BR v8.5.7 log backup 写入华为 OBS 失败，报 PutObject XAmzContentSHA256Mismatch；同配置在 BR v7.5.7 正常

🪐 TiDB 技术问题
1

复现命令：
tiup br:v8.5.7 log start --task-name=vendorptl-tidb-logbackup --pd 10.203.0.10:2379 --storage "s3://db-archive/tidb-backup/log-backup/vendorptl-tidb/?access-key=***&secret-access-key=***&endpoint=https://obs.ap-southeast-3.myhuaweicloud.com&force-path-style=false"
log start 启动报错日志：
[2026/08/24 00:46:20.505 +00:00] [INFO] [collector.go:77] [“log start failed summary”] [total-ranges=1] [ranges-succeed=0] [ranges-failed=1] [unit-name=“log start”] [error=“operation error S3: PutObject, https response error StatusCode: 400, RequestID: 000001A0313B89498006D210C237B9B0, HostID: MOCKQjIxQTYxQzZDMDAwMDAxMzQwMzFCRTgwMDUyOTNBQUFBQUFBQWJiYmJiYmJi, api error XAmzContentSHA256Mismatch: The provided ‘x-amz-content-sha256’ header does not match what was computed.”] [errorVerbose=“operation error S3: PutObject, https response error StatusCode: 400, RequestID: 000001A0313B89498006D210C237B9B0, HostID: MOCKQjIxQTYxQzZDMDAwMDAxMzQwMzFCRTgwMDUyOTNBQUFBQUFBQWJiYmJiYmJi, api error XAmzContentSHA256Mismatch: The provided ‘x-amz-content-sha256’ header does not match what was computed.\ngithub.com/pingcap/errors.Trace\n\t/root/go/pkg/mod/github.com/pingcap/errors@v0.11.5-0.20250523034308-74f78ae071ee/juju_adaptor.go:15\ngithub.com/pingcap/tidb/br/pkg/storage.(*S3Storage).WriteFile\n\t/workspace/source/tidb/br/pkg/storage/s3.go:730\ngithub.com/pingcap/tidb/br/pkg/backup.(*Client).SetLockFile\n\t/workspace/source/tidb/br/pkg/backup/client.go:499\ngithub.com/pingcap/tidb/br/pkg/task.(*streamMgr).setLock\n\t/workspace/source/tidb/br/pkg/task/stream.go:391\ngithub.com/pingcap/tidb/br/pkg/task.RunStreamStart\n\t/workspace/source/tidb/br/pkg/task/stream.go:652\ngithub.com/pingcap/tidb/br/pkg/task.RunStreamCommand\n\t/workspace/source/tidb/br/pkg/task/stream.go:549\nmain.streamCommand\n\t/workspace/source/tidb/br/cmd/br/stream.go:232\nmain.newStreamStartCommand.func1\n\t/workspace/source/tidb/br/cmd/br/stream.go:70\ngithub.com/spf13/cobra.(*Command).execute\n\t/root/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:985\ngithub.com/spf13/cobra.(*Command).ExecuteC\n\t/root/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1117\ngithub.com/spf13/cobra.(*Command).Execute\n\t/root/go/pkg/mod/github.com/spf13/cobra@v1.8.1/command.go:1041\nmain.main\n\t/workspace/source/tidb/br/cmd/br/main.go:42\nruntime.main\n\t/root/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.8.linux-amd64/src/runtime/proc.go:285\nruntime.goexit\n\t/root/go/pkg/mod/golang.org/toolchain@v0.0.1-go1.25.8.linux-amd64/src/runtime/asm_amd64.s:1693”]
Error: operation error S3: PutObject, https response error StatusCode: 400, RequestID: 000001A0313B89498006D210C237B9B0, HostID: MOCKQjIxQTYxQzZDMDAwMDAxMzQwMzFCRTgwMDUyOTNBQUFBQUFBQWJiYmJiYmJi, api error XAmzContentSHA256Mismatch: The provided ‘x-amz-content-sha256’ header does not match what was computed.
/tmp/br.log.2026-08-24T00.46.20Z 日志：
[2026/08/24 00:46:20.467 +00:00] [WARN] [s3.go:1394] [“failed to request s3, checking whether we can retry”] [error="https response error StatusCode: 404, RequestID: 000001A0313B892DB8272290BCB8E1F1, HostID: 36AAAQAAEAABAAAQAAEAABAAAQAAEAABAAAaI=AAAAAAAAAAAAAAAAAAAAAAAAAA, NotFound: "] [retry=false]

[2026/08/24 00:46:20.476 +00:00] [INFO] [stream.go:448] [“set stream safePoint”] [safePoint=“{ID=br-4c767c86-c485-459a-bf94-8de20c44082d,TTL=30m0s,BackupTime="2026-08-24 00:46:20.434 +0000 UTC",BackupTS=468590888336490507}”]

[2026/08/24 00:46:20.504 +00:00] [WARN] [s3.go:1394] [“failed to request s3, checking whether we can retry”] [error=“https response error StatusCode: 400, RequestID: 000001A0313B89498006D210C237B9B0, HostID: MOCKQjIxQTYxQzZDMDAwMDAxMzQwMzFCRTgwMDUyOTNBQUFBQUFBQWJiYmJiYmJi, api error XAmzContentSHA256Mismatch: The provided ‘x-amz-content-sha256’ header does not match what was computed.”] [retry=false]

对比结果：
相同 OBS 配置下：

  • tiup br:v7.5.7 log start 正常
  • tiup br:v8.5.7 log start 失败，测试br:v8.5.6均失败

预期结果：
同样的 OBS S3 兼容配置在 BR v8.5.7 也应能够正常启动 log backup，或至少需要明确说明是否存在已知兼容限制。

诉求：
请协助确认：

  1. 这是否是 BR v8.5.7 与 Huawei OBS 的已知兼容问题；
  2. 是否与 AWS SDK v2 / checksum / payload signing 行为变化有关；
  3. 是否有可用的参数、配置或补丁可以规避；
  4. 如果是已知问题，预计在哪个版本修复。
2

PingCAP 在 v8.5.x 这一档升级了 aws-sdk-go-v2，把 payload 校验行为从 “when_required” 改成 “always”，撞上了华为云 OBS 的兼容性差异。

试环境变量方案

既然你确认 v8.5.7 失败，最值得在 v8.5.7 上验证一下环境变量是否生效——这决定了能不能不降级继续用新 BR：

bash

export AWS_REQUEST_CHECKSUM_CALCULATION=when_required
export AWS_RESPONSE_CHECKSUM_VALIDATION=when_required

./tiup br:v8.5.7 log start \
  --task-name=vendorptl-tidb-logbackup \
  --pd 10.203.0.10:2379 \
  --storage "s3://db-archive/tidb-backup/log-backup/vendorptl-tidb/?access-key=***&secret-access-key=***&endpoi
3

我也遇到过这个问题，还没解决

4

这个报错是BR v8.5.7在S3兼容存储上计算payload hash的方式变了，OBS不认。v7.5.7没这问题说明是新版本改了签名逻辑。

5

8.5.7 的 S3 客户端校验和头与华为 OBS 对不上，所以 PutObject 报 XAmzContentSHA256Mismatch。可先继续用 7.5.7 做日志备份，或查该版本是否支持关闭校验/改签名方式。endpoint 和 path-style 要与 OBS 文档一致，单改密钥解决不了。

6

谢谢，马上去试试验证下

7

这是 BR 升级 AWS SDK v2 带来的 S3 兼容适配 bug，并非请求签名错误，更换密钥无效，可临时降级至 v7.5.7 规避。

8

怎么样，问题解决了吗