Infra: Integration test Hive Dockerfile fails Debian Bullseye apt repo expired

[qzyu999]

Apache Iceberg version

main (HEAD)

Please describe the bug 🐛

The integration-test CI job is failing repo-wide because dev/hive/Dockerfile runs apt-get update against an expired Debian Bullseye security repo.

The apache/hive:4.0.0 base image uses Debian Bullseye, which reached end of life. The InRelease file for bullseye-security is no longer being refreshed, so apt-get update rejects it:

E: Release file for http://deb.debian.org/debian-security/dists/bullseye-security/InRelease
is expired (invalid since 7h 1min 15s). Updates for this repository will not be applied.

This is not intermittent — it affects every PR. Confirmed on at least four unrelated branches:

• feature/core-rewrite-api (run 34186219561)
• jschmidt/add-fast-forward (run 34260757166)
• remove_orphan_snapshots (run 34260442342)
• reject-out-of-range-in-literals (run 34200528342)

All unit tests, lint, docs, S3/ADLS/GCS integration, and Windows CI jobs pass. Only the Hive-dependent integration-test job fails.

The failing line is in dev/hive/Dockerfile:26:

RUN apt-get update -qq && \
    apt-get -qq -y install --no-install-recommends curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Possible fix

Add Acquire::Check-Valid-Until "false" before the apt-get update to allow the expired repo:

RUN echo 'Acquire::Check-Valid-Until "false";' > /etc/apt/apt.conf.d/99no-check-valid && \
    apt-get update -qq && \
    apt-get -qq -y install --no-install-recommends curl && \
    apt-get clean && \
    rm -rf /var/lib/apt/lists/*

Alternatively, a newer Hive base image not based on Bullseye would resolve this permanently.

[damansingh1313]

I'd like to take this up. Opening a PR with the minimal fix (Acquire::Check-Valid-Until=false on the hive Dockerfile's apt-get update) to unblock CI, and I'm happy to follow up with the permanent fix (dropping the apt-get layer) based on what the maintainers prefer.