[bitnami/opensearch] Release 3.7.0-debian-12-r0 (#94819)

Signed-off-by: Bitnami Bot <bitnami.bot@broadcom.com>

bitnami/opensearch/3/debian-12/Dockerfile

@@ -9,13 +9,13 @@ ARG OPENSEARCH_PLUGINS
 ARG TARGETARCH
 
 LABEL org.opencontainers.image.base.name="docker.io/bitnami/minideb:bookworm" \
-      org.opencontainers.image.created="2026-06-11T03:55:14Z" \
+      org.opencontainers.image.created="2026-06-15T20:26:19Z" \
       org.opencontainers.image.description="Application packaged by Broadcom, Inc." \
       org.opencontainers.image.documentation="https://github.com/bitnami/containers/tree/main/bitnami/opensearch/README.md" \
       org.opencontainers.image.source="https://github.com/bitnami/containers/tree/main/bitnami/opensearch" \
       org.opencontainers.image.title="opensearch" \
       org.opencontainers.image.vendor="Broadcom, Inc." \
-      org.opencontainers.image.version="3.6.0"
+      org.opencontainers.image.version="3.7.0"
 
 ENV HOME="/" \
     OS_ARCH="${TARGETARCH:-amd64}" \
@@ -33,7 +33,7 @@ RUN --mount=type=secret,id=downloads_url,env=SECRET_DOWNLOADS_URL \
     COMPONENTS=( \
       "yq-4.53.3-1-linux-${OS_ARCH}-debian-12" \
       "jre-21.0.11-11-1-linux-${OS_ARCH}-debian-12" \
-      "opensearch-3.6.0-0-linux-${OS_ARCH}-debian-12" \
+      "opensearch-3.7.0-0-linux-${OS_ARCH}-debian-12" \
     ) ; \
     for COMPONENT in "${COMPONENTS[@]}"; do \
       if [ ! -f "${COMPONENT}.tar.gz" ]; then \
@@ -52,9 +52,9 @@ RUN find / -perm /6000 -type f -exec chmod a-s {} \; || true
 COPY rootfs /
 RUN /opt/bitnami/scripts/opensearch/postunpack.sh
 RUN /opt/bitnami/scripts/java/postunpack.sh
-ENV APP_VERSION="3.6.0" \
+ENV APP_VERSION="3.7.0" \
     BITNAMI_APP_NAME="opensearch" \
-    IMAGE_REVISION="7" \
+    IMAGE_REVISION="0" \
     JAVA_HOME="/opt/bitnami/java" \
     LD_LIBRARY_PATH="/opt/bitnami/opensearch/plugins/opensearch-knn/lib" \
     OPENSEARCH_JAVA_HOME="/opt/bitnami/java"

bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-ce2396d7413e5284206c7e2fe252a6730405ffe4756bd83c46d418d53d1176ad  opensearch-3.6.0-0-linux-amd64-debian-12.tar.gz

bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz.sha256

@@ -1 +0,0 @@
-c1f7cd521f2be1d9be4fd736dc66e59d06f3c686b28d228bc40cc303065ceb1c  opensearch-3.6.0-0-linux-arm64-debian-12.tar.gz

bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+fc1302cd5ad383c8ab357c1181ce6f74d587f845af6824458cb3f797b166cee9  opensearch-3.7.0-0-linux-amd64-debian-12.tar.gz

bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/checksums/opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz.sha256

@@ -0,0 +1 @@
+5da3610c89fa41f34ebc0eb1359acbf4628424c2b8c4b74d2eee2782815d35a8  opensearch-3.7.0-0-linux-arm64-debian-12.tar.gz

bitnami/opensearch/3/debian-12/prebuildfs/opt/bitnami/scripts/libpersistence.sh

@@ -39,7 +39,7 @@ persist_app() {
     fi
     pushd "$install_dir" >/dev/null || exit
     local file_to_persist_relative file_to_persist_destination file_to_persist_destination_folder
-    local -r tmp_file="/tmp/perms.acl"
+    local -r acl_file="$(mktemp "${TMPDIR:-/tmp}"/acl.XXXXXXXXXX)"
     for file_to_persist in "${files_to_persist[@]}"; do
         if [[ ! -f "$file_to_persist" && ! -d "$file_to_persist" ]]; then
             error "Cannot persist '${file_to_persist}' because it does not exist"
@@ -50,22 +50,22 @@ persist_app() {
         file_to_persist_destination_folder="$(dirname "$file_to_persist_destination")"
         # Get original permissions for existing files, which will be applied later
         # Exclude the root directory with 'sed', to avoid issues when copying the entirety of it to a volume
-        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$tmp_file"
+        getfacl -R "$file_to_persist_relative" | sed -E '/# file: (\..+|[^.])/,$!d' > "$acl_file"
         # Copy directories to the volume
         ensure_dir_exists "$file_to_persist_destination_folder"
         cp -Lr --preserve=links "$file_to_persist_relative" "$file_to_persist_destination_folder"
         # Restore permissions
         pushd "$persist_dir" >/dev/null || exit
         if am_i_root; then
-            setfacl --restore="$tmp_file"
+            setfacl --restore="$acl_file"
         else
             # When running as non-root, don't change ownership
-            setfacl --restore=<(grep -E -v '^# (owner|group):' "$tmp_file")
+            setfacl --restore=<(grep -E -v '^# (owner|group):' "$acl_file")
         fi
         popd >/dev/null || exit
     done
     popd >/dev/null || exit
-    rm -f "$tmp_file"
+    rm -f "$acl_file"
     # Install the persisted files into the installation directory, via symlinks
     restore_persisted_app "$@"
 }

bitnami/opensearch/3/debian-12/rootfs/opt/bitnami/scripts/libopensearch.sh

@@ -756,6 +756,48 @@ elasticsearch_initialize() {
             replace_in_file "${DB_CONF_DIR}/jvm.options" "(^.*logs[/]gc.log.*$)" "# \1"
         fi
         elasticsearch_set_heap_size
+        # Write BC FIPS JVM options only when FIPS mode is enabled AND Java is in restricted mode.
+        # Restricted mode is signalled by JAVA_TOOL_OPTIONS containing "java.security.restricted",
+        # which the chart sets via common.fips.config when fips.java=restricted.
+        # Relaxed mode (fips.java=relaxed) uses the non-FIPS BouncyCastle provider and does not
+        # need the BC FIPS module path.
+        if is_boolean_yes "${ELASTICSEARCH_ENABLE_FIPS_MODE:-false}" && \
+           [[ "${JAVA_TOOL_OPTIONS:-}" == *"java.security.restricted"* ]]; then
+            info "Writing BC FIPS JVM options to ${DB_CONF_DIR}/jvm.options.d/bc-fips.options..."
+            # BC FIPS JARs are placed into ${BITNAMI_ROOT_DIR}/elasticsearch/lib/ at container start by the
+            # prepare-bcfips-lib initContainer (see charts-private extra-init-vals7.yaml). This makes
+            # them named modules (org.bouncycastle.fips.core etc.) in the ES server layer, which is
+            # required for the es.entitlements.policy.server patch to work.
+            # The patch grants manage_threads to org.bouncycastle.fips.core so DisposalDaemon can
+            # call Thread.setDaemon() without triggering NotEntitledException.
+            # --module-path is NOT written here; BC FIPS is already in lib/ (server layer) via the
+            # initContainer, and JAVA_TOOL_OPTIONS provides it for CLI tools and the boot layer.
+            # The version is detected at runtime from the installed JAR filename so the patch
+            # never goes stale on upgrades. We avoid calling elasticsearch_get_version() here
+            # because at this point the BC FIPS JARs are already in lib/ (server layer via the
+            # prepare-bcfips-lib initContainer), and running the elasticsearch binary without
+            # the entitlement patch would trigger DisposalDaemon.<clinit> → NotEntitledException
+            # before the version string is ever printed (chicken-and-egg problem).
+            local es_version
+            es_version="$(ls "${DB_BASE_DIR}/lib/elasticsearch-"*.jar 2>/dev/null | grep -oP '\d+\.\d+\.\d+' | head -1)"
+            if [[ -z "$es_version" ]]; then
+                warn "Could not detect Elasticsearch version from lib/; skipping entitlement patch"
+                return
+            fi
+            local bc_fips_entitlement_patch
+            bc_fips_entitlement_patch="$(printf 'versions:\n  - %s\npolicy:\n  org.bouncycastle.fips.core:\n    - manage_threads\n' "${es_version}" | base64 -w 0)"
+
+            cat > "${DB_CONF_DIR}/jvm.options.d/bc-fips.options" <<BCFIPS
+## Bouncy Castle FIPS provider JVM options (restricted mode only)
+## BC FIPS JARs are loaded from ${BITNAMI_ROOT_DIR}/elasticsearch/lib/ as named Java modules in the ES
+## server layer (placed there by the prepare-bcfips-lib initContainer at container start).
+## The entitlement patch grants manage_threads to org.bouncycastle.fips.core for DisposalDaemon.
+## java.security.restricted is overlaid by the prepare-bcfips-lib initContainer to add SunJCE
+## as provider 4 so the JDK PKCS12KeyStore can resolve PBEWithHmacSHA256AndAES_256 AlgParams.
+-Djava.security.properties==${BITNAMI_ROOT_DIR}/java/conf/security/java.security.restricted
+-Des.entitlements.policy.server=${bc_fips_entitlement_patch}
+BCFIPS
+        fi
     else
         warn "The JVM options configuration files are not writable. Configurations based on environment variables will not be applied"
     fi
@@ -818,6 +860,11 @@ elasticsearch_initialize() {
                         elasticsearch_conf_set xpack.security.fips_mode.required_providers "${fips_providers[@]}"
                     fi
                 fi
+                # In FIPS restricted mode the ES server refuses to bootstrap a keystore
+                # with an empty password. If no secure settings were added above
+                # (e.g. bootstrap.password is empty), ensure we still have a
+                # password-protected keystore so the server can start.
+                elasticsearch_ensure_fips_keystore
             fi
             # Latest Elasticseach releases install x-pack-ml  by default. Since we have faced some issues with this library on certain platforms,
             # currently we are disabling this machine learning module whatsoever by defining "xpack.ml.enabled=false" in the "elasicsearch.yml" file