Bug Report
Please answer these questions before submitting your issue. Thanks!
1. What did you do?
I attempted to scale out an existing TiDB v8.5.5 cluster using TiUP:
tiup cluster scale-out db-prod \
scale-out-db-prod-tidb-5.yml \
--user tidb \
-i ~/.ssh/id_ed25519
The new node scale-out topology includes PD, TiKV, TiDB, Prometheus, Grafana, and Alertmanager.
The topology validation succeeds and TiUP begins downloading the required components. All components download successfully except TiKV v8.5.5.
TiUP repeatedly fails with:
Error: validation failed for /home/tidb/.tiup/storage/cluster/packages/tikv-v8.5.5-linux-amd64.tar.gz:
sha256 checksum mismatch,
expect: 7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938,
got: 7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab
I reproduced the issue several times.
I then updated both TiUP itself and the cluster component:
tiup update --self
tiup update cluster --force
After updating:
TiUP: v1.17.0
TiUP cluster: v1.17.0
The scale-out still failed with the same expected and actual SHA-256 values.
I also downloaded the TiKV v8.5.5 artifact directly from the TiUP mirror:
curl -fL \
-o /tmp/tikv-v8.5.5-linux-amd64.tar.gz \
https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz
sha256sum /tmp/tikv-v8.5.5-linux-amd64.tar.gz
The downloaded file consistently hashes to:
7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab
I also tried a cache-busting request:
curl -fL \
-o /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gz \
"https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz?cb=$(date +%s)"
sha256sum /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gz
This returned the same SHA-256:
7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab
I then checked the current live TiUP metadata.
The current TiKV manifest version referenced by snapshot.json is:
I downloaded the live manifest:
curl -fsSL \
"https://tiup-mirrors.pingcap.com/7194.tikv.json" \
-o /tmp/tikv-meta.json
The current live remote metadata for linux/amd64 TiKV v8.5.5 reports:
{
"sha256": "7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938",
"sha512": "10544a2696f25c783ee330d4475803d91ff0f5643e6958c33b4047cc7aca9f14dedd86ad8a0d981b70135baa46f5431d81c08822ec653e477567d09dd1b19bec",
"url": "/tikv-v8.5.5-linux-amd64.tar.gz",
"length": 393510693,
"released": "2026-08-12T00:07:17Z",
"yanked": false
}I compared this with my freshly updated local manifest at:
~/.tiup/manifests/tikv.json
The local manifest contains the exact same metadata and expected SHA-256:
7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938
Therefore, the current local TiUP metadata and the current remote TiUP metadata agree, but the artifact currently served by the TiUP mirror has a different checksum.
2. What did you expect to see?
I expected TiUP to download:
https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz
and for the downloaded artifact to match the SHA-256 published in the current signed TiKV manifest:
7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938
After successful checksum validation, I expected the tiup cluster scale-out operation to continue deploying TiKV and the other components to the new node.
3. What did you see instead?
The TiKV artifact currently served from the TiUP mirror hashes to:
7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab
while both the current remote manifest and my freshly refreshed local manifest expect:
7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938
As a result, every scale-out attempt fails during TiKV package validation:
Error: validation failed for /home/tidb/.tiup/storage/cluster/packages/tikv-v8.5.5-linux-amd64.tar.gz:
sha256 checksum mismatch,
expect: 7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938,
got: 7ff04d6457beecc285b82b497800ec96e50b414ed4640c9081d5071df53d62ab
The mismatch is reproducible when downloading the artifact directly with curl, including when using a unique cache-busting query parameter.
This appears to be a mismatch between the TiKV v8.5.5 artifact currently being served by tiup-mirrors.pingcap.com and the checksum published in the current TiUP component metadata.
I have not attempted to bypass or modify TiUP's checksum validation.
Example TiUP debug log from one failed attempt:
/home/tidb/.tiup/logs/tiup-cluster-debug-2026-08-18-19-13-05.log
4. What version of TiUP are you using (tiup --version)?
1.17.0 tiup
Go Version: go1.25.0
Git Ref: v1.17.0
GitHash: 9f6ebb7edc26ca0ba53b9f4a70de22388f865910
The cluster component is also v1.17.0:
tiup version 1.17.0 tiup
Go Version: go1.25.0
Git Ref: v1.17.0
GitHash: 9f6ebb7edc26ca0ba53b9f4a70de22388f865910
The TiDB cluster being scaled out is running:
TiDB cluster version: v8.5.5
OS/Architecture: linux/amd64
TLS: enabled
Bug Report
Please answer these questions before submitting your issue. Thanks!
1. What did you do?
I attempted to scale out an existing TiDB v8.5.5 cluster using TiUP:
tiup cluster scale-out db-prod \ scale-out-db-prod-tidb-5.yml \ --user tidb \ -i ~/.ssh/id_ed25519The new node scale-out topology includes PD, TiKV, TiDB, Prometheus, Grafana, and Alertmanager.
The topology validation succeeds and TiUP begins downloading the required components. All components download successfully except TiKV v8.5.5.
TiUP repeatedly fails with:
I reproduced the issue several times.
I then updated both TiUP itself and the
clustercomponent:After updating:
The scale-out still failed with the same expected and actual SHA-256 values.
I also downloaded the TiKV v8.5.5 artifact directly from the TiUP mirror:
The downloaded file consistently hashes to:
I also tried a cache-busting request:
curl -fL \ -o /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gz \ "https://tiup-mirrors.pingcap.com/tikv-v8.5.5-linux-amd64.tar.gz?cb=$(date +%s)" sha256sum /tmp/tikv-v8.5.5-linux-amd64-cachebust.tar.gzThis returned the same SHA-256:
I then checked the current live TiUP metadata.
The current TiKV manifest version referenced by
snapshot.jsonis:I downloaded the live manifest:
curl -fsSL \ "https://tiup-mirrors.pingcap.com/7194.tikv.json" \ -o /tmp/tikv-meta.jsonThe current live remote metadata for
linux/amd64TiKV v8.5.5 reports:{ "sha256": "7d092a7d35a6bc4836e9577a3dcfbc19afd415f6ea2520c24838d32edfbb1938", "sha512": "10544a2696f25c783ee330d4475803d91ff0f5643e6958c33b4047cc7aca9f14dedd86ad8a0d981b70135baa46f5431d81c08822ec653e477567d09dd1b19bec", "url": "/tikv-v8.5.5-linux-amd64.tar.gz", "length": 393510693, "released": "2026-08-12T00:07:17Z", "yanked": false }I compared this with my freshly updated local manifest at:
The local manifest contains the exact same metadata and expected SHA-256:
Therefore, the current local TiUP metadata and the current remote TiUP metadata agree, but the artifact currently served by the TiUP mirror has a different checksum.
2. What did you expect to see?
I expected TiUP to download:
and for the downloaded artifact to match the SHA-256 published in the current signed TiKV manifest:
After successful checksum validation, I expected the
tiup cluster scale-outoperation to continue deploying TiKV and the other components to the new node.3. What did you see instead?
The TiKV artifact currently served from the TiUP mirror hashes to:
while both the current remote manifest and my freshly refreshed local manifest expect:
As a result, every scale-out attempt fails during TiKV package validation:
The mismatch is reproducible when downloading the artifact directly with
curl, including when using a unique cache-busting query parameter.This appears to be a mismatch between the TiKV v8.5.5 artifact currently being served by
tiup-mirrors.pingcap.comand the checksum published in the current TiUP component metadata.I have not attempted to bypass or modify TiUP's checksum validation.
Example TiUP debug log from one failed attempt:
4. What version of TiUP are you using (
tiup --version)?The
clustercomponent is also v1.17.0:The TiDB cluster being scaled out is running: