JDBC Drivers — Official Catalog and Governance

Downloading a database driver from a dubious website, finding out about the incompatibility only in production and never knowing whether that JAR carries a known vulnerability: that was the invisible cost of connecting each new source. DATTA removes that risk with an official catalog of 39 JDBC drivers and a security validation pipeline that every JAR goes through — downloaded automatically or uploaded by you — before it becomes available to any connection.

Management lives in Sistema›Drivers JDBC, restricted to administrators. This guide covers your responsibilities over the catalog: initial installation, manual upload, validation, lifecycle and monitoring.

Who does what

The platform no longer performs an automatic bootstrap in the backend — all initialization was moved to setup-datta.sh (commit 277661e, "refactor: move all initial setup from backend to setup-datta.sh"). Once installed, drivers are managed at runtime through the screen and the administration API.

What already ships in the catalog (39 drivers)

• Open-source relational: PostgreSQL, MySQL, MariaDB, SQLite, H2, HSQLDB, Apache Derby, CockroachDB (uses the PostgreSQL driver) and TimescaleDB (same).
• Analytical / columnar: DuckDB, ClickHouse, Apache Druid (via Avatica), Apache Pinot, Apache Doris and StarRocks (both MySQL-compatible).
• Data warehouse / cloud: Snowflake, Amazon Redshift, Azure Synapse (SQL Server-compatible), Databricks (manual download), IBM Db2.
• Enterprise: Oracle (manual), Microsoft SQL Server, SAP HANA, Teradata (manual), IBM Informix (manual), SAP ASE jConnect (manual), Firebird (Jaybird), Vertica, Exasol.
• Query engines: Trino, PrestoDB, Apache Spark Thrift (via Hive JDBC), Apache Hive, Apache Impala (Cloudera, manual), Apache Phoenix, Apache Drill.
• Time-series: QuestDB (PostgreSQL-compatible), Apache IoTDB, InfluxDB 3.x (via Flight SQL).

That is 39 entries in the official catalog, versioned by a version tag the developer increments on every structural change (new field, license change).

SQL dialects: you write it once, the platform translates

Every driver in the catalog has a matching dialect registered in the platform's dialect library — today 39 dialects, some of them shared (CockroachDB reuses the PostgreSQL one, Synapse the SQL Server one). The dialect absorbs each vendor's differences:

• catalog introspection (ALL_TABLES versus information_schema);
• case sensitivity (Oracle works in upper case);
• identifier quoting;
• pagination (LIMIT/OFFSET, FETCH or ROWNUM);
• date types (TIMESTAMP, DATETIME2, TIMESTAMPTZ);
• MERGE/UPSERT syntax.

Architecture rule: vendor-specific logic lives in the dialect and nowhere else.

Initial installation (Phase 7 of setup-datta.sh)

When the operator runs ./setup-datta.sh, Phase 7 — "Download and upload of the official JDBC drivers" — does the following, in order:

1. Authenticates as an administrator to obtain the session credentials.
2. For each catalog driver that is neither an alias nor requires a manual download: downloads the JAR from the vendor's official URL into the installation's log directory and uploads it to the platform along with the metadata (key, version, vendor). The driver upload endpoint is described in the API reference.
3. The validation pipeline runs on the spot; if it passes, the driver is registered as Aprovado (approved).
4. Click-through license drivers are skipped with a warning — it is up to you to download and upload them through the screen (next section).

The --skip-drivers flag skips Phase 7 entirely: use it when you need to run the setup again without redoing the downloads.

Manual download: drivers with click-through licenses

Some vendors require explicit license acceptance on their own site. For those, the automatic download is skipped and the driver shows up in the table with the Download manual badge and a direct link to the official page:

Step by step: uploading the Oracle driver

1. Open the official page from the link on the driver's row and download the JAR, accepting the OTN license.
2. In Sistema›Drivers JDBC, click Adicionar driver.
3. Select the .jar file and fill in the name, vendor, version and driver class.
4. Confirm the upload. The validation pipeline runs on the spot; if it passes, the driver enters as Aprovado and can already be used in new connections.

If the same JAR has been uploaded before, the platform recognizes it by the SHA-256 hash and reuses the existing record instead of creating a duplicate — the event is recorded as DRIVER.UPLOAD_DEDUP.

Security validation: no JAR gets in without the pipeline

Every JAR — from the setup or uploaded by you — goes through five stages in sequence:

1. Static bytecode analysis: classes with dangerous calls (Runtime.exec, ProcessBuilder, System.loadLibrary) are rejected, and so are JARs too small to be a real driver.
2. Vulnerability scan against the local CVE database (Trivy / Grype): an unmitigated HIGH or CRITICAL finding blocks the driver.
3. Digital signature verification, when the vendor publishes an .asc or a .sha256 hash.
4. Isolated load test: the driver class is loaded in an isolated class loader, to guarantee it comes up without an unhandled exception before any real connection.
5. Safe JAR extraction and metadata inference, which complete the driver's record.

Failed at any stage? The validation outcome is recorded with the reason and the driver goes to Quarentena (quarantined) — it is never exposed for use.

Lifecycle and governance

The three statuses

A newly uploaded driver that passes validation goes straight to Aprovado; a validation failure goes straight to Quarentena. There is no intermediate pending-review state.

Administrator actions

Vendor documentation for the Copilot

The platform reindexes each driver's vendor documentation to feed the answers about that source. The ingestion runs in the background: the request answers immediately and progress is polled afterwards (RUNNING / COMPLETED / FAILED) — both endpoints are in the API reference. The crawl downloads same-level pages in parallel, controlled by datta.doc-ingest.crawl-concurrency (default 6), with a global time ceiling in datta.doc-ingest.crawl-timeout-seconds (default 120).

Audit trail

Every governance action emits an event:

Monitoring

The Micrometer driver metrics live on the platform's Prometheus metrics endpoint and cover:

• validation latency — through the HTTP request metrics, or through a dedicated metric when exposed;
• number of drivers per status — datta_drivers_by_status when implemented; otherwise, derived from a graph read;
• pipeline outcomes — datta_drivers_validation_outcome.

Three signals deserve an alert:

Native sources stay out of the JDBC catalog

Sources with capabilities a generic JDBC driver cannot reach use the native connectors of the platform's execution engine — on purpose. Shipping a JDBC wrapper for them would trade the best of each engine for a lowest common denominator:

JDBC drivers for these sources do not enter the official catalog.

For developers: adding a driver to the catalog

Adding a new driver to the official catalog is a code change, made in the platform's official driver list:

1. Declare the entry with the driver's key.
2. Fill in name, vendor, version, driver class, source page, documentation URL, license type, sample JDBC URL, default port and tags.
3. If the JAR can be downloaded directly (Maven Central, for example), set the download URL; when the vendor publishes a .sha256, record the expected hash.
4. Click-through license: mark the driver as manual download and as requiring license acceptance.
5. Alias: point it at the base key (CockroachDB points at postgresql).
6. Register the matching dialect in the dialect library, if it does not exist yet.
7. Increment the catalog's version tag.
8. Adjust Phase 7 of setup-datta.sh only if the driver requires special handling — the generic loop covers the normal case.
9. Whenever possible, add a validation pipeline test.

References

• Streaming runbook (Kafka/Debezium): Runbook — Streaming (F9).
• Connection operations, including credential backup and re-encryption: Runbook — Connection Management.
• Driver catalog, upload and documentation endpoints: API reference.