diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000..f1fb01e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+**/Dockerfile            linguist-generated
+**/docker-entrypoint.sh  linguist-generated
+Dockerfile.template      linguist-language=Dockerfile
diff --git a/.github/workflows/verify-templating.yml b/.github/workflows/verify-templating.yml
new file mode 100644
index 0000000..7e833f1
--- /dev/null
+++ b/.github/workflows/verify-templating.yml
@@ -0,0 +1,22 @@
+name: Verify Templating
+
+on:
+  pull_request:
+  push:
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+jobs:
+  apply-templates:
+    name: Check For Uncomitted Changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Apply Templates
+        run: ./apply-templates.sh
+      - name: Check Git Status
+        run: |
+          status="$(git status --short)"
+          [ -z "$status" ]
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000..d548f66
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.jq-template.awk
diff --git a/3.0/Dockerfile b/3.0/Dockerfile
index d3abade..edb6f0b 100644
--- a/3.0/Dockerfile
+++ b/3.0/Dockerfile
@@ -1,12 +1,16 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 3.0
-ENV _BASH_PATCH_LEVEL 16
-# https://ftp.gnu.org/gnu/bash/bash-3.1-patches/?C=M;O=D
+ENV _BASH_VERSION 3.0.22
+ENV _BASH_BASELINE 3.0.16
+ENV _BASH_BASELINE_PATCH 16
+# https://ftp.gnu.org/gnu/bash/bash-3.0-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 22
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
 
@@ -17,36 +21,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +56,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +70,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +80,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -103,8 +108,11 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
+		/usr/local/share/info \
 		/usr/local/share/locale \
+		/usr/local/share/man \
 	; \
 	\
 	runDeps="$( \
@@ -113,13 +121,14 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
 # for some reason, 3.0.xx manifests as 3.00.xx (hence the extra "0" added in the following check)
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION}0.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION//.0./.00.}" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/3.1/Dockerfile b/3.1/Dockerfile
index 54ad010..d553181 100644
--- a/3.1/Dockerfile
+++ b/3.1/Dockerfile
@@ -1,11 +1,14 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 3.1
-ENV _BASH_PATCH_LEVEL 0
+ENV _BASH_VERSION 3.1.23
+ENV _BASH_BASELINE 3.1
 # https://ftp.gnu.org/gnu/bash/bash-3.1-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 23
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,36 +20,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +55,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +69,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +79,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -103,8 +107,11 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
+		/usr/local/share/info \
 		/usr/local/share/locale \
+		/usr/local/share/man \
 	; \
 	\
 	runDeps="$( \
@@ -113,12 +120,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/3.2/Dockerfile b/3.2/Dockerfile
index bf257bd..6c35c34 100644
--- a/3.2/Dockerfile
+++ b/3.2/Dockerfile
@@ -1,11 +1,15 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 3.2
-ENV _BASH_PATCH_LEVEL 57
+ENV _BASH_VERSION 3.2.57
+ENV _BASH_BASELINE 3.2.57
+ENV _BASH_BASELINE_PATCH 57
 # https://ftp.gnu.org/gnu/bash/bash-3.2-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 57
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,36 +21,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +56,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +70,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +80,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -103,8 +108,11 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
+		/usr/local/share/info \
 		/usr/local/share/locale \
+		/usr/local/share/man \
 	; \
 	\
 	runDeps="$( \
@@ -113,12 +121,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/4.0/Dockerfile b/4.0/Dockerfile
index bdbc703..8c96fd9 100644
--- a/4.0/Dockerfile
+++ b/4.0/Dockerfile
@@ -1,11 +1,14 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 4.0
-ENV _BASH_PATCH_LEVEL 0
+ENV _BASH_VERSION 4.0.44
+ENV _BASH_BASELINE 4.0
 # https://ftp.gnu.org/gnu/bash/bash-4.0-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 44
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -13,41 +16,37 @@ ENV _BASH_LATEST_PATCH 44
 RUN set -eux; \
 	\
 	apk add --no-cache --virtual .build-deps \
-		autoconf \
 		bison \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -56,7 +55,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -68,6 +69,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -77,6 +79,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -96,6 +99,9 @@ RUN set -eux; \
 		cat >&2 config.log; \
 		false; \
 	}; \
+# in https://ftp.gnu.org/gnu/bash/bash-4.0-patches/bash40-037, "configure.in" is patched, resulting in https://git.savannah.gnu.org/cgit/bash.git/tree/Makefile.in?h=bash-4.0#n705 trying to rebuild "configure" via "autoconf"
+# however, bash40-037 is only relevant on Darwin / OS X, so we can safely use "touch configure" to fool "make" into thinking "configure" is up-to-date instead
+	touch configure; \
 # parallel jobs workaround borrowed from Alpine :)
 	make y.tab.c; make builtins/libbuiltins.a; \
 	make -j "$(nproc)"; \
@@ -104,7 +110,8 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
 		/usr/local/share/man \
@@ -116,12 +123,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/4.1/Dockerfile b/4.1/Dockerfile
index f8d5c34..652d389 100644
--- a/4.1/Dockerfile
+++ b/4.1/Dockerfile
@@ -1,11 +1,14 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 4.1
-ENV _BASH_PATCH_LEVEL 0
+ENV _BASH_VERSION 4.1.17
+ENV _BASH_BASELINE 4.1
 # https://ftp.gnu.org/gnu/bash/bash-4.1-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 17
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,36 +20,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +55,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +69,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +79,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -101,7 +105,8 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
 		/usr/local/share/man \
@@ -113,12 +118,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/4.2/Dockerfile b/4.2/Dockerfile
index 56bfde9..c2075c2 100644
--- a/4.2/Dockerfile
+++ b/4.2/Dockerfile
@@ -1,11 +1,15 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 4.2
-ENV _BASH_PATCH_LEVEL 53
+ENV _BASH_VERSION 4.2.53
+ENV _BASH_BASELINE 4.2.53
+ENV _BASH_BASELINE_PATCH 53
 # https://ftp.gnu.org/gnu/bash/bash-4.2-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 53
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,36 +21,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +56,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +70,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +80,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -101,7 +106,8 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
 		/usr/local/share/man \
@@ -113,12 +119,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/4.3/Dockerfile b/4.3/Dockerfile
index d63dfba..a686722 100644
--- a/4.3/Dockerfile
+++ b/4.3/Dockerfile
@@ -1,11 +1,15 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 4.3
-ENV _BASH_PATCH_LEVEL 30
+ENV _BASH_VERSION 4.3.48
+ENV _BASH_BASELINE 4.3.30
+ENV _BASH_BASELINE_PATCH 30
 # https://ftp.gnu.org/gnu/bash/bash-4.3-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 48
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,37 +21,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gettext-dev \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -56,7 +56,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -68,6 +70,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -77,6 +80,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -102,7 +106,7 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
 		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
@@ -115,12 +119,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/4.4/Dockerfile b/4.4/Dockerfile
index 263ee18..2bcc486 100644
--- a/4.4/Dockerfile
+++ b/4.4/Dockerfile
@@ -1,11 +1,15 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 4.4
-ENV _BASH_PATCH_LEVEL 18
+ENV _BASH_VERSION 4.4.23
+ENV _BASH_BASELINE 4.4.18
+ENV _BASH_BASELINE_PATCH 18
 # https://ftp.gnu.org/gnu/bash/bash-4.4-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 23
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,37 +21,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gettext-dev \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -56,7 +56,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -68,6 +70,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -77,6 +80,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -102,7 +106,7 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
 		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
@@ -115,12 +119,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/5.0/Dockerfile b/5.0/Dockerfile
index da34405..f607bcc 100644
--- a/5.0/Dockerfile
+++ b/5.0/Dockerfile
@@ -1,11 +1,14 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
-ENV _BASH_VERSION 5.0
-ENV _BASH_PATCH_LEVEL 0
+ENV _BASH_VERSION 5.0.18
+ENV _BASH_BASELINE 5.0
 # https://ftp.gnu.org/gnu/bash/bash-5.0-patches/?C=M;O=D
 ENV _BASH_LATEST_PATCH 18
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
@@ -17,36 +20,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +55,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +69,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +79,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -97,7 +101,7 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
 		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
 		/usr/local/share/locale \
@@ -110,12 +114,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/5.1-rc/Dockerfile b/5.1-rc/Dockerfile
index 17e9d7c..c1325fc 100644
--- a/5.1-rc/Dockerfile
+++ b/5.1-rc/Dockerfile
@@ -1,13 +1,14 @@
-FROM alpine:3.12
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
 
-# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
-ENV _BASH_GPG_KEY 7C0135FB088AAF6C66C650B9BB5869F064EA74AB
+FROM alpine:3.12
 
 # https://ftp.gnu.org/gnu/bash/?C=M;O=D
 ENV _BASH_VERSION 5.1-beta
-ENV _BASH_PATCH_LEVEL 0
-# https://ftp.gnu.org/gnu/bash/bash-5.0-patches/?C=M;O=D
-ENV _BASH_LATEST_PATCH 0
+ENV _BASH_BASELINE 5.1-beta
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
 
 RUN set -eux; \
@@ -17,36 +18,33 @@ RUN set -eux; \
 		coreutils \
 		dpkg-dev dpkg \
 		gcc \
-		gnupg \
 		libc-dev \
 		make \
 		ncurses-dev \
-		patch \
 		tar \
 	; \
 	\
-	version="$_BASH_VERSION"; \
-	if [ "$_BASH_PATCH_LEVEL" -gt 0 ]; then \
-		version="$version.$_BASH_PATCH_LEVEL"; \
-	fi; \
-	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz"; \
-	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$version.tar.gz.sig"; \
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
 	\
-	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_PATCH_LEVEL" ]; then \
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
 		mkdir -p bash-patches; \
-		first="$(printf '%03d' "$(( _BASH_PATCH_LEVEL + 1 ))")"; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
 		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
 		for patch in $(seq -w "$first" "$last"); do \
-			url="https://ftp.gnu.org/gnu/bash/bash-$_BASH_VERSION-patches/bash${_BASH_VERSION//./}-$patch"; \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
 			wget -O "bash-patches/$patch" "$url"; \
 			wget -O "bash-patches/$patch.sig" "$url.sig"; \
 		done; \
 	fi; \
 	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$_BASH_GPG_KEY"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
 	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
-	gpgconf --kill all; \
 	rm bash.tar.gz.sig; \
 	if [ -d bash-patches ]; then \
 		for sig in bash-patches/*.sig; do \
@@ -55,7 +53,9 @@ RUN set -eux; \
 			rm "$sig"; \
 		done; \
 	fi; \
+	gpgconf --kill all; \
 	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
 	\
 	mkdir -p /usr/src/bash; \
 	tar \
@@ -67,6 +67,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -76,6 +77,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -97,10 +99,10 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
 		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
-#		/usr/local/share/locale \
+		/usr/local/share/locale \
 		/usr/local/share/man \
 	; \
 	\
@@ -110,12 +112,13 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
 	bash --version; \
-	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.$_BASH_LATEST_PATCH" ];
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.0" ]; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/Dockerfile.template b/Dockerfile.template
new file mode 100644
index 0000000..842f3bc
--- /dev/null
+++ b/Dockerfile.template
@@ -0,0 +1,158 @@
+FROM alpine:3.12
+
+{{ if env.version == "devel" then ( -}}
+# https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel
+ENV _BASH_COMMIT {{ .commit.version }}
+ENV _BASH_VERSION devel-{{ .version }}
+{{ ) else ( -}}
+# https://ftp.gnu.org/gnu/bash/?C=M;O=D
+ENV _BASH_VERSION {{ .version }}
+ENV _BASH_BASELINE {{ .baseline.version // .version }}
+{{ if .baseline.patch then ( -}}
+ENV _BASH_BASELINE_PATCH {{ .baseline.patch }}
+{{ ) else "" end -}}
+{{ if .patch.version then ( -}}
+# https://ftp.gnu.org/gnu/bash/bash-{{ env.version | rtrimstr("-rc") }}-patches/?C=M;O=D
+ENV _BASH_LATEST_PATCH {{ .patch.version }}
+{{ ) else "" end -}}
+{{ ) end -}}
+# prefixed with "_" since "$BASH..." have meaning in Bash parlance
+
+RUN set -eux; \
+	\
+	apk add --no-cache --virtual .build-deps \
+		bison \
+		coreutils \
+		dpkg-dev dpkg \
+		gcc \
+		libc-dev \
+		make \
+		ncurses-dev \
+		tar \
+	; \
+	\
+{{ if env.version == "devel" then ( -}}
+	wget -O bash.tar.gz "https://git.savannah.gnu.org/cgit/bash.git/snapshot/bash-$_BASH_COMMIT.tar.gz"; \
+{{ ) else ( -}}
+	wget -O bash.tar.gz "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz"; \
+	wget -O bash.tar.gz.sig "https://ftp.gnu.org/gnu/bash/bash-$_BASH_BASELINE.tar.gz.sig"; \
+	\
+	: "${_BASH_BASELINE_PATCH:=0}" "${_BASH_LATEST_PATCH:=0}"; \
+	if [ "$_BASH_LATEST_PATCH" -gt "$_BASH_BASELINE_PATCH" ]; then \
+		mkdir -p bash-patches; \
+		first="$(printf '%03d' "$(( _BASH_BASELINE_PATCH + 1 ))")"; \
+		last="$(printf '%03d' "$_BASH_LATEST_PATCH")"; \
+		majorMinor="${_BASH_VERSION%.*}"; \
+		for patch in $(seq -w "$first" "$last"); do \
+			url="https://ftp.gnu.org/gnu/bash/bash-$majorMinor-patches/bash${majorMinor//./}-$patch"; \
+			wget -O "bash-patches/$patch" "$url"; \
+			wget -O "bash-patches/$patch.sig" "$url.sig"; \
+		done; \
+	fi; \
+	\
+	apk add --no-cache --virtual .gpg-deps gnupg; \
+	export GNUPGHOME="$(mktemp -d)"; \
+# gpg: key 64EA74AB: public key "Chet Ramey <chet@cwru.edu>" imported
+	gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys 7C0135FB088AAF6C66C650B9BB5869F064EA74AB; \
+	gpg --batch --verify bash.tar.gz.sig bash.tar.gz; \
+	rm bash.tar.gz.sig; \
+	if [ -d bash-patches ]; then \
+		for sig in bash-patches/*.sig; do \
+			p="${sig%.sig}"; \
+			gpg --batch --verify "$sig" "$p"; \
+			rm "$sig"; \
+		done; \
+	fi; \
+	gpgconf --kill all; \
+	rm -rf "$GNUPGHOME"; \
+	apk del --no-network .gpg-deps; \
+{{ ) end -}}
+	\
+	mkdir -p /usr/src/bash; \
+	tar \
+		--extract \
+		--file=bash.tar.gz \
+		--strip-components=1 \
+		--directory=/usr/src/bash \
+	; \
+	rm bash.tar.gz; \
+	\
+	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
+		for p in bash-patches/*; do \
+			patch \
+				--directory=/usr/src/bash \
+				--input="$(readlink -f "$p")" \
+				--strip=0 \
+			; \
+			rm "$p"; \
+		done; \
+		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
+	fi; \
+	\
+	cd /usr/src/bash; \
+	gnuArch="$(dpkg-architecture --query DEB_BUILD_GNU_TYPE)"; \
+{{ if env.version == "devel" or (env.version | split(".") | .[0] | tonumber) >= 5 then "" else ( -}}
+# update "config.guess" and "config.sub" to get more aggressively inclusive architecture support
+	for f in config.guess config.sub; do \
+		wget -O "support/$f" "https://git.savannah.gnu.org/cgit/config.git/plain/$f?id=7d3d27baf8107b630586c962c057e22149653deb"; \
+	done; \
+{{ ) end -}}
+	./configure \
+		--build="$gnuArch" \
+		--enable-readline \
+		--with-curses \
+# musl does not implement brk/sbrk (they simply return -ENOMEM)
+#   bash: xmalloc: locale.c:81: cannot allocate 18 bytes (0 bytes allocated)
+		--without-bash-malloc \
+	|| { \
+		cat >&2 config.log; \
+		false; \
+	}; \
+{{ if env.version == "4.0" then ( -}}
+# in https://ftp.gnu.org/gnu/bash/bash-4.0-patches/bash40-037, "configure.in" is patched, resulting in https://git.savannah.gnu.org/cgit/bash.git/tree/Makefile.in?h=bash-4.0#n705 trying to rebuild "configure" via "autoconf"
+# however, bash40-037 is only relevant on Darwin / OS X, so we can safely use "touch configure" to fool "make" into thinking "configure" is up-to-date instead
+	touch configure; \
+{{ ) else "" end -}}
+{{ if env.version == "devel" or (env.version | rtrimstr("-rc") | tonumber) >= 4.1 then "" else ( -}}
+# parallel jobs workaround borrowed from Alpine :)
+	make y.tab.c; make builtins/libbuiltins.a; \
+{{ ) end -}}
+	make -j "$(nproc)"; \
+	make install; \
+	cd /; \
+	rm -r /usr/src/bash; \
+	\
+# delete a few installed bits for smaller image size
+	rm -rf \
+		/usr/local/share/doc/bash/*.html \
+		/usr/local/share/info \
+		/usr/local/share/locale \
+		/usr/local/share/man \
+	; \
+	\
+	runDeps="$( \
+		scanelf --needed --nobanner --format '%n#p' --recursive /usr/local \
+			| tr ',' '\n' \
+			| sort -u \
+			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
+	)"; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
+	\
+	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
+	bash --version; \
+{{ if env.version == "devel" then "" elif env.version | startswith("3.0") then ( -}}
+# for some reason, 3.0.xx manifests as 3.00.xx (hence the extra "0" added in the following check)
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION//.0./.00.}" ]; \
+{{ ) elif env.version | endswith("-rc") then ( -}}
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "${_BASH_VERSION%%-*}.0" ]; \
+{{ ) else ( -}}
+	[ "$(bash -c 'echo "${BASH_VERSION%%[^0-9.]*}"')" = "$_BASH_VERSION" ]; \
+{{ ) end -}}
+	bash -c 'help' > /dev/null
+
+COPY docker-entrypoint.sh /usr/local/bin/
+ENTRYPOINT ["docker-entrypoint.sh"]
+CMD ["bash"]
diff --git a/apply-templates.sh b/apply-templates.sh
new file mode 100755
index 0000000..f1432df
--- /dev/null
+++ b/apply-templates.sh
@@ -0,0 +1,40 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+[ -f versions.json ] # run "versions.sh" first
+
+jqt='.jq-template.awk'
+if [ -n "${BASHBREW_SCRIPTS:-}" ]; then
+	jqt="$BASHBREW_SCRIPTS/jq-template.awk"
+elif [ "$BASH_SOURCE" -nt "$jqt" ]; then
+	wget -qO "$jqt" 'https://github.com/docker-library/bashbrew/raw/ac3e8e9541cb362a579b05bec41dd40d1df1c6e6/scripts/jq-template.awk'
+fi
+
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
+
+generated_warning() {
+	cat <<-EOH
+		#
+		# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+		#
+		# PLEASE DO NOT EDIT IT DIRECTLY.
+		#
+
+	EOH
+}
+
+for version; do
+	export version
+
+	echo "processing $version ..."
+
+	{
+		generated_warning
+		gawk -f "$jqt" Dockerfile.template
+	} > "$version/Dockerfile"
+
+	cp -a docker-entrypoint.sh "$version/"
+done
diff --git a/devel/Dockerfile b/devel/Dockerfile
index 150bb65..0f2c30d 100644
--- a/devel/Dockerfile
+++ b/devel/Dockerfile
@@ -1,8 +1,14 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM alpine:3.12
 
 # https://git.savannah.gnu.org/cgit/bash.git/commit/?h=devel
 ENV _BASH_COMMIT f43f678557d150aeca89836812ccfac506718280
-ENV _BASH_COMMIT_DESC commit bash-20200901 snapshot
+ENV _BASH_VERSION devel-20200901
 # prefixed with "_" since "$BASH..." have meaning in Bash parlance
 
 RUN set -eux; \
@@ -30,6 +36,7 @@ RUN set -eux; \
 	rm bash.tar.gz; \
 	\
 	if [ -d bash-patches ]; then \
+		apk add --no-cache --virtual .patch-deps patch; \
 		for p in bash-patches/*; do \
 			patch \
 				--directory=/usr/src/bash \
@@ -39,6 +46,7 @@ RUN set -eux; \
 			rm "$p"; \
 		done; \
 		rmdir bash-patches; \
+		apk del --no-network .patch-deps; \
 	fi; \
 	\
 	cd /usr/src/bash; \
@@ -60,10 +68,10 @@ RUN set -eux; \
 	rm -r /usr/src/bash; \
 	\
 # delete a few installed bits for smaller image size
-	rm -r \
+	rm -rf \
 		/usr/local/share/doc/bash/*.html \
 		/usr/local/share/info \
-#		/usr/local/share/locale \
+		/usr/local/share/locale \
 		/usr/local/share/man \
 	; \
 	\
@@ -73,11 +81,12 @@ RUN set -eux; \
 			| sort -u \
 			| awk 'system("[ -e /usr/local/lib/" $1 " ]") == 0 { next } { print "so:" $1 }' \
 	)"; \
-	apk add --no-cache --virtual .bash-rundeps $runDeps; \
-	apk del .build-deps; \
+	apk add --no-network --virtual .bash-rundeps $runDeps; \
+	apk del --no-network .build-deps; \
 	\
 	[ "$(which bash)" = '/usr/local/bin/bash' ]; \
-	bash --version
+	bash --version; \
+	bash -c 'help' > /dev/null
 
 COPY docker-entrypoint.sh /usr/local/bin/
 ENTRYPOINT ["docker-entrypoint.sh"]
diff --git a/generate-stackbrew-library.sh b/generate-stackbrew-library.sh
index 9d70e5c..f4c5dc5 100755
--- a/generate-stackbrew-library.sh
+++ b/generate-stackbrew-library.sh
@@ -1,5 +1,5 @@
-#!/usr/bin/env bash
-set -Eeuo pipefail
+#!/bin/bash
+set -eu
 
 declare -A aliases=(
 	[5.1-rc]='rc'
@@ -11,11 +11,13 @@ declare -A aliases=(
 self="$(basename "$BASH_SOURCE")"
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-versions=( */ )
-versions=( "${versions[@]%/}" )
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
 
 # sort version numbers with highest first
-IFS=$'\n'; versions=( $(echo "${versions[*]}" | sort -rV) ); unset IFS
+IFS=$'\n'; set -- $(sort -rV <<<"$*"); unset IFS
 
 # get the most recent commit which modified any of "$@"
 fileCommit() {
@@ -53,7 +55,6 @@ getArches() {
 			| xargs bashbrew cat --format '[{{ .RepoName }}:{{ .TagName }}]="{{ join " " .TagEntry.Architectures }}"'
 	) )"
 }
-
 getArches 'bash'
 
 cat <<-EOH
@@ -70,30 +71,13 @@ join() {
 	echo "${out#$sep}"
 }
 
-for version in "${versions[@]}"; do
-	commit="$(dirCommit "$version")"
-	parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/Dockerfile")"
-	arches="${parentRepoToArches[$parent]}"
+for version; do
+	export version
 
-	fullVersion="$(git show "$commit":"$version/Dockerfile" | awk -v version="$version" '
-		$1 == "ENV" && $2 == "_BASH_COMMIT_DESC" && $4 ~ /^bash-[0-9]+$/ && $5 == "snapshot" { gsub(/^bash-/, "", $4); print version "-" $4; exit }
-
-		$1 == "ENV" && $2 == "_BASH_VERSION" {
-			bashVersion = $3
-		}
-		$1 == "ENV" && $2 == "_BASH_LATEST_PATCH" {
-			bashLatestPatch = $3
-		}
-		bashVersion != "" && bashLatestPatch != "" {
-			if (bashVersion ~ /-/ && bashLatestPatch == "0") {
-				printf "%s", bashVersion
-			}
-			else {
-				printf "%s.%s", bashVersion, bashLatestPatch;
-			}
-			exit
-		}
-	')"
+	fullVersion="$(jq -r '.[env.version].version' versions.json)"
+	if [ "$version" = 'devel' ]; then
+		fullVersion="$version-$fullVersion"
+	fi
 
 	versionAliases=(
 		$fullVersion
@@ -101,6 +85,11 @@ for version in "${versions[@]}"; do
 		${aliases[$version]:-}
 	)
 
+	parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/Dockerfile")"
+	arches="${parentRepoToArches[$parent]}"
+
+	commit="$(dirCommit "$version")"
+
 	echo
 	cat <<-EOE
 		Tags: $(join ', ' "${versionAliases[@]}")
diff --git a/update.sh b/update.sh
index 4afa9f9..bac2d75 100755
--- a/update.sh
+++ b/update.sh
@@ -3,90 +3,5 @@ set -Eeuo pipefail
 
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-versions=( "$@" )
-if [ ${#versions[@]} -eq 0 ]; then
-	versions=( */ )
-fi
-versions=( "${versions[@]%/}" )
-
-ftpBase='ftp://ftp.gnu.org/gnu/bash'
-allBaseVersions="$(
-	curl --silent --list-only "$ftpBase/" \
-		| grep -E '^bash-[0-9].*\.tar\.gz$' \
-		| sed -r 's/^bash-|\.tar\.gz$//g'
-)"
-
-for version in "${versions[@]}"; do
-	rcVersion="${version%-rc}"
-	rcGrepV='-v'
-	if [ "$version" != "$rcVersion" ]; then
-		rcGrepV=
-	fi
-
-	if [ "$version" = 'devel' ]; then
-		commit="$(git ls-remote https://git.savannah.gnu.org/git/bash.git refs/heads/devel | cut -d$'\t' -f1)"
-		if [ -z "$commit" ]; then
-			echo >&2 "error: cannot determine commit for $version (from https://git.savannah.gnu.org/cgit/bash.git)"
-			exit 1
-		fi
-		desc="$(
-			curl -fsSL "https://git.savannah.gnu.org/cgit/bash.git/patch/?id=$commit" 2>/dev/null \
-				| sed -n '/^Subject: /{s///p;q}' \
-				|| :
-		)"
-		[ -n "$desc" ]
-		echo "$version: $commit ($desc)"
-		sed -ri -e 's/^(ENV _BASH_COMMIT) .*/\1 '"$commit"'/' \
-			-e 's!^(ENV _BASH_COMMIT_DESC) .*!\1 '"$desc"'!' \
-			"$version/Dockerfile"
-		cp -a docker-entrypoint.sh "$version/"
-		continue
-	fi
-
-	bashVersion="$rcVersion"
-
-	IFS=$'\n'
-	allVersions=( $(
-		echo "$allBaseVersions" \
-			| grep -E "^$bashVersion([.-]|\$)" \
-			| grep -E $rcGrepV -- '-(rc|beta|alpha)' \
-			| sort -rV
-	) )
-	allPatches=( $(
-		curl --silent --list-only "$ftpBase/bash-$bashVersion-patches/" \
-			| grep -E '^bash'"${bashVersion//./}"'-[0-9]{3}$' \
-			| sed -r 's/^bash'"${bashVersion//./}"'-0*//g' \
-			| sort -rn \
-		|| true
-	) )
-	unset IFS
-
-	if [ "${#allVersions[@]}" -eq 0 ]; then
-		echo >&2 "error: cannot find any releases of $version in $ftpBase"
-		exit 1
-	fi
-	latestVersion="${allVersions[0]}"
-
-	latestPatch='0'
-	if [ "${#allPatches[@]}" -gt 0 ]; then
-		latestPatch="${allPatches[0]}"
-	fi
-
-	patchLevel='0'
-	if [[ "$latestVersion" == *.*.* ]]; then
-		patchLevel="${latestVersion##*.*.}"
-	fi
-
-	if [ "$rcVersion" != "$version" ]; then
-		bashVersion="$latestVersion" # "5.0-beta", "5.0-alpha", etc
-	fi
-
-	echo "$version: $latestVersion"
-
-	sed -ri \
-		-e 's/^(ENV _BASH_VERSION) .*/\1 '"$bashVersion"'/' \
-		-e 's/^(ENV _BASH_PATCH_LEVEL) .*/\1 '"$patchLevel"'/' \
-		-e 's/^(ENV _BASH_LATEST_PATCH) .*/\1 '"$latestPatch"'/' \
-		"$version/Dockerfile"
-	cp -a docker-entrypoint.sh "$version/"
-done
+./versions.sh "$@"
+./apply-templates.sh "$@"
diff --git a/versions.json b/versions.json
new file mode 100644
index 0000000..73db0ed
--- /dev/null
+++ b/versions.json
@@ -0,0 +1,95 @@
+{
+  "3.0": {
+    "baseline": {
+      "patch": "16",
+      "version": "3.0.16"
+    },
+    "patch": {
+      "version": "22"
+    },
+    "version": "3.0.22"
+  },
+  "3.1": {
+    "baseline": {
+      "version": "3.1"
+    },
+    "patch": {
+      "version": "23"
+    },
+    "version": "3.1.23"
+  },
+  "3.2": {
+    "baseline": {
+      "patch": "57"
+    },
+    "patch": {
+      "version": "57"
+    },
+    "version": "3.2.57"
+  },
+  "4.0": {
+    "baseline": {
+      "version": "4.0"
+    },
+    "patch": {
+      "version": "44"
+    },
+    "version": "4.0.44"
+  },
+  "4.1": {
+    "baseline": {
+      "version": "4.1"
+    },
+    "patch": {
+      "version": "17"
+    },
+    "version": "4.1.17"
+  },
+  "4.2": {
+    "baseline": {
+      "patch": "53"
+    },
+    "patch": {
+      "version": "53"
+    },
+    "version": "4.2.53"
+  },
+  "4.3": {
+    "baseline": {
+      "patch": "30",
+      "version": "4.3.30"
+    },
+    "patch": {
+      "version": "48"
+    },
+    "version": "4.3.48"
+  },
+  "4.4": {
+    "baseline": {
+      "patch": "18",
+      "version": "4.4.18"
+    },
+    "patch": {
+      "version": "23"
+    },
+    "version": "4.4.23"
+  },
+  "5.0": {
+    "baseline": {
+      "version": "5.0"
+    },
+    "patch": {
+      "version": "18"
+    },
+    "version": "5.0.18"
+  },
+  "5.1-rc": {
+    "version": "5.1-beta"
+  },
+  "devel": {
+    "commit": {
+      "version": "f43f678557d150aeca89836812ccfac506718280"
+    },
+    "version": "20200901"
+  }
+}
diff --git a/versions.sh b/versions.sh
new file mode 100755
index 0000000..4cb5748
--- /dev/null
+++ b/versions.sh
@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
+
+versions=( "$@" )
+if [ ${#versions[@]} -eq 0 ]; then
+	versions=( */ )
+	json='{}'
+else
+	json="$(< versions.json)"
+fi
+versions=( "${versions[@]%/}" )
+
+ftpBase='ftp://ftp.gnu.org/gnu/bash'
+ftp_list() {
+	curl --silent --list-only "$ftpBase/${1:-}/"
+}
+
+allBaseVersions="$(
+	ftp_list \
+		| sed -rne '/^bash-([0-9].+)[.]tar[.]gz$/s//\1/p' \
+		| sort -V
+)"
+
+for version in "${versions[@]}"; do
+	export version
+
+	rcVersion="${version%-rc}"
+	rcGrepV='-v'
+	if [ "$version" != "$rcVersion" ]; then
+		rcGrepV=
+	fi
+
+	if [ "$version" = 'devel' ]; then
+		commit="$(git ls-remote https://git.savannah.gnu.org/git/bash.git refs/heads/devel | cut -d$'\t' -f1)"
+		if [ -z "$commit" ]; then
+			echo >&2 "error: cannot determine commit for $version (from https://git.savannah.gnu.org/cgit/bash.git)"
+			exit 1
+		fi
+		desc="$(
+			curl -fsSL "https://git.savannah.gnu.org/cgit/bash.git/patch/?id=$commit" 2>/dev/null \
+				| sed -ne '/^Subject: /{s///p;q}' \
+				|| :
+		)"
+		[ -n "$desc" ]
+		timestamp="$(sed -rne '/.*[[:space:]]+bash-([0-9]+)[[:space:]]+.*/s//\1/p' <<<"$desc")"
+		[ -n "$timestamp" ]
+
+		echo "$version: $commit ($timestamp)"
+
+		export commit timestamp
+		json="$(jq <<<"$json" -c '.[env.version] = {
+			version: env.timestamp,
+			commit: { version: env.commit },
+		}')"
+		continue
+	fi
+
+	baseline="$(
+		grep -E "^$rcVersion([.-]|\$)" <<<"$allBaseVersions" \
+			| grep -E $rcGrepV -- '-(rc|beta|alpha)' \
+			| tail -1
+	)"
+	if [ -z "$baseline" ]; then
+		echo >&2 "error: cannot find any releases of $version in $ftpBase"
+		exit 1
+	fi
+
+	patchlevel=
+	if [ "$version" = "$rcVersion" ]; then
+		patchlevel="$(
+			ftp_list "bash-$rcVersion-patches" \
+				| sed -rne '/^bash[0-9]+-([0-9]{3})$/s//\1/p' \
+				| tail -1 \
+				|| :
+		)"
+	fi
+	patchlevel="${patchlevel#0}"
+	patchlevel="${patchlevel#0}"
+	: "${patchlevel:=0}"
+	[[ "$patchlevel" =~ ^[0-9]+$ ]]
+
+	patchbase=
+	if [ "$version" = "$rcVersion" ] && [[ "$baseline" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]]; then
+		patchbase="${baseline#*.*.}"
+	fi
+	: "${patchbase:=0}"
+
+	fullVersion="$baseline"
+	if [[ "$fullVersion" =~ ^[0-9]+[.][0-9]+$ ]]; then
+		fullVersion+='.0'
+	fi
+	if [ "$version" = "$rcVersion" ] && [[ "$fullVersion" =~ ^[0-9]+[.][0-9]+[.][0-9]+$ ]] && [ "$patchlevel" -gt "$patchbase" ]; then
+		fullVersion="${fullVersion%.*}.$patchlevel"
+	fi
+
+	echo "$version: $fullVersion"
+
+	export fullVersion baseline patchbase patchlevel
+	json="$(jq <<<"$json" -c '
+		(env.patchbase | tonumber) as $patchbase
+		| (env.patchlevel | tonumber) as $patchlevel
+		| .[env.version] = { version: env.fullVersion }
+		+ if env.baseline != env.fullVersion or $patchbase > 0 then
+			{
+				baseline: (
+					if env.baseline != env.fullVersion then { version: env.baseline } else {} end
+					+ if $patchbase > 0 then { patch: env.patchbase } else {} end
+				),
+			}
+		else {} end
+		+ if $patchlevel > 0 then
+			{
+				patch: { version: env.patchlevel },
+			}
+		else {} end
+	')"
+done
+
+jq <<<"$json" -S . > versions.json