MODE" ]]; then
+          redis_configure_replication
+      fi
+  fi
+}
+
+########################
+# Ensure Redis is initialized
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_initialize() {
+  redis_configure_default
+  redis_override_conf
+}
+
+########################
+# Configures Redis permissions and general parameters (also used in redis-cluster container)
+# Globals:
+#   REDIS_*
+# Arguments:
+#   None
+# Returns:
+#   None
+#########################
+redis_configure_default() {
+    info "Initializing Redis"
+
+    # This fixes an issue where the trap would kill the entrypoint.sh, if a PID was left over from a previous run
+    # Exec replaces the process without creating a new one, and when the container is restarted it may have the same PID
+    rm -f "$REDIS_BASE_DIR/tmp/redis.pid"
+
+    redis_configure_permissions
+
+    # User injected custom configuration
+    if [[ -e "${REDIS_MOUNTED_CONF_DIR}/redis.conf" ]]; then
+        if [[ -e "$REDIS_BASE_DIR/etc/redis-default.conf" ]]; then
+            rm "${REDIS_BASE_DIR}/etc/redis-default.conf"
+        fi
+        cp "${REDIS_MOUNTED_CONF_DIR}/redis.conf" "${REDIS_BASE_DIR}/etc/redis.conf"
+    else
+        info "Setting Redis config file"
+        is_boolean_yes "$REDIS_ALLOW_REMOTE_CONNECTIONS" && redis_conf_set bind 0.0.0.0 # Allow remote connections
+        # Enable AOF https://redis.io/topics/persistence#append-only-file
+        # Leave default fsync (every second)
+        redis_conf_set appendonly "${REDIS_AOF_ENABLED}"
+        redis_conf_set port "$REDIS_PORT_NUMBER"
+        # TLS configuration
+        if is_boolean_yes "$REDIS_TLS_ENABLED"; then
+            if [[ "$REDIS_PORT_NUMBER" ==  "6379" ]] && [[ "$REDIS_TLS_PORT" ==  "6379" ]]; then
+                # If both ports are set to default values, enable TLS traffic only
+                redis_conf_set port 0
+                redis_conf_set tls-port "$REDIS_TLS_PORT"
+            else
+                # Different ports were specified
+                redis_conf_set tls-port "$REDIS_TLS_PORT"
+            fi
+            redis_conf_set tls-cert-file "$REDIS_TLS_CERT_FILE"
+            redis_conf_set tls-key-file "$REDIS_TLS_KEY_FILE"
+            redis_conf_set tls-ca-cert-file "$REDIS_TLS_CA_FILE"
+            [[ -n "$REDIS_TLS_DH_PARAMS_FILE" ]] && redis_conf_set tls-dh-params-file "$REDIS_TLS_DH_PARAMS_FILE"
+            redis_conf_set tls-auth-clients "$REDIS_TLS_AUTH_CLIENTS"
+        fi
+        if [[ -n "$REDIS_PASSWORD" ]]; then
+            redis_conf_set requirepass "$REDIS_PASSWORD"
+        else
+            redis_conf_unset requirepass
+        fi
+        if [[ -n "$REDIS_DISABLE_COMMANDS" ]]; then
+            redis_disable_unsafe_commands
+        fi
+    fi
+}

scripts/libservice.sh

+#!/bin/bash
+#
+# Library for managing services
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/libvalidations.sh
+. /opt/bitnami/scripts/liblog.sh
+
+# Functions
+
+########################
+# Read the provided pid file and returns a PID
+# Arguments:
+#   $1 - Pid file
+# Returns:
+#   PID
+#########################
+get_pid_from_file() {
+    local pid_file="${1:?pid file is missing}"
+
+    if [[ -f "$pid_file" ]]; then
+        if [[ -n "$(< "$pid_file")" ]] && [[ "$(< "$pid_file")" -gt 0 ]]; then
+            echo "$(< "$pid_file")"
+        fi
+    fi
+}
+
+########################
+# Check if a provided PID corresponds to a running service
+# Arguments:
+#   $1 - PID
+# Returns:
+#   Boolean
+#########################
+is_service_running() {
+    local pid="${1:?pid is missing}"
+
+    kill -0 "$pid" 2>/dev/null
+}
+
+########################
+# Stop a service by sending a termination signal to its pid
+# Arguments:
+#   $1 - Pid file
+#   $2 - Signal number (optional)
+# Returns:
+#   None
+#########################
+stop_service_using_pid() {
+    local pid_file="${1:?pid file is missing}"
+    local signal="${2:-}"
+    local pid
+
+    pid="$(get_pid_from_file "$pid_file")"
+    [[ -z "$pid" ]] || ! is_service_running "$pid" && return
+
+    if [[ -n "$signal" ]]; then
+        kill "-${signal}" "$pid"
+    else
+        kill "$pid"
+    fi
+
+    local counter=10
+    while [[ "$counter" -ne 0 ]] && is_service_running "$pid"; do
+        sleep 1
+        counter=$((counter - 1))
+    done
+}
+
+########################
+# Start cron daemon
+# Arguments:
+#   None
+# Returns:
+#   true if started correctly, false otherwise
+#########################
+cron_start() {
+    if [[ -x "/usr/sbin/cron" ]]; then
+        /usr/sbin/cron
+    elif [[ -x "/usr/sbin/crond" ]]; then
+        /usr/sbin/crond
+    else
+        false
+    fi
+}
+
+########################
+# Generate a cron configuration file for a given service
+# Arguments:
+#   $1 - Service name
+#   $2 - Command
+# Flags:
+#   --run-as - User to run as (default: root)
+#   --schedule - Cron schedule configuration (default: * * * * *)
+# Returns:
+#   None
+#########################
+generate_cron_conf() {
+    local service_name="${1:?service name is missing}"
+    local cmd="${2:?command is missing}"
+    local run_as="root"
+    local schedule="* * * * *"
+
+    # Parse optional CLI flags
+    shift 2
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            --run-as)
+                shift
+                run_as="$1"
+                ;;
+            --schedule)
+                shift
+                schedule="$1"
+                ;;
+            *)
+                echo "Invalid command line flag ${1}" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    mkdir -p /etc/cron.d
+    echo "${schedule} ${run_as} ${cmd}" > /etc/cron.d/"$service_name"
+}
+
+########################
+# Generate a monit configuration file for a given service
+# Arguments:
+#   $1 - Service name
+#   $2 - Pid file
+#   $3 - Start command
+#   $4 - Stop command
+# Flags:
+#   --disabled - Whether to disable the monit configuration
+# Returns:
+#   None
+#########################
+generate_monit_conf() {
+    local service_name="${1:?service name is missing}"
+    local pid_file="${2:?pid file is missing}"
+    local start_command="${3:?start command is missing}"
+    local stop_command="${4:?stop command is missing}"
+    local monit_conf_dir="/etc/monit/conf.d"
+    local disabled="no"
+
+    # Parse optional CLI flags
+    shift 4
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            --disabled)
+                shift
+                disabled="$1"
+                ;;
+            *)
+                echo "Invalid command line flag ${1}" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    is_boolean_yes "$disabled" && conf_suffix=".disabled"
+    mkdir -p "$monit_conf_dir"
+    cat >"${monit_conf_dir}/${service_name}.conf${conf_suffix:-}" <<EOF
+check process ${service_name}
+  with pidfile "${pid_file}"
+  start program = "${start_command}" with timeout 90 seconds
+  stop program = "${stop_command}" with timeout 90 seconds
+EOF
+}
+
+########################
+# Generate a logrotate configuration file
+# Arguments:
+#   $1 - Service name
+#   $2 - Log files pattern
+# Flags:
+#   --period - Period
+#   --rotations - Number of rotations to store
+#   --extra - Extra options (Optional)
+# Returns:
+#   None
+#########################
+generate_logrotate_conf() {
+    local service_name="${1:?service name is missing}"
+    local log_path="${2:?log path is missing}"
+    local period="weekly"
+    local rotations="150"
+    local extra=""
+    local logrotate_conf_dir="/etc/logrotate.d"
+    local var_name
+    # Parse optional CLI flags
+    shift 2
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            --period|--rotations|--extra)
+                var_name="$(echo "$1" | sed -e "s/^--//" -e "s/-/_/g")"
+                shift
+                declare "$var_name"="${1:?"$var_name" is missing}"
+                ;;
+            *)
+                echo "Invalid command line flag ${1}" >&2
+                return 1
+                ;;
+        esac
+        shift
+    done
+
+    mkdir -p "$logrotate_conf_dir"
+    cat <<EOF | sed '/^\s*$/d' >"${logrotate_conf_dir}/${service_name}"
+${log_path} {
+  ${period}
+  rotate ${rotations}
+  dateext
+  compress
+  copytruncate
+  missingok
+$(indent "$extra" 2)
+}
+EOF
+}

scripts/libvalidations.sh

+#!/bin/bash
+#
+# Validation functions library
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+
+# Functions
+
+########################
+# Check if the provided argument is an integer
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_int() {
+    local -r int="${1:?missing value}"
+    if [[ "$int" =~ ^-?[0-9]+ ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Check if the provided argument is a positive integer
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_positive_int() {
+    local -r int="${1:?missing value}"
+    if is_int "$int" && (( "${int}" >= 0 )); then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Check if the provided argument is a boolean or is the string 'yes/true'
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_boolean_yes() {
+    local -r bool="${1:-}"
+    # comparison is performed without regard to the case of alphabetic characters
+    shopt -s nocasematch
+    if [[ "$bool" = 1 || "$bool" =~ ^(yes|true)$ ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Check if the provided argument is a boolean yes/no value
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_yes_no_value() {
+    local -r bool="${1:-}"
+    if [[ "$bool" =~ ^(yes|no)$ ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Check if the provided argument is a boolean true/false value
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_true_false_value() {
+    local -r bool="${1:-}"
+    if [[ "$bool" =~ ^(true|false)$ ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Check if the provided argument is an empty string or not defined
+# Arguments:
+#   $1 - Value to check
+# Returns:
+#   Boolean
+#########################
+is_empty_value() {
+    local -r val="${1:-}"
+    if [[ -z "$val" ]]; then
+        true
+    else
+        false
+    fi
+}
+
+########################
+# Validate if the provided argument is a valid port
+# Arguments:
+#   $1 - Port to validate
+# Returns:
+#   Boolean and error message
+#########################
+validate_port() {
+    local value
+    local unprivileged=0
+
+    # Parse flags
+    while [[ "$#" -gt 0 ]]; do
+        case "$1" in
+            -unprivileged)
+                unprivileged=1
+                ;;
+            --)
+                shift
+                break
+                ;;
+            -*)
+                stderr_print "unrecognized flag $1"
+                return 1
+                ;;
+            *)
+                break
+                ;;
+        esac
+        shift
+    done
+
+    if [[ "$#" -gt 1 ]]; then
+        echo "too many arguments provided"
+        return 2
+    elif [[ "$#" -eq 0 ]]; then
+        stderr_print "missing port argument"
+        return 1
+    else
+        value=$1
+    fi
+
+    if [[ -z "$value" ]]; then
+        echo "the value is empty"
+        return 1
+    else
+        if ! is_int "$value"; then
+            echo "value is not an integer"
+            return 2
+        elif [[ "$value" -lt 0 ]]; then
+            echo "negative value provided"
+            return 2
+        elif [[ "$value" -gt 65535 ]]; then
+            echo "requested port is greater than 65535"
+            return 2
+        elif [[ "$unprivileged" = 1 && "$value" -lt 1024 ]]; then
+            echo "privileged port requested"
+            return 3
+        fi
+    fi
+}
+
+########################
+# Validate if the provided argument is a valid IPv4 address
+# Arguments:
+#   $1 - IP to validate
+# Returns:
+#   Boolean
+#########################
+validate_ipv4() {
+    local ip="${1:?ip is missing}"
+    local stat=1
+
+    if [[ $ip =~ ^[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}$ ]]; then
+	read -r -a ip_array <<< "$(tr '.' ' ' <<< "$ip")"
+        [[ ${ip_array[0]} -le 255 && ${ip_array[1]} -le 255 \
+            && ${ip_array[2]} -le 255 && ${ip_array[3]} -le 255 ]]
+        stat=$?
+    fi
+    return $stat
+}
+
+########################
+# Validate a string format
+# Arguments:
+#   $1 - String to validate
+# Returns:
+#   Boolean
+#########################
+validate_string() {
+    local string
+    local min_length=-1
+    local max_length=-1
+
+    # Parse flags
+    while [ "$#" -gt 0 ]; do
+        case "$1" in
+            -min-length)
+                shift
+                min_length=${1:-}
+                ;;
+            -max-length)
+                shift
+                max_length=${1:-}
+                ;;
+            --)
+                shift
+                break
+                ;;
+            -*)
+                stderr_print "unrecognized flag $1"
+                return 1
+                ;;
+            *)
+                break
+                ;;
+        esac
+        shift
+    done
+
+    if [ "$#" -gt 1 ]; then
+        stderr_print "too many arguments provided"
+        return 2
+    elif [ "$#" -eq 0 ]; then
+        stderr_print "missing string"
+        return 1
+    else
+        string=$1
+    fi
+
+    if [[ "$min_length" -ge 0 ]] && [[ "${#string}" -lt "$min_length" ]]; then
+        echo "string length is less than $min_length"
+        return 1
+    fi
+    if [[ "$max_length" -ge 0 ]] && [[ "${#string}" -gt "$max_length" ]]; then
+        echo "string length is great than $max_length"
+        return 1
+    fi
+}

scripts/libversion.sh

+#!/bin/bash
+#
+# Library for managing versions strings
+
+# shellcheck disable=SC1091
+
+# Load Generic Libraries
+. /opt/bitnami/scripts/liblog.sh
+
+# Functions
+########################
+# Gets semantic version 
+# Arguments:
+#   $1 - version: string to extract major.minor.patch
+#   $2 - section: 1 to extract major, 2 to extract minor, 3 to extract patch
+# Returns:
+#   array with the major, minor and release
+#########################
+get_sematic_version () {
+    local version="${1:?version is required}"
+    local section="${2:?section is required}"
+    local -a version_sections
+
+    #Regex to parse versions: x.y.z
+    local -r regex='([0-9]+)(\.([0-9]+)(\.([0-9]+))?)?'
+
+    if [[ "$version" =~ $regex ]]; then
+        local i=1
+        local j=1
+        local n=${#BASH_REMATCH[*]}
+
+        while [[ $i -lt $n ]]; do
+            if [[ -n "${BASH_REMATCH[$i]}" ]] && [[ "${BASH_REMATCH[$i]:0:1}" != '.' ]];  then
+                version_sections[$j]=${BASH_REMATCH[$i]}
+                ((j++))
+            fi
+            ((i++))
+        done
+
+        local number_regex='^[0-9]+$'
+        if [[ "$section" =~ $number_regex ]] && (( $section > 0 )) && (( $section <= 3 )); then
+             echo "${version_sections[$section]}"
+             return
+        else
+            stderr_print "Section allowed values are: 1, 2, and 3"
+            return 1
+        fi
+    fi
+}