fix(docker): mirror IBM iAccess driver on collate CDN

[IceS2]

Describe your changes:

Fixes #

IBM's public CDN (public.dhe.ibm.com) has been unreliable, causing Docker
builds to fail when curling the iAccess .list or .deb. This PR mirrors
the iAccess driver on cdn.getcollate.io and switches all four ingestion
Dockerfiles to wget from the mirror with SHA256 verification.

Why: the CI build error pasted in the linked issue is a 134-second TCP
timeout against public.dhe.ibm.com — IBM's CDN was unreachable from the
runner. Direct download of the .deb (instead of apt-list) wouldn't help:
same hostname, same network path, same failure mode. Mirroring the binary
on a CDN we control decouples Docker builds from IBM's availability.

Type of change:

• Bug fix

High-level design:

Files changed (4):

• ingestion/Dockerfile + Dockerfile.ci: replace apt-list+apt-install
  pattern with direct wget+dpkg, matching the operators' existing shape.
• ingestion/operators/docker/Dockerfile + Dockerfile.ci: bump pinned
  version from 1.1.0.13 (May 2022) to 1.1.0.29 (March 2026, matches the
  version production ingestion-slim images actually ship today).

SHA256 verification is added to all four files. The mirrored .deb is
byte-identical to IBM's upstream:

SHA256:  e60e968d2cee96b2851964456f5b31ab990b1aa47d8f2399607809f7d4514f58
Size:    1,179,698 bytes
URL:     https://cdn.getcollate.io/deps/ingestion/ibm/ibm-iaccess-1.1.0.29-1.0.amd64.deb
Source:  https://public.dhe.ibm.com/software/ibmi/products/odbc/debs/dists/1.1.0/main/binary-amd64/ibm-iaccess-1.1.0.29-1.0.amd64.deb

Why 1.1.0.29 is safe: it's the same version production
ingestion-slim:1.13.0-n103 already runs (confirmed via dpkg -l ibm-iaccess
inside the image). The smaller .deb size (1.1 MB vs 5.5 MB for 1.1.0.28) is
because IBM finally stripped debug symbols from the shared libraries — same
438 files, same libcwbodbc.so ODBC driver, same libcwbcore.so. No
functionality removed; file reports v29 as "stripped" vs v28 "with
debug_info, not stripped."

dpkg --force-depends retained because the .deb declares old Debian
package names (libodbc1, odbcinst1debian2) that don't exist in Debian 12;
the actual libraries (unixodbc, odbcinst) are installed earlier in each
Dockerfile.

Tests:

No automated test exists in the repo for the iAccess install path
(test_db2.py is a pure-mock unit test, doesn't exercise the driver, and
no CI workflow mentions db2/iaccess). Validated manually:

docker run --rm --platform=linux/amd64 debian:bookworm-slim bash -c '
  apt-get update -qq && apt-get install -y -qq wget ca-certificates unixodbc odbcinst >/dev/null 2>&1
  wget -q https://cdn.getcollate.io/deps/ingestion/ibm/ibm-iaccess-1.1.0.29-1.0.amd64.deb -O /tmp/x.deb
  echo "e60e968d2cee96b2851964456f5b31ab990b1aa47d8f2399607809f7d4514f58  /tmp/x.deb" | sha256sum -c -
  dpkg -i --force-depends /tmp/x.deb
  apt-get install -f -y --no-install-recommends
  dpkg -l ibm-iaccess
'

Result: ii ibm-iaccess 1.1.0.29-1.0 amd64 IBM i Access Client Solutions.
libcwbodbc.so (the ODBC driver, 830 KB) and the
/usr/lib/x86_64-linux-gnu/libcwbcore.so symlink land at expected paths.

Adding a Dockerfile-build smoke test to CI is a worthwhile follow-up but
out of scope for this fix.

[gitar-bot]

Code Review ✅ Approved

Mirrors the IBM iAccess driver on the Collate CDN and implements direct wget downloads with SHA256 verification to resolve build failures caused by IBM CDN instability. No issues found.

Options

Display: compact → Showing less information.

Comment with these commands to change:

Compact

gitar display:verbose

_{Was this helpful? React with 👍 / 👎 | Gitar}

[Copilot]

Pull request overview

This PR updates the ingestion Docker images’ DB2 iAccess driver installation to download a mirrored .deb from cdn.getcollate.io (instead of IBM’s CDN / apt-list flow) and verifies the artifact via pinned SHA256, improving Docker build reliability in CI.

Changes:

• Switch DB2 iAccess installation to direct wget of the mirrored .deb + sha256sum verification.
• Update the pinned iAccess version in operator images to 1.1.0.29 and align install steps across the four Dockerfiles.
• Retain dpkg -i --force-depends to handle legacy dependency naming on Debian 12.

Reviewed changes

Copilot reviewed 4 out of 4 changed files in this pull request and generated 4 comments.

File	Description
ingestion/Dockerfile	Replaces IBM apt-list install with mirrored .deb download + SHA256 verification for iAccess.
ingestion/Dockerfile.ci	Same as above for CI image build path.
ingestion/operators/docker/Dockerfile	Switches iAccess download to Collate CDN mirror, pins SHA256, and bumps to 1.1.0.29.
ingestion/operators/docker/Dockerfile.ci	Same as above for the operator CI Dockerfile.

[github-actions]

🟡 Playwright Results — all passed (14 flaky)

✅ 4062 passed · ❌ 0 failed · 🟡 14 flaky · ⏭️ 97 skipped

Shard	Passed	Failed	Flaky	Skipped
🟡 Shard 1	298	0	1	4
🟡 Shard 2	748	0	8	19
🟡 Shard 3	782	0	2	7
✅ Shard 4	790	0	0	18
✅ Shard 5	709	0	0	41
🟡 Shard 6	735	0	3	8

🟡 14 flaky test(s) (passed on retry)

• Pages/AuditLogs.spec.ts › should apply both User and EntityType filters simultaneously (shard 1, 1 retry)
• Features/BulkEditEntity.spec.ts › Glossary (shard 2, 1 retry)
• Features/BulkImport.spec.ts › Keyboard Delete selection (shard 2, 1 retry)
• Features/CuratedAssets.spec.ts › Test Data Model with display name filter (shard 2, 1 retry)
• Features/Glossary/GlossaryWorkflow.spec.ts › should start term as Draft when glossary has reviewers (shard 2, 2 retries)
• Features/KnowledgeCenter.spec.ts › Article mentions in description should working for Knowledge Center (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/KnowledgeCenterTextEditor.spec.ts › Rich Text Editor - Text Formatting (shard 2, 1 retry)
• Features/RTL.spec.ts › Verify Following widget functionality (shard 3, 1 retry)
• Flow/IngestionBot.spec.ts › Ingestion bot should be able to access domain specific domain (shard 3, 1 retry)
• Features/AutoPilot.spec.ts › Agents created by AutoPilot should be deleted (shard 6, 1 retry)
• Pages/GlossaryImportExport.spec.ts › Glossary CSV import preserves typed relations (shard 6, 1 retry)
• Pages/Lineage/LineageFilters.spec.ts › Verify lineage schema filter selection (shard 6, 1 retry)

📦 Download artifacts

How to debug locally

# Download playwright-test-results-<shard> artifact and unzip
npx playwright show-trace path/to/trace.zip    # view trace

[sonarqubecloud]

Quality Gate passed for 'open-metadata-ingestion'

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud