TiKV v8.5.5 package checksum mismatch on tiup-mirrors.pingcap.com

Bug Report

Please answer these questions before submitting your issue. Thanks!

1. What did you do?

I attempted to scale out an existing TiDB v8.5.5 cluster using TiUP:

tiup cluster scale-out db-prod \
  scale-out-db-prod-tidb-5.yml \
  --user tidb \
  -i ~/.ssh/id_ed25519

The new node scale-out topology includes PD, TiKV, TiDB, Prometheus, Grafana, and Alertmanager.

The topology validation succeeds and TiUP begins downloading the required components. All components download successfully except TiKV v8.5.5.

TiUP repeatedly fails with:

Error: validation failed for /home/tidb/.tiup/storage/cluster/packages/tikv-v8.5.5-linux-amd64.tar.gz:
sha256 checksum mismatch,
expect: 7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938,
got: 7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab

I reproduced the issue several times.

I then updated both TiUP itself and the cluster component:

tiup update --self
tiup update cluster --force

After updating:

TiUP:         v1.17.0
TiUP cluster: v1.17.0

The scale-out still failed with the same expected and actual SHA-256 values.

I also downloaded the TiKV v8.5.5 artifact directly from the TiUP mirror:

curl -fL \
  -o /tmp/tikv-v8.5.5-linux-amd64.tar.gz \
  https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz

sha256sum /tmp/tikv-v8.5.5-linux-amd64.tar.gz

The downloaded file consistently hashes to:

7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab

I also tried a cache-busting request:

curl -fL \
  -o /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gz \
  "https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz?cb=$(date +%s)"

sha256sum /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gz

This returned the same SHA-256:

7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab

I then checked the current live TiUP metadata.

The current TiKV manifest version referenced by snapshot.json is:

7194

I downloaded the live manifest:

curl -fsSL \
  "https://tiup-mirrors.pingcap.com/7194.tikv.json" \
  -o /tmp/tikv-meta.json

The current live remote metadata for linux/amd64 TiKV v8.5.5 reports:

{
  "sha256": "7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938",
  "sha512": "10544a2696f25c783ee330d4475803d91ff0f5643e6958c33b4047cc7aca9f14dedd86ad8a0d981b70135baa46f5431d81c08822ec653e477567d09dd1b19bec",
  "url": "/tikv-v8.5.5-linux-amd64.tar.gz",
  "length": 393510693,
  "released": "2026-08-12T00:07:17Z",
  "yanked": false
}

I compared this with my freshly updated local manifest at:

~/.tiup/manifests/tikv.json

The local manifest contains the exact same metadata and expected SHA-256:

7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938

Therefore, the current local TiUP metadata and the current remote TiUP metadata agree, but the artifact currently served by the TiUP mirror has a different checksum.

2. What did you expect to see?

I expected TiUP to download:

https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz

and for the downloaded artifact to match the SHA-256 published in the current signed TiKV manifest:

7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938

After successful checksum validation, I expected the tiup cluster scale-out operation to continue deploying TiKV and the other components to the new node.

3. What did you see instead?

The TiKV artifact currently served from the TiUP mirror hashes to:

7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab

while both the current remote manifest and my freshly refreshed local manifest expect:

7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938

As a result, every scale-out attempt fails during TiKV package validation:

Error: validation failed for /home/tidb/.tiup/storage/cluster/packages/tikv-v8.5.5-linux-amd64.tar.gz:
sha256 checksum mismatch,
expect: 7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938,
got: 7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab

The mismatch is reproducible when downloading the artifact directly with curl, including when using a unique cache-busting query parameter.

This appears to be a mismatch between the TiKV v8.5.5 artifact currently being served by tiup-mirrors.pingcap.com and the checksum published in the current TiUP component metadata.

I have not attempted to bypass or modify TiUP's checksum validation.

Example TiUP debug log from one failed attempt:

/home/tidb/.tiup/logs/tiup-cluster-debug-2026-08-18-19-13-05.log

4. What version of TiUP are you using (tiup --version)?

1.17.0 tiup
Go Version: go1.25.0
Git Ref: v1.17.0
GitHash: 9f6ebb7edc26ca0ba53b9f4a70de22388f865910

The cluster component is also v1.17.0:

tiup version 1.17.0 tiup
Go Version: go1.25.0
Git Ref: v1.17.0
GitHash: 9f6ebb7edc26ca0ba53b9f4a70de22388f865910

The TiDB cluster being scaled out is running:

TiDB cluster version: v8.5.5
OS/Architecture: linux/amd64
TLS: enabled

Start by comparing the live 7194.tikv.json metadata and ~/.tiup/manifests/tikv.json with the artifact served at tiup-mirrors.pingcap.com. Review the TiUP debug log at /home/tidb/.tiup/logs/tiup-cluster-debug-2026-08-18-19-13-05.log and the checksum validation path. Done means the served TiKV v8.5.5 package matches the published checksum and scale-out proceeds.