metadata early warning system

[Tom Scavo]

TL;DR Looking for feedback on a proof-of-concept implementation of a
metadata early warning system:
https://wiki.shibboleth.net/confluence/x/CgDKAg

The implementation consists of a metadata filter written in bash.
Essentially the filter is a superset of the Shibboleth
RequiredValidUntil metadata filter. Like the RequiredValidUntil
filter, the bash filter rejects metadata that never expires or for
which the validity interval is too long. In addition, the filter
ensures that the metadata is associated with a @creationInstant
attribute. This allows the filter to warn if the metadata is stale,
long before the metadata expires.

Unlike the RequiredValidUntil filter, the bash filter is intended to
run every time a metadata refresh is attempted, whether or not fresh
metadata is pulled down from the server. To simulate this behavior,
the bash filter relies on the backing file of a
FileBackedHTTPMetadataProvider as its metadata source.

As a side effect, the filter persists the values of the
@creationInstant and @validUntil attributes to a log file. It then
converts a portion of the log file to JSON. The data in the JSON file
are sufficient to construct a time-series plot, examples of which are
shown in the wiki article:
https://wiki.shibboleth.net/confluence/x/CgDKAg

Feedback is welcome.

Tom