dumpling: pin MinIO CI downloads to GitHub releases

[D3Hunter]

What problem does this PR solve?

Issue Number: close #71290

Problem Summary:

The Dumpling workflow fails before building TiDB or running integration tests because the MinIO server download returns HTTP 410 Gone. The subsequent mc download endpoint is also retired, so both downloads need replacement. This affects unrelated PRs and cannot be resolved by retrying the unchanged workflow.

Example: https://github.com/pingcap/tidb/actions/runs/35178151909/job/105066506521

What changed and how does it work?

This is a small, temporary CI-only unblock confined to dumpling/install.sh:

• Download MinIO RELEASE.2025-09-07T16-13-09Z and mc RELEASE.2025-08-13T08-35-41Z from their official GitHub release assets instead of the retired download endpoints.
• Verify each binary against a pinned SHA-256 digest before granting executable permissions.
• Preserve Linux amd64/arm64 support, the bin/minio and bin/mc paths, and existing fail-fast behavior.

No TiDB code, S3 test behavior, workflow configuration, or other dependency downloads are changed.

The selected prebuilt MinIO server predates the fix for CVE-2025-62506. This is an isolated-test dependency stopgap, not a production upgrade recommendation. A durable replacement should use a validated, checksummed CI artifact built from patched source rather than treating this archived binary pin as a long-term solution.

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Validation used the Ready profile:

sh -n dumpling/install.sh
git diff --check
make lint

All checks passed. Downloaded all four actual GitHub release binaries using curl --fail --location, hashed them with shasum -a 256, and checked their ELF architectures with file. All digests match the pins in the installer for amd64 and arm64.

A local-only offline shell harness rejected the retired URL before the fix and passed after the fix for x86_64, aarch64, and arm64, checking pinned URLs, output paths, checksum selection, and verification-before-chmod ordering. That harness is not included in this PR.

The full Dumpling/S3 integration test was not run locally: the Docker daemon was unavailable, and the Linux binaries were not executed on the macOS host. Runtime compatibility still needs validation by the Dumpling CI matrix.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

Summary by CodeRabbit

• Security & Reliability
  • MinIO and MC installation now uses pinned release versions.
  • Downloaded binaries are verified with SHA-256 checksums on supported architectures.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Advanced

Run ID: bbd933f8-30c7-4a6b-883e-8b9b6256d9bb

📥 Commits

Reviewing files that changed from the base of the PR and between 02e5d7b and f600323.

📒 Files selected for processing (1)

• dumpling/install.sh

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The installer now downloads pinned MinIO and MC release binaries from GitHub. It verifies both binaries with architecture-specific SHA256 checksums before making them executable.

Changes

MinIO dependency downloads

Layer / File(s)	Summary
Pinned downloads and checksum verification dumpling/install.sh	The installer defines MinIO and MC release checksums for amd64 and arm64. It downloads pinned GitHub release binaries and verifies both files with sha256sum -c -.

Priority: ➖ Normal

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Merge Risk: ⚪ Minimal · up to f6003

The pinned downloads, checksums, architecture handling, and downstream binary paths are consistent; the change is ready to merge.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely describes the main change: pinning Dumpling CI MinIO downloads to GitHub releases. It follows the repository's package-prefix format.
Description check	✅ Passed	The description includes the issue reference, problem summary, implementation details, test results, side effects, documentation impact, release note, and limitations. It clearly states that full inte…
Linked Issues check	✅ Passed	For issue #71290, dumpling/install.sh replaces both retired dl.min.io and dl.minio.io URLs with pinned GitHub release assets for MinIO and mc. The script defines SHA-256 values for amd64 and…
Out of Scope Changes check	✅ Passed	The diff changes only dumpling/install.sh. The changes update the two failing MinIO downloads, add architecture-specific checksum verification, and preserve the existing output paths. No TiDB code, …
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1…

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks each binary bright
With hashes lined up just right
Old paths rest beyond the gate
Pinned releases arrive in state
MinIO and MC pass the test
Then hop onward with the rest}

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 72.4146%. Comparing base (e80270e) to head (f600323).
⚠️ Report is 5 commits behind head on master.

Additional details and impacted files

@@               Coverage Diff                @@
##             master     #71291        +/-   ##
================================================
- Coverage   76.3029%   72.4146%   -3.8883%     
================================================
  Files          2041       2104        +63     
  Lines        555347     595418     +40071     
================================================
+ Hits         423746     431170      +7424     
- Misses       130701     163007     +32306     
- Partials        900       1241       +341     

Flag	Coverage Δ
integration	40.7045% <ø> (+1.0369%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	58.8716% <ø> (ø)
parser	∅ <ø> (∅)
br	46.5900% <ø> (-16.1209%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[ti-chi-bot]

@coderabbitai[bot]: adding LGTM is restricted to approvers and reviewers in OWNERS files.

Details

In response to this:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: coderabbitai[bot], joechenrh, YangKeao

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Details

Needs approval from an approver in each of these files:

• dumpling/OWNERS [joechenrh]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[ti-chi-bot]

[LGTM Timeline notifier]

Timeline:

• 2026-09-17 04:26:19.520128917 +0000 UTC m=+265625.457786511: ☑️ agreed by joechenrh.
• 2026-09-17 04:37:24.999105274 +0000 UTC m=+266290.936762867: ☑️ agreed by YangKeao.