diff --git a/.architectures-lib b/.architectures-lib
deleted file mode 100644
index 9c45a8cd9c..0000000000
--- a/.architectures-lib
+++ /dev/null
@@ -1,44 +0,0 @@
-#!/usr/bin/env bash
-
-hasBashbrewArch() {
-	local version="$1"; shift
-	local bashbrewArch="$1"; shift
-	local arches="$(grep -m1 'bashbrew-architectures:' "$version/Dockerfile" | cut -d':' -f2)"
-	[[ " $arches " == *" $bashbrewArch "* ]]
-}
-
-_generateParentRepoToArches() {
-	local repo="$1"; shift
-	local officialImagesUrl='https://github.com/docker-library/official-images/raw/master/library/'
-
-	eval "declare -g -A parentRepoToArches=( $(
-		find -name 'Dockerfile' -exec awk '
-				toupper($1) == "FROM" && $2 !~ /^('"$repo"'|scratch|.*\/.*)(:|$)/ {
-					print "'"$officialImagesUrl"'" $2
-				}
-			' '{}' + \
-			| sort -u \
-			| xargs bashbrew cat --format '[{{ .RepoName }}:{{ .TagName }}]="{{ join " " .TagEntry.Architectures }}"'
-	) )"
-}
-_generateParentRepoToArches 'mongo'
-
-parentArches() {
-	local version="$1"; shift # "1.8", etc
-
-	local parent="$(awk 'toupper($1) == "FROM" { print $2 }' "$version/Dockerfile")"
-	echo "${parentRepoToArches[$parent]:-}"
-}
-versionArches() {
-	local version="$1"; shift # "1.8", etc
-
-	local parentArches="$(parentArches "$version")"
-
-	local variantArches=()
-	for arch in $parentArches; do
-		if hasBashbrewArch "$version" "$arch"; then
-			variantArches+=( "$arch" )
-		fi
-	done
-	echo "${variantArches[*]}"
-}
diff --git a/.gitattributes b/.gitattributes
new file mode 100644
index 0000000000..14a112269e
--- /dev/null
+++ b/.gitattributes
@@ -0,0 +1,3 @@
+/*/**/Dockerfile            linguist-generated
+/*/**/docker-entrypoint.sh  linguist-generated
+/Dockerfile*.template       linguist-language=Dockerfile
diff --git a/.github/workflows/verify-templating.yml b/.github/workflows/verify-templating.yml
new file mode 100644
index 0000000000..7e833f1c7d
--- /dev/null
+++ b/.github/workflows/verify-templating.yml
@@ -0,0 +1,22 @@
+name: Verify Templating
+
+on:
+  pull_request:
+  push:
+
+defaults:
+  run:
+    shell: 'bash -Eeuo pipefail -x {0}'
+
+jobs:
+  apply-templates:
+    name: Check For Uncomitted Changes
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v2
+      - name: Apply Templates
+        run: ./apply-templates.sh
+      - name: Check Git Status
+        run: |
+          status="$(git status --short)"
+          [ -z "$status" ]
diff --git a/.gitignore b/.gitignore
new file mode 100644
index 0000000000..d548f66de0
--- /dev/null
+++ b/.gitignore
@@ -0,0 +1 @@
+.jq-template.awk
diff --git a/4.0/Dockerfile b/4.0/Dockerfile
index 0aa425fcae..d4eede8c98 100644
--- a/4.0/Dockerfile
+++ b/4.0/Dockerfile
@@ -1,3 +1,9 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM ubuntu:xenial
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
@@ -59,13 +65,13 @@ RUN set -ex; \
 
 RUN mkdir /docker-entrypoint-initdb.d
 
-ENV GPG_KEYS 9DA31620334BD75D9DCB49F368818C72E52529D4
 RUN set -ex; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	for key in $GPG_KEYS; do \
+	set -- '9DA31620334BD75D9DCB49F368818C72E52529D4'; \
+	for key; do \
 		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
 	done; \
-	gpg --batch --export $GPG_KEYS > /etc/apt/trusted.gpg.d/mongodb.gpg; \
+	gpg --batch --export "$@" > /etc/apt/trusted.gpg.d/mongodb.gpg; \
 	command -v gpgconf && gpgconf --kill all || :; \
 	rm -r "$GNUPGHOME"; \
 	apt-key list
@@ -74,15 +80,16 @@ RUN set -ex; \
 # Options for MONGO_PACKAGE: mongodb-org OR mongodb-enterprise
 # Options for MONGO_REPO: repo.mongodb.org OR repo.mongodb.com
 # Example: docker build --build-arg MONGO_PACKAGE=mongodb-enterprise --build-arg MONGO_REPO=repo.mongodb.com .
-ARG MONGO_PACKAGE=mongodb-org
-ARG MONGO_REPO=repo.mongodb.org
+ARG MONGO_PACKAGE=mongodb-org MONGO_REPO=repo.mongodb.org
 ENV MONGO_PACKAGE=${MONGO_PACKAGE} MONGO_REPO=${MONGO_REPO}
 
 ENV MONGO_MAJOR 4.0
-ENV MONGO_VERSION 4.0.24
-# bashbrew-architectures:amd64 arm64v8
 RUN echo "deb http://$MONGO_REPO/apt/ubuntu xenial/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR multiverse" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
 
+# http://docs.mongodb.org/master/release-notes/4.0/
+ENV MONGO_VERSION 4.0.24
+# 04/15/2021, https://github.com/mongodb/mongo/tree/9df1b3a80f39cf7e7ccd6264a207518426a524f6
+
 RUN set -x \
 # installing "mongodb-enterprise" pulls in "tzdata" which prompts for input
 	&& export DEBIAN_FRONTEND=noninteractive \
diff --git a/4.0/windows/windowsservercore-1809/Dockerfile b/4.0/windows/windowsservercore-1809/Dockerfile
index d76d822579..cd30ae9fcf 100644
--- a/4.0/windows/windowsservercore-1809/Dockerfile
+++ b/4.0/windows/windowsservercore-1809/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:1809
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.0/
 ENV MONGO_VERSION 4.0.24
+# 04/15/2021, https://github.com/mongodb/mongo/tree/9df1b3a80f39cf7e7ccd6264a207518426a524f6
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-4.0.24-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=e17a25bc51b6bdcf6da0fe6b0ba22075b43566119c656b454542735133cd9f1e
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools,MonitoringTools,ImportExportTools' \
+			'ADDLOCAL=Client,ImportExportTools,MiscellaneousTools,MonitoringTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/4.0/windows/windowsservercore-ltsc2016/Dockerfile b/4.0/windows/windowsservercore-ltsc2016/Dockerfile
index cd00c420f0..d7f28c4aa7 100644
--- a/4.0/windows/windowsservercore-ltsc2016/Dockerfile
+++ b/4.0/windows/windowsservercore-ltsc2016/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:ltsc2016
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.0/
 ENV MONGO_VERSION 4.0.24
+# 04/15/2021, https://github.com/mongodb/mongo/tree/9df1b3a80f39cf7e7ccd6264a207518426a524f6
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-4.0.24-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=e17a25bc51b6bdcf6da0fe6b0ba22075b43566119c656b454542735133cd9f1e
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools,MonitoringTools,ImportExportTools' \
+			'ADDLOCAL=Client,ImportExportTools,MiscellaneousTools,MonitoringTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/4.2/Dockerfile b/4.2/Dockerfile
index c766054b47..9d70862680 100644
--- a/4.2/Dockerfile
+++ b/4.2/Dockerfile
@@ -1,3 +1,9 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM ubuntu:bionic
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
@@ -59,13 +65,13 @@ RUN set -ex; \
 
 RUN mkdir /docker-entrypoint-initdb.d
 
-ENV GPG_KEYS E162F504A20CDF15827F718D4B7C549A058F8B6B
 RUN set -ex; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	for key in $GPG_KEYS; do \
+	set -- 'E162F504A20CDF15827F718D4B7C549A058F8B6B'; \
+	for key; do \
 		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
 	done; \
-	gpg --batch --export $GPG_KEYS > /etc/apt/trusted.gpg.d/mongodb.gpg; \
+	gpg --batch --export "$@" > /etc/apt/trusted.gpg.d/mongodb.gpg; \
 	command -v gpgconf && gpgconf --kill all || :; \
 	rm -r "$GNUPGHOME"; \
 	apt-key list
@@ -74,15 +80,16 @@ RUN set -ex; \
 # Options for MONGO_PACKAGE: mongodb-org OR mongodb-enterprise
 # Options for MONGO_REPO: repo.mongodb.org OR repo.mongodb.com
 # Example: docker build --build-arg MONGO_PACKAGE=mongodb-enterprise --build-arg MONGO_REPO=repo.mongodb.com .
-ARG MONGO_PACKAGE=mongodb-org
-ARG MONGO_REPO=repo.mongodb.org
+ARG MONGO_PACKAGE=mongodb-org MONGO_REPO=repo.mongodb.org
 ENV MONGO_PACKAGE=${MONGO_PACKAGE} MONGO_REPO=${MONGO_REPO}
 
 ENV MONGO_MAJOR 4.2
-ENV MONGO_VERSION 4.2.14
-# bashbrew-architectures:amd64 arm64v8
 RUN echo "deb http://$MONGO_REPO/apt/ubuntu bionic/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR multiverse" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
 
+# http://docs.mongodb.org/master/release-notes/4.2/
+ENV MONGO_VERSION 4.2.14
+# 05/03/2021, https://github.com/mongodb/mongo/tree/0e6db36e92d82cc81cbd40ffd607eae88dc1f09d
+
 RUN set -x \
 # installing "mongodb-enterprise" pulls in "tzdata" which prompts for input
 	&& export DEBIAN_FRONTEND=noninteractive \
diff --git a/4.2/windows/windowsservercore-1809/Dockerfile b/4.2/windows/windowsservercore-1809/Dockerfile
index df56759a64..6839ffbb7e 100644
--- a/4.2/windows/windowsservercore-1809/Dockerfile
+++ b/4.2/windows/windowsservercore-1809/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:1809
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.2/
 ENV MONGO_VERSION 4.2.14
+# 05/03/2021, https://github.com/mongodb/mongo/tree/0e6db36e92d82cc81cbd40ffd607eae88dc1f09d
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2012plus-4.2.14-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=706610f96ae74963d5348aafe34f976e7b1c02ef1a9f3596862e1e5ba3437e76
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools,MonitoringTools,ImportExportTools' \
+			'ADDLOCAL=Client,ImportExportTools,MiscellaneousTools,MonitoringTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/4.2/windows/windowsservercore-ltsc2016/Dockerfile b/4.2/windows/windowsservercore-ltsc2016/Dockerfile
index a7ac6fa18d..2151b54922 100644
--- a/4.2/windows/windowsservercore-ltsc2016/Dockerfile
+++ b/4.2/windows/windowsservercore-ltsc2016/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:ltsc2016
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.2/
 ENV MONGO_VERSION 4.2.14
+# 05/03/2021, https://github.com/mongodb/mongo/tree/0e6db36e92d82cc81cbd40ffd607eae88dc1f09d
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2012plus-4.2.14-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=706610f96ae74963d5348aafe34f976e7b1c02ef1a9f3596862e1e5ba3437e76
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools,MonitoringTools,ImportExportTools' \
+			'ADDLOCAL=Client,ImportExportTools,MiscellaneousTools,MonitoringTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/4.4/Dockerfile b/4.4/Dockerfile
index daa59f6017..569211c148 100644
--- a/4.4/Dockerfile
+++ b/4.4/Dockerfile
@@ -1,3 +1,9 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM ubuntu:bionic
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
@@ -59,13 +65,13 @@ RUN set -ex; \
 
 RUN mkdir /docker-entrypoint-initdb.d
 
-ENV GPG_KEYS 20691EEC35216C63CAF66CE1656408E390CFB1F5
 RUN set -ex; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	for key in $GPG_KEYS; do \
+	set -- '20691EEC35216C63CAF66CE1656408E390CFB1F5'; \
+	for key; do \
 		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
 	done; \
-	gpg --batch --export $GPG_KEYS > /etc/apt/trusted.gpg.d/mongodb.gpg; \
+	gpg --batch --export "$@" > /etc/apt/trusted.gpg.d/mongodb.gpg; \
 	command -v gpgconf && gpgconf --kill all || :; \
 	rm -r "$GNUPGHOME"; \
 	apt-key list
@@ -74,15 +80,16 @@ RUN set -ex; \
 # Options for MONGO_PACKAGE: mongodb-org OR mongodb-enterprise
 # Options for MONGO_REPO: repo.mongodb.org OR repo.mongodb.com
 # Example: docker build --build-arg MONGO_PACKAGE=mongodb-enterprise --build-arg MONGO_REPO=repo.mongodb.com .
-ARG MONGO_PACKAGE=mongodb-org
-ARG MONGO_REPO=repo.mongodb.org
+ARG MONGO_PACKAGE=mongodb-org MONGO_REPO=repo.mongodb.org
 ENV MONGO_PACKAGE=${MONGO_PACKAGE} MONGO_REPO=${MONGO_REPO}
 
 ENV MONGO_MAJOR 4.4
-ENV MONGO_VERSION 4.4.6
-# bashbrew-architectures:amd64 arm64v8 s390x
 RUN echo "deb http://$MONGO_REPO/apt/ubuntu bionic/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR multiverse" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
 
+# http://docs.mongodb.org/master/release-notes/4.4/
+ENV MONGO_VERSION 4.4.6
+# 05/07/2021, https://github.com/mongodb/mongo/tree/72e66213c2c3eab37d9358d5e78ad7f5c1d0d0d7
+
 RUN set -x \
 # installing "mongodb-enterprise" pulls in "tzdata" which prompts for input
 	&& export DEBIAN_FRONTEND=noninteractive \
diff --git a/4.4/windows/windowsservercore-1809/Dockerfile b/4.4/windows/windowsservercore-1809/Dockerfile
index f1bd13823b..a510aa2fa0 100644
--- a/4.4/windows/windowsservercore-1809/Dockerfile
+++ b/4.4/windows/windowsservercore-1809/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:1809
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.4/
 ENV MONGO_VERSION 4.4.6
+# 05/07/2021, https://github.com/mongodb/mongo/tree/72e66213c2c3eab37d9358d5e78ad7f5c1d0d0d7
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-4.4.6-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=ede50e8f8d8c9d23a8ca2cc1c96cdb9bcc1f617930e8bd1d46f21d95d0b555f8
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools' \
+			'ADDLOCAL=Client,MiscellaneousTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/4.4/windows/windowsservercore-ltsc2016/Dockerfile b/4.4/windows/windowsservercore-ltsc2016/Dockerfile
index c672e8ec65..ebf2a3bc22 100644
--- a/4.4/windows/windowsservercore-ltsc2016/Dockerfile
+++ b/4.4/windows/windowsservercore-ltsc2016/Dockerfile
@@ -1,8 +1,17 @@
+#
+# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+#
+# PLEASE DO NOT EDIT IT DIRECTLY.
+#
+
 FROM mcr.microsoft.com/windows/servercore:ltsc2016
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
+# http://docs.mongodb.org/master/release-notes/4.4/
 ENV MONGO_VERSION 4.4.6
+# 05/07/2021, https://github.com/mongodb/mongo/tree/72e66213c2c3eab37d9358d5e78ad7f5c1d0d0d7
+
 ENV MONGO_DOWNLOAD_URL https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-4.4.6-signed.msi
 ENV MONGO_DOWNLOAD_SHA256=ede50e8f8d8c9d23a8ca2cc1c96cdb9bcc1f617930e8bd1d46f21d95d0b555f8
 
@@ -29,7 +38,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=ServerNoService,Client,Router,MiscellaneousTools' \
+			'ADDLOCAL=Client,MiscellaneousTools,Router,ServerNoService' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/Dockerfile-linux.template b/Dockerfile-linux.template
index 3c42d04827..eba872470d 100644
--- a/Dockerfile-linux.template
+++ b/Dockerfile-linux.template
@@ -1,4 +1,5 @@
-FROM placeholder
+{{ def target: .targets[.linux] -}}
+FROM {{ target.image }}
 
 # add our user and group first to make sure their IDs get assigned consistently, regardless of whatever dependencies get added
 RUN groupadd -r mongodb && useradd -r -g mongodb mongodb
@@ -59,13 +60,13 @@ RUN set -ex; \
 
 RUN mkdir /docker-entrypoint-initdb.d
 
-ENV GPG_KEYS placeholder
 RUN set -ex; \
 	export GNUPGHOME="$(mktemp -d)"; \
-	for key in $GPG_KEYS; do \
+	set -- {{ .gpg | map(@sh) | join(" ") }}; \
+	for key; do \
 		gpg --batch --keyserver ha.pool.sks-keyservers.net --recv-keys "$key"; \
 	done; \
-	gpg --batch --export $GPG_KEYS > /etc/apt/trusted.gpg.d/mongodb.gpg; \
+	gpg --batch --export "$@" > /etc/apt/trusted.gpg.d/mongodb.gpg; \
 	command -v gpgconf && gpgconf --kill all || :; \
 	rm -r "$GNUPGHOME"; \
 	apt-key list
@@ -74,14 +75,19 @@ RUN set -ex; \
 # Options for MONGO_PACKAGE: mongodb-org OR mongodb-enterprise
 # Options for MONGO_REPO: repo.mongodb.org OR repo.mongodb.com
 # Example: docker build --build-arg MONGO_PACKAGE=mongodb-enterprise --build-arg MONGO_REPO=repo.mongodb.com .
-ARG MONGO_PACKAGE=placeholder
-ARG MONGO_REPO=repo.mongodb.org
+ARG MONGO_PACKAGE=mongodb-org{{ if env.version | test("-rc$") then "-unstable" else "" end }} MONGO_REPO=repo.mongodb.org
 ENV MONGO_PACKAGE=${MONGO_PACKAGE} MONGO_REPO=${MONGO_REPO}
 
-ENV MONGO_MAJOR placeholder
-ENV MONGO_VERSION placeholder
-# bashbrew-architectures:%%ARCHES%%
-RUN echo "deb http://$MONGO_REPO/apt/%%DISTRO%% %%SUITE%%/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR %%COMPONENT%%" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
+ENV MONGO_MAJOR {{ if env.version | test("-rc$") then "testing" else env.version end }}
+RUN echo "deb http://$MONGO_REPO/apt/{{ target.image | gsub(":.*$"; "") }} {{ target.suite }}/${MONGO_PACKAGE%-unstable}/$MONGO_MAJOR {{ if target.image | test("^debian") then "main" else "multiverse" end }}" | tee "/etc/apt/sources.list.d/${MONGO_PACKAGE%-unstable}.list"
+
+{{ if .notes then ( -}}
+# {{ .notes }}
+{{ ) else "" end -}}
+ENV MONGO_VERSION {{ .version | gsub("-"; "~") }}
+{{ if .date or .githash then ( -}}
+# {{ [ .date // empty, "https://github.com/mongodb/mongo/tree/" + .githash // empty ] | join(", ") }}
+{{ ) else "" end -}}
 
 RUN set -x \
 # installing "mongodb-enterprise" pulls in "tzdata" which prompts for input
diff --git a/Dockerfile-windows.template b/Dockerfile-windows.template
index 7a06c1f099..5f78275474 100644
--- a/Dockerfile-windows.template
+++ b/Dockerfile-windows.template
@@ -1,10 +1,17 @@
-FROM mcr.microsoft.com/windows/servercore:placeholder
+FROM mcr.microsoft.com/windows/{{ env.windowsVariant }}:{{ env.windowsRelease }}
 
 SHELL ["powershell", "-Command", "$ErrorActionPreference = 'Stop';"]
 
-ENV MONGO_VERSION placeholder
-ENV MONGO_DOWNLOAD_URL placeholder
-ENV MONGO_DOWNLOAD_SHA256=placeholder
+{{ if .notes then ( -}}
+# {{ .notes }}
+{{ ) else "" end -}}
+ENV MONGO_VERSION {{ .version }}
+{{ if .date or .githash then ( -}}
+# {{ [ .date // empty, "https://github.com/mongodb/mongo/tree/" + .githash // empty ] | join(", ") }}
+{{ ) else "" end -}}
+
+ENV MONGO_DOWNLOAD_URL {{ .targets.windows.msi }}
+ENV MONGO_DOWNLOAD_SHA256={{ .targets.windows.sha256 }}
 
 RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 	[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12; \
@@ -29,7 +36,7 @@ RUN Write-Host ('Downloading {0} ...' -f $env:MONGO_DOWNLOAD_URL); \
 			'/l*v', 'install.log', \
 # https://docs.mongodb.com/manual/tutorial/install-mongodb-on-windows-unattended/#run-the-windows-installer-from-the-windows-command-interpreter
 			'INSTALLLOCATION=C:\mongodb', \
-			'ADDLOCAL=placeholder' \
+			'ADDLOCAL={{ .targets.windows.features | join(",") }}' \
 		); \
 	if (-Not (Test-Path C:\mongodb\bin\mongo.exe -PathType Leaf)) { \
 		Write-Host 'Installer failed!'; \
diff --git a/apply-templates.sh b/apply-templates.sh
new file mode 100755
index 0000000000..8f1a5fc80a
--- /dev/null
+++ b/apply-templates.sh
@@ -0,0 +1,60 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+[ -f versions.json ] # run "versions.sh" first
+
+jqt='.jq-template.awk'
+if [ -n "${BASHBREW_SCRIPTS:-}" ]; then
+	jqt="$BASHBREW_SCRIPTS/jq-template.awk"
+elif [ "$BASH_SOURCE" -nt "$jqt" ]; then
+	# https://github.com/docker-library/bashbrew/blob/master/scripts/jq-template.awk
+	wget -qO "$jqt" 'https://github.com/docker-library/bashbrew/raw/00e281f36edd19f52541a6ba2f215cc3c4645128/scripts/jq-template.awk'
+fi
+
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
+
+generated_warning() {
+	cat <<-EOH
+		#
+		# NOTE: THIS DOCKERFILE IS GENERATED VIA "apply-templates.sh"
+		#
+		# PLEASE DO NOT EDIT IT DIRECTLY.
+		#
+
+	EOH
+}
+
+for version; do
+	export version
+
+	echo "processing $version ..."
+
+	mkdir -p "$version"
+	{
+		generated_warning
+		gawk -f "$jqt" Dockerfile-linux.template
+	} > "$version/Dockerfile"
+
+	cp -a docker-entrypoint.sh "$version/"
+
+	variants="$(jq -r '.[env.version].targets.windows.variants | map(@sh) | join(" ")' versions.json)"
+	eval "variants=( $variants )"
+	for variant in "${variants[@]}"; do
+		windowsVariant="${variant%%-*}" # "windowsservercore", "nanoserver"
+		windowsRelease="${variant#$windowsVariant-}" # "1809", "ltsc2016", etc
+		windowsVariant="${windowsVariant#windows}" # "servercore", "nanoserver"
+		export windowsVariant windowsRelease
+
+		dir="$version/windows/$variant"
+		echo "processing $dir ..."
+
+		mkdir -p "$dir"
+		{
+			generated_warning
+			gawk -f "$jqt" Dockerfile-windows.template
+		} > "$dir/Dockerfile"
+	done
+done
diff --git a/generate-stackbrew-library.sh b/generate-stackbrew-library.sh
index 025703e689..8ce7694d8b 100755
--- a/generate-stackbrew-library.sh
+++ b/generate-stackbrew-library.sh
@@ -1,5 +1,5 @@
-#!/bin/bash
-set -eu
+#!/usr/bin/env bash
+set -Eeuo pipefail
 
 declare -A aliases=(
 	[4.4]='4 latest'
@@ -9,10 +9,13 @@ declare -A aliases=(
 self="$(basename "$BASH_SOURCE")"
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-source '.architectures-lib'
+if [ "$#" -eq 0 ]; then
+	versions="$(jq -r 'keys | map(@sh) | join(" ")' versions.json)"
+	eval "set -- $versions"
+fi
 
-versions=( */ )
-versions=( "${versions[@]%/}" )
+# sort version numbers with highest first
+IFS=$'\n'; set -- $(sort -rV <<<"$*"); unset IFS
 
 # get the most recent commit which modified any of "$@"
 fileCommit() {
@@ -36,6 +39,22 @@ dirCommit() {
 	)
 }
 
+getArches() {
+	local repo="$1"; shift
+	local officialImagesUrl='https://github.com/docker-library/official-images/raw/master/library/'
+
+	eval "declare -g -A parentRepoToArches=( $(
+		find -name 'Dockerfile' -exec awk '
+				toupper($1) == "FROM" && $2 !~ /^('"$repo"'|scratch|.*\/.*)(:|$)/ {
+					print "'"$officialImagesUrl"'" $2
+				}
+			' '{}' + \
+			| sort -u \
+			| xargs bashbrew cat --format '[{{ .RepoName }}:{{ .TagName }}]="{{ join " " .TagEntry.Architectures }}"'
+	) )"
+}
+getArches 'mongo'
+
 cat <<-EOH
 # this file is generated via https://github.com/docker-library/mongo/blob/$(fileCommit "$self")/$self
 
@@ -51,79 +70,29 @@ join() {
 	echo "${out#$sep}"
 }
 
-for version in "${versions[@]}"; do
-	rcVersion="${version%-rc}"
+for version; do
+	export version
 
-	commit="$(dirCommit "$version")"
+	fullVersion="$(jq -r '.[env.version].version' versions.json)"
 
-	fullVersion="$(git show "$commit":"$version/Dockerfile" | awk '$1 == "ENV" && $2 == "MONGO_VERSION" { gsub(/~/, "-", $3); print $3; exit }')"
-
-	versionAliases=()
-	if [ "$version" = "$rcVersion" ]; then
-		while [ "$fullVersion" != "$version" -a "${fullVersion%[.-]*}" != "$fullVersion" ]; do
-			versionAliases+=( $fullVersion )
-			fullVersion="${fullVersion%[.-]*}"
-		done
-	else
-		versionAliases+=( $fullVersion )
-	fi
-	versionAliases+=(
+	versionAliases=(
+		$fullVersion
 		$version
 		${aliases[$version]:-}
 	)
 
-	from="$(git show "$commit":"$version/Dockerfile" | awk '$1 == "FROM" { print $2; exit }')"
-	distro="${from%%:*}" # "debian", "ubuntu"
-	suite="${from#$distro:}" # "jessie-slim", "xenial"
-	suite="${suite%-slim}" # "jessie", "xenial"
-
-	component='multiverse'
-	if [ "$distro" = 'debian' ]; then
-		component='main'
-	fi
-
-	variant="$suite"
-	variantAliases=( "${versionAliases[@]/%/-$variant}" )
-	variantAliases=( "${variantAliases[@]//latest-/}" )
-
-	major="$(git show "$commit":"$version/Dockerfile" | awk '$1 == "ENV" && $2 == "MONGO_MAJOR" { print $3 }')"
-
-	echo
-	cat <<-EOE
-		Tags: $(join ', ' "${variantAliases[@]}")
-		SharedTags: $(join ', ' "${versionAliases[@]}")
-		# see http://repo.mongodb.org/apt/$distro/dists/$suite/mongodb-org/$major/$component/
-		Architectures: $(join ', ' $(versionArches "$version"))
-		GitCommit: $commit
-		Directory: $version
-	EOE
-
-	for v in \
-		windows/windowsservercore-{1809,ltsc2016} \
-		windows/nanoserver-{1809,sac2016} \
-	; do
-		dir="$version/$v"
-		variant="$(basename "$v")"
-
-		[ -f "$dir/Dockerfile" ] || continue
+	variants="$(jq -r '.[env.version].targets.windows.variants | [""] + map("windows/" + .) | map(@sh) | join(" ")' versions.json)"
+	eval "variants=( $variants )"
 
+	for v in "${variants[@]}"; do
+		dir="$version${v:+/$v}"
 		commit="$(dirCommit "$dir")"
 
-		fullVersion="$(git show "$commit":"$dir/Dockerfile" | awk '$1 == "ENV" && $2 == "MONGO_VERSION" { gsub(/~/, "-", $3); print $3; exit }')"
-
-		versionAliases=()
-		if [ "$version" = "$rcVersion" ]; then
-			while [ "$fullVersion" != "$version" -a "${fullVersion%[.-]*}" != "$fullVersion" ]; do
-				versionAliases+=( $fullVersion )
-				fullVersion="${fullVersion%[.-]*}"
-			done
+		if [ -z "$v" ]; then
+			variant="$(jq -r '.[env.version] | .targets[.linux].suite' versions.json)" # "bionic", etc.
 		else
-			versionAliases+=( $fullVersion )
+			variant="$(basename "$v")" # windowsservercore-1809, etc.
 		fi
-		versionAliases+=(
-			$version
-			${aliases[$version]:-}
-		)
 
 		variantAliases=( "${versionAliases[@]/%/-$variant}" )
 		variantAliases=( "${variantAliases[@]//latest-/}" )
@@ -136,20 +105,31 @@ for version in "${versions[@]}"; do
 				break
 			fi
 		done
-		if [[ "$variant" == 'windowsservercore'* ]]; then
+		if [[ "$variant" == 'windowsservercore'* ]] || [ -z "$v" ]; then
 			sharedTags+=( "${versionAliases[@]}" )
 		fi
 
+		case "$v" in
+			windows/*)
+				# this is the really long way to say "windows-amd64"
+				variantArches="$(jq -r '.[env.version] | .targets.windows.arches | map("windows-" + . | @sh) | join(" ")' versions.json)"
+				;;
+			*)
+				variantArches="$(jq -r '.[env.version] | .targets[.linux].arches | map(@sh) | join(" ")' versions.json)"
+				;;
+		esac
+		eval "variantArches=( $variantArches )"
+
 		echo
 		echo "Tags: $(join ', ' "${variantAliases[@]}")"
 		if [ "${#sharedTags[@]}" -gt 0 ]; then
 			echo "SharedTags: $(join ', ' "${sharedTags[@]}")"
 		fi
 		cat <<-EOE
-			Architectures: windows-amd64
+			Architectures: $(join ', ' "${variantArches[@]}")
 			GitCommit: $commit
 			Directory: $dir
 		EOE
-		[ "$variant" = "$v" ] || echo "Constraints: $variant"
+		[ -z "$v" ] || echo "Constraints: $variant"
 	done
 done
diff --git a/update.sh b/update.sh
index ee07fb3946..bac2d7581c 100755
--- a/update.sh
+++ b/update.sh
@@ -3,195 +3,5 @@ set -Eeuo pipefail
 
 cd "$(dirname "$(readlink -f "$BASH_SOURCE")")"
 
-versions=( "$@" )
-if [ ${#versions[@]} -eq 0 ]; then
-	versions=( */ )
-fi
-versions=( "${versions[@]%/}" )
-
-defaultFrom='ubuntu:bionic'
-declare -A froms=(
-	[4.0]='ubuntu:xenial'
-)
-
-declare -A fromToCommunityVersionsTarget=(
-	[ubuntu:bionic]='ubuntu1804'
-	[ubuntu:xenial]='ubuntu1604'
-)
-
-declare -A dpkgArchToBashbrew=(
-	[amd64]='amd64'
-	[armel]='arm32v5'
-	[armhf]='arm32v7'
-	[arm64]='arm64v8'
-	[i386]='i386'
-	[ppc64el]='ppc64le'
-	[s390x]='s390x'
-)
-
-communityVersions="$(
-	curl -fsSL 'https://downloads.mongodb.org/current.json' \
-		| jq -c '.versions[]'
-)"
-
-for version in "${versions[@]}"; do
-	rcVersion="${version%-rc}"
-	major="$rcVersion"
-	rcJqNot='| not'
-	if [ "$rcVersion" != "$version" ]; then
-		rcJqNot=
-		major='testing'
-	fi
-
-	from="${froms[$version]:-$defaultFrom}"
-	distro="${from%%:*}" # "debian", "ubuntu"
-	suite="${from#$distro:}" # "jessie-slim", "xenial"
-	suite="${suite%-slim}" # "jessie", "xenial"
-
-	downloads="$(
-		jq -c --arg rcVersion "$rcVersion" '
-			select(
-				(.version | startswith($rcVersion + "."))
-				and (.version | contains("-rc") '"$rcJqNot"')
-			)
-			| .version as $version
-			| .downloads[]
-			| select(.arch == "x86_64")
-			| .version = $version
-		' <<<"$communityVersions"
-	)"
-	versions="$(
-		jq -r --arg target "${fromToCommunityVersionsTarget[$from]}" '
-			select(.edition == "targeted" and .target // "" == $target)
-			| .version
-		' <<<"$downloads"
-	)"
-	windowsDownloads="$(
-		jq -c '
-			select(
-				.edition == "base"
-				and (.target // "" | test("^windows(_x86_64-(2008plus-ssl|2012plus))?$"))
-			)
-		' <<<"$downloads"
-	)"
-	windowsVersions="$(
-		jq -r '.version' <<<"$windowsDownloads"
-	)"
-	commonVersions="$(
-		comm -12 \
-			<(sort -u <<<"$versions") \
-			<(sort -u <<<"$windowsVersions")
-	)"
-	fullVersion="$(sort -V <<< "$commonVersions" | tail -1)"
-
-	if [ -z "$fullVersion" ]; then
-		echo >&2 "error: failed to find full version for $version"
-		exit 1
-	fi
-
-	echo "$version: $fullVersion"
-
-	tilde='~'
-	debVersion="${fullVersion//-/$tilde}"
-	component='multiverse'
-	if [ "$distro" = 'debian' ]; then
-		component='main'
-	fi
-	repoUrlBase="https://repo.mongodb.org/apt/$distro/dists/$suite/mongodb-org/$major/$component"
-
-	_arch_has_version() {
-		local arch="$1"; shift
-		local version="$1"; shift
-		curl -fsSL "$repoUrlBase/binary-$arch/Packages.gz" 2>/dev/null \
-			| gunzip 2>/dev/null \
-			| awk -F ': ' -v version="$version" '
-				BEGIN { ret = 1 }
-				$1 == "Package" { pkg = $2 }
-				pkg ~ /^mongodb-(org(-unstable)?|10gen)$/ && $1 == "Version" && $2 == version { print pkg; ret = 0; last }
-				END { exit(ret) }
-			'
-	}
-
-	arches=()
-	packageName=
-	for dpkgArch in "${!dpkgArchToBashbrew[@]}"; do
-		bashbrewArch="${dpkgArchToBashbrew[$dpkgArch]}"
-		if archPackageName="$(_arch_has_version "$dpkgArch" "$debVersion")"; then
-			if [ -z "$packageName" ]; then
-				packageName="$archPackageName"
-			elif [ "$archPackageName" != "$packageName" ]; then
-				echo >&2 "error: package name for $dpkgArch ($archPackageName) does not match other arches ($packageName)"
-				exit 1
-			fi
-			arches+=( "$bashbrewArch" )
-		fi
-	done
-	sortedArches="$(xargs -n1 <<<"${arches[*]}" | sort | xargs)"
-	if [ -z "$sortedArches" ]; then
-		echo >&2 "error: version $version is missing $distro ($suite) packages!"
-		exit 1
-	fi
-
-	echo "- $sortedArches"
-
-	if [ "$major" != 'testing' ]; then
-		gpgKeyVersion="$rcVersion"
-		minor="${rcVersion#*.}" # "4.3" -> "3"
-		if [ "$(( minor % 2 ))" = 1 ]; then
-			gpgKeyVersion="${rcVersion%.*}.$(( minor + 1 ))"
-		fi
-		gpgKeys="$(grep "^$gpgKeyVersion:" gpg-keys.txt | cut -d: -f2)"
-	else
-		# the "testing" repository (used for RCs) could be signed by any of the GPG keys used by the project
-		gpgKeys="$(grep -E '^[0-9.]+:' gpg-keys.txt | cut -d: -f2 | xargs)"
-	fi
-
-	sed -r \
-		-e 's/^(ENV MONGO_MAJOR) .*/\1 '"$major"'/' \
-		-e 's/^(ENV MONGO_VERSION) .*/\1 '"$debVersion"'/' \
-		-e 's/^(ARG MONGO_PACKAGE)=.*/\1='"$packageName"'/' \
-		-e 's/^(FROM) .*/\1 '"$from"'/' \
-		-e 's/%%DISTRO%%/'"$distro"'/' \
-		-e 's/%%SUITE%%/'"$suite"'/' \
-		-e 's/%%COMPONENT%%/'"$component"'/' \
-		-e 's!%%ARCHES%%!'"$sortedArches"'!g' \
-		-e 's/^(ENV GPG_KEYS) .*/\1 '"$gpgKeys"'/' \
-		Dockerfile-linux.template \
-		> "$version/Dockerfile"
-
-	cp -a docker-entrypoint.sh "$version/"
-
-	windowsMsi="$(
-		jq -r --arg version "$fullVersion" '
-			select(.version == $version)
-			| .msi
-		' <<<"$windowsDownloads" | head -1
-	)"
-	[ -n "$windowsMsi" ]
-
-	# 4.3 doesn't seem to have a sha256 file (403 forbidden), so this has to be optional :(
-	windowsSha256="$(curl -fsSL "$windowsMsi.sha256" | cut -d' ' -f1 || :)"
-
-	# https://github.com/mongodb/mongo/blob/r4.4.2/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L92 (no MonitoringTools,ImportExportTools)
-	# https://github.com/mongodb/mongo/blob/r4.2.11/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L116
-	# https://github.com/mongodb/mongo/blob/r4.0.21/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L128
-	windowsFeatures='ServerNoService,Client,Router,MiscellaneousTools'
-	case "$rcVersion" in
-		4.2 | 4.0) windowsFeatures+=',MonitoringTools,ImportExportTools' ;;
-	esac
-
-	for winVariant in \
-		windowsservercore-{1809,ltsc2016} \
-	; do
-		mkdir -p "$version/windows/$winVariant"
-
-		sed -r \
-			-e 's/^(ENV MONGO_VERSION) .*/\1 '"$fullVersion"'/' \
-			-e 's!^(ENV MONGO_DOWNLOAD_URL) .*!\1 '"$windowsMsi"'!' \
-			-e 's/^(ENV MONGO_DOWNLOAD_SHA256)=.*/\1='"$windowsSha256"'/' \
-			-e 's!^(FROM .+):.+!\1:'"${winVariant#*-}"'!' \
-			-e 's!(ADDLOCAL)=placeholder!\1='"$windowsFeatures"'!' \
-			Dockerfile-windows.template \
-			> "$version/windows/$winVariant/Dockerfile"
-	done
-done
+./versions.sh "$@"
+./apply-templates.sh "$@"
diff --git a/versions.json b/versions.json
new file mode 100644
index 0000000000..8d7fc640d1
--- /dev/null
+++ b/versions.json
@@ -0,0 +1,164 @@
+{
+  "4.0": {
+    "changes": "https://jira.mongodb.org/issues/?jql=project%20%3D%20SERVER%20AND%20fixVersion%20%3D%20%224.0.24%22%20ORDER%20BY%20status%20DESC%2C%20priority%20DESC",
+    "date": "04/15/2021",
+    "githash": "9df1b3a80f39cf7e7ccd6264a207518426a524f6",
+    "gpg": [
+      "9DA31620334BD75D9DCB49F368818C72E52529D4"
+    ],
+    "linux": "ubuntu1604",
+    "notes": "http://docs.mongodb.org/master/release-notes/4.0/",
+    "targets": {
+      "ubuntu1604": {
+        "arches": [
+          "amd64",
+          "arm64v8"
+        ],
+        "image": "ubuntu:xenial",
+        "suite": "xenial"
+      },
+      "ubuntu1804": {
+        "arches": [
+          "amd64"
+        ],
+        "image": "ubuntu:bionic",
+        "suite": "bionic"
+      },
+      "windows": {
+        "arches": [
+          "amd64"
+        ],
+        "features": [
+          "Client",
+          "ImportExportTools",
+          "MiscellaneousTools",
+          "MonitoringTools",
+          "Router",
+          "ServerNoService"
+        ],
+        "msi": "https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2008plus-ssl-4.0.24-signed.msi",
+        "sha256": "e17a25bc51b6bdcf6da0fe6b0ba22075b43566119c656b454542735133cd9f1e",
+        "variants": [
+          "windowsservercore-1809",
+          "windowsservercore-ltsc2016"
+        ]
+      }
+    },
+    "version": "4.0.24"
+  },
+  "4.2": {
+    "changes": "https://jira.mongodb.org/issues/?jql=project%20%3D%20SERVER%20AND%20fixVersion%20%3D%20%224.2.14%22%20ORDER%20BY%20status%20DESC%2C%20priority%20DESC",
+    "date": "05/03/2021",
+    "githash": "0e6db36e92d82cc81cbd40ffd607eae88dc1f09d",
+    "gpg": [
+      "E162F504A20CDF15827F718D4B7C549A058F8B6B"
+    ],
+    "linux": "ubuntu1804",
+    "notes": "http://docs.mongodb.org/master/release-notes/4.2/",
+    "targets": {
+      "debian10": {
+        "arches": [
+          "amd64"
+        ],
+        "image": "debian:buster-slim",
+        "suite": "buster"
+      },
+      "ubuntu1604": {
+        "arches": [
+          "amd64"
+        ],
+        "image": "ubuntu:xenial",
+        "suite": "xenial"
+      },
+      "ubuntu1804": {
+        "arches": [
+          "amd64",
+          "arm64v8"
+        ],
+        "image": "ubuntu:bionic",
+        "suite": "bionic"
+      },
+      "windows": {
+        "arches": [
+          "amd64"
+        ],
+        "features": [
+          "Client",
+          "ImportExportTools",
+          "MiscellaneousTools",
+          "MonitoringTools",
+          "Router",
+          "ServerNoService"
+        ],
+        "msi": "https://fastdl.mongodb.org/win32/mongodb-win32-x86_64-2012plus-4.2.14-signed.msi",
+        "sha256": "706610f96ae74963d5348aafe34f976e7b1c02ef1a9f3596862e1e5ba3437e76",
+        "variants": [
+          "windowsservercore-1809",
+          "windowsservercore-ltsc2016"
+        ]
+      }
+    },
+    "version": "4.2.14"
+  },
+  "4.4": {
+    "changes": "https://jira.mongodb.org/issues/?jql=project%20%3D%20SERVER%20AND%20fixVersion%20%3D%20%224.4.6%22%20ORDER%20BY%20status%20DESC%2C%20priority%20DESC",
+    "date": "05/07/2021",
+    "githash": "72e66213c2c3eab37d9358d5e78ad7f5c1d0d0d7",
+    "gpg": [
+      "20691EEC35216C63CAF66CE1656408E390CFB1F5"
+    ],
+    "linux": "ubuntu1804",
+    "notes": "http://docs.mongodb.org/master/release-notes/4.4/",
+    "targets": {
+      "debian10": {
+        "arches": [
+          "amd64"
+        ],
+        "image": "debian:buster-slim",
+        "suite": "buster"
+      },
+      "ubuntu1604": {
+        "arches": [
+          "amd64"
+        ],
+        "image": "ubuntu:xenial",
+        "suite": "xenial"
+      },
+      "ubuntu1804": {
+        "arches": [
+          "amd64",
+          "arm64v8",
+          "s390x"
+        ],
+        "image": "ubuntu:bionic",
+        "suite": "bionic"
+      },
+      "ubuntu2004": {
+        "arches": [
+          "amd64",
+          "arm64v8"
+        ],
+        "image": "ubuntu:focal",
+        "suite": "focal"
+      },
+      "windows": {
+        "arches": [
+          "amd64"
+        ],
+        "features": [
+          "Client",
+          "MiscellaneousTools",
+          "Router",
+          "ServerNoService"
+        ],
+        "msi": "https://fastdl.mongodb.org/windows/mongodb-windows-x86_64-4.4.6-signed.msi",
+        "sha256": "ede50e8f8d8c9d23a8ca2cc1c96cdb9bcc1f617930e8bd1d46f21d95d0b555f8",
+        "variants": [
+          "windowsservercore-1809",
+          "windowsservercore-ltsc2016"
+        ]
+      }
+    },
+    "version": "4.4.6"
+  }
+}
diff --git a/versions.sh b/versions.sh
new file mode 100755
index 0000000000..6a7653d61d
--- /dev/null
+++ b/versions.sh
@@ -0,0 +1,208 @@
+#!/usr/bin/env bash
+set -Eeuo pipefail
+
+shell="$(
+	wget -qO- 'https://downloads.mongodb.org/current.json' \
+	| jq -r '
+		[
+			.versions[]
+
+			# filter out download objects we are definitely not interested in (enterprise, rhel, etc)
+			| del(.downloads[] | select(
+				(
+					.edition == "base"
+					or .edition == "targeted"
+				)
+				and (
+					.target // ""
+					| (
+						test("^(" + ([
+							"debian[0-9]+", # debian10, debian11, etc
+							"ubuntu[0-9]{4}", # ubuntu2004, ubuntu1804, etc
+							"windows.*" # windows, windows_x86_64, windows_x86_64-2012plus, etc
+						] | join("|")) + ")$")
+						and (
+							# a few things old enough we do not want anything to do with them /o\
+							test("^(" + ([
+								"debian[89].*",
+								"ubuntu14.*"
+							] | join("|")) + ")$")
+							| not
+						)
+					)
+				)
+			| not))
+
+			| {
+				version: (
+					# convert "4.4.x" into "4.4" and "4.9.x-rcY" into "4.9-rc"
+					(.version | split(".")[0:2] | join("."))
+					+ if .release_candidate then "-rc" else "" end
+				),
+				meta: .,
+			}
+
+			# filter out EOL versions
+			# (for some reason "current.json" still lists all these, and as of 2021-05-13 there is not an included way to differentiate them)
+			| select(.version as $v | [
+				# https://www.mongodb.com/support-policy -> "MongoDB Server" -> "End of Life Date"
+				"3.0", # February 2018
+				"3.2", # September 2018
+				"3.4", # January 2020
+				"3.6", # April 2021
+				null # ... so we can have a trailing comma above, making diffs nicer :trollface:
+			] | index($v) | not)
+		]
+
+		# now convert all that data to a basic shell list + map so we can loop over/use it appropriately
+		| "allVersions=( " + (map(.version | @sh) | join(" ")) + " )\n"
+		+ "declare -A versionMeta=(\n" + (
+			map(
+				"\t[" + (.version | @sh) + "]="
+				+ (.meta | @json | @sh)
+			) | join("\n")
+		) + "\n)"
+	'
+)"
+eval "$shell"
+
+versions=( "$@" )
+if [ ${#versions[@]} -eq 0 ]; then
+	versions=( "${allVersions[@]}" )
+	json='{}'
+else
+	versions=( "${versions[@]%/}" )
+	json="$(< versions.json)"
+fi
+
+for version in "${versions[@]}"; do
+	export version
+	_jq() { jq <<<"${versionMeta[$version]}" "$@"; }
+
+	#echo "$version: $fullVersion"
+	_jq -r 'env.version + ": " + .version'
+
+	# download the Windows MSI sha256 (so we can embed it)
+	msiUrl="$(_jq -r '.downloads[] | select(.target | test("^windows")) | .msi // ""')"
+	[ -n "$msiUrl" ]
+	[[ "$msiUrl" != *$'\n'* ]] # just in case they do something wild like support windows-arm64 :D
+	# 4.3 doesn't seem to have a sha256 file (403 forbidden), so this has to be optional :(
+	msiSha256="$(wget -qO- "$msiUrl.sha256" || :)"
+	msiSha256="${msiSha256%% *}"
+	export msiUrl msiSha256
+
+	# GPG keys
+	if [[ "$version" == *-rc ]]; then
+		# the "testing" repository (used for RCs) could be signed by any of the GPG keys used by the project
+		gpgKeys="$(grep -E '^[0-9.]+:' gpg-keys.txt | cut -d: -f2 | xargs)"
+	else
+		gpgKeyVersion="$version"
+		minor="${version#*.}" # "4.3" -> "3"
+		if [ "$(( minor % 2 ))" = 1 ]; then
+			gpgKeyVersion="${version%.*}.$(( minor + 1 ))"
+		fi
+		gpgKeys="$(grep "^$gpgKeyVersion:" gpg-keys.txt | cut -d: -f2)"
+	fi
+	[ -n "$gpgKeys" ]
+	export gpgKeys
+
+	json="$(
+		{
+			jq <<<"$json" -c .
+			_jq '{ (env.version): (
+				with_entries(select(.key as $key | [
+					# interesting bits of raw upstream metadata
+					"changes",
+					"date",
+					"githash",
+					"notes",
+					"version",
+					null # ... trailing comma hack
+				] | index($key)))
+				+ {
+					gpg: (env.gpgKeys | split(" ") | sort),
+					targets: (
+						reduce (
+							.downloads[]
+							| .target |= sub("^windows.*$"; "windows")
+						) as $d ({}; $d.target as $t |
+							.[$t].arches |= (. + [
+								{
+									# mapping from "current.json" arch values to bashbrew arch values
+									"aarch64": "arm64v8",
+									"arm64": "arm64v8",
+									"s390x": "s390x",
+									"x86_64": "amd64",
+								}[$d.arch] // ("unknown:" + $d.arch)
+							] | sort)
+							| if $t | test("^(debian|ubuntu)") then
+								.[$t].image = (
+									{
+										"debian10": "debian:buster-slim",
+										"debian11": "debian:bullseye-slim",
+										"ubuntu1604": "ubuntu:xenial",
+										"ubuntu1804": "ubuntu:bionic",
+										"ubuntu2004": "ubuntu:focal",
+									}[$t] // "unknown"
+								)
+								| .[$t].suite = (
+									.[$t].image
+									| gsub("^.*:|-slim$"; "")
+								)
+							else . end
+						)
+					),
+				}
+				| .targets.windows += {
+					msi: env.msiUrl,
+					sha256: env.msiSha256,
+					variants: [
+						"windowsservercore-1809",
+						"windowsservercore-ltsc2016"
+					],
+					features: ([
+						# https://github.com/mongodb/mongo/blob/r4.4.2/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L92 (no MonitoringTools,ImportExportTools)
+						# https://github.com/mongodb/mongo/blob/r4.2.11/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L116
+						# https://github.com/mongodb/mongo/blob/r4.0.21/src/mongo/installer/msi/wxs/FeatureFragment.wxs#L9-L128
+						"ServerNoService",
+						"Client",
+						"Router",
+						"MiscellaneousTools",
+						if [ "4.2", "4.0" ] | index(env.version) then
+							"ImportExportTools",
+							"MonitoringTools"
+						else empty end
+					] | sort),
+				}
+				# ignore anything that does not support amd64
+				| del(.targets[] | select(.arches | index("amd64") | not))
+				| .linux = (
+					# automatically choose an appropriate linux target, preferring (in order):
+					# - more supported architectures
+					# - debian over ubuntu
+					# - newer release over older
+					.targets
+					| to_entries
+					| [ .[] | select(.key | test("^(debian|ubuntu)")) ]
+					| sort_by([
+						(.value.arches | length),
+						(
+							.key
+							| if startswith("ubuntu") then
+								1
+							elif startswith("debian") then
+								2
+							else 0 end
+						),
+						(.key | sub("^(debian|ubuntu)"; "") | tonumber), # 10, 11, 2004, 1804, etc
+						.key
+					])
+					| reverse[0].key
+				)
+				| .
+			) }'
+		} | jq -cs add
+	)"
+done
+
+jq <<<"$json" -S . > versions.json