Merge branch 'master' into develop

Author: cdanger

CHANGELOG.md

@@ -4,6 +4,11 @@ All notable changes to this project are documented in this file following the [K
 Issues reported on [GitHub](https://github.com/authzforce/server/issues) are referenced in the form of `[GH-N]`, where N is the issue number. Issues reported on [OW2](https://jira.ow2.org/browse/AUTHZFORCE/) are mentioned in the form of `[OW2-N]`, where N is the issue number.
 
 
+## 11.0.1
+### Fixed
+- [GH-22]: replaced vulnerable Tomcat base image with latest official (tomcat:9-jre11-temurin-focal) for Docker.
+
+
 ## 11.0.0
 ### Changed
 - **Supported PDP configuration schema version is now 8.0 minimum: if you are already using AuthzForce Server 10.x or older and wish to migrate to this new version, follow the [Upgrader tool instructions](upgrader/src/README.md)**

dist/src/docker/Dockerfile.tmpl

@@ -23,7 +23,7 @@
 
 # The alternative is to use FROM ubuntu:* then install tomcat ubuntu package and use upstart/sysctl init script but this is not the way to go:
 # https://github.com/docker/docker/issues/6800
-FROM tomcat:9-jre11-slim
+FROM tomcat:9-jre11-temurin-focal
 MAINTAINER AuthzForce Team
 
 ENV DEBIAN_FRONTEND noninteractive

dist/src/docker/release.sh.tmpl

@@ -1,5 +1,5 @@
 set -ex
 
-docker build -t authzforce/server:${project.version} .
+docker build -t authzforce/server:release-${project.version} .
 docker login
-docker push authzforce/server:${project.version}
+docker push authzforce/server:release-${project.version}