@stubbedev/atlassian-mcp 0.5.26 → 0.5.27

package/README.md

@@ -241,12 +241,13 @@ Clients start the server from their own working directory, so use absolute paths
 
 #### Binary cache
 
-npm and Composer download each release's binary once per user, into
-`$XDG_CACHE_HOME/atlassian-mcp/<version>/` (by default `~/.cache` on Linux and FreeBSD,
-`~/Library/Caches` on macOS, `%LOCALAPPDATA%` on Windows), and hardlink it into every
-install, or copy it where the install is on another filesystem. Further projects and git
-worktrees on the same version install without downloading anything. Delete old version
-directories to reclaim their space; installs keep their own link.
+npm and Composer download each release's binary once per user, verify it against the
+release's `checksums.txt`, and keep it in `$XDG_CACHE_HOME/atlassian-mcp/<version>/` (by
+default `~/.cache` on Linux and FreeBSD, `~/Library/Caches` on macOS, `%LOCALAPPDATA%` on
+Windows), and hardlink it into every install, or copy it where the install is on another
+filesystem. Further projects and git worktrees on the same version install without
+downloading anything. Delete old version directories to reclaim their space; installs keep
+their own link.
 
 #### Standalone binary (Go, Nix, release download)
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@stubbedev/atlassian-mcp",
-  "version": "0.5.26",
+  "version": "0.5.27",
   "description": "MCP server for self-hosted Jira and Bitbucket (Go, distributed as a prebuilt binary)",
   "license": "MIT",
   "type": "module",

package/scripts/download.mjs

@@ -1,9 +1,7 @@
-import { randomBytes } from 'node:crypto';
-import { createWriteStream, readFileSync } from 'node:fs';
-import { chmod, copyFile, link, mkdir, rename, rm, stat } from 'node:fs/promises';
+import { createHash, randomBytes } from 'node:crypto';
+import { readFileSync } from 'node:fs';
+import { chmod, copyFile, link, mkdir, rename, rm, stat, writeFile } from 'node:fs/promises';
 import { dirname, join } from 'node:path';
-import { Readable } from 'node:stream';
-import { pipeline } from 'node:stream/promises';
 import { fileURLToPath } from 'node:url';
 
 const NAME = 'atlassian-mcp';
@@ -54,21 +52,7 @@ function asset() {
 }
 
 async function fetchInto(cached) {
-  const url = `https://github.com/${REPO}/releases/download/v${pkg.version}/${asset()}`;
-  const res = await fetch(url, { redirect: 'follow' });
-  if (!res.ok || !res.body) {
-    throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
-  }
-  const tmp = await tmpBeside(cached);
-  try {
-    await pipeline(Readable.fromWeb(res.body), createWriteStream(tmp));
-    if ((await stat(tmp)).size === 0) {
-      throw new Error(`Failed to download ${url}: empty response`);
-    }
-    await commit(tmp, cached);
-  } finally {
-    await rm(tmp, { force: true });
-  }
+  await store(await fetchRelease(`v${pkg.version}`, asset()), cached);
 }
 
 function cacheDir() {
@@ -115,3 +99,34 @@ async function tmpBeside(file) {
   await mkdir(dirname(file), { recursive: true });
   return `${file}.${randomBytes(6).toString('hex')}.tmp`;
 }
+
+async function fetchRelease(tag, asset) {
+  const base = `https://github.com/${REPO}/releases/download/${tag}`;
+  const sums = (await get(`${base}/checksums.txt`)).toString('utf8');
+  const want = sums
+    .split('\n')
+    .map((line) => line.trim().split(/\s+\*?/))
+    .find(([, file]) => file === asset)?.[0];
+  if (!want) throw new Error(`${asset} is not listed in ${tag} checksums.txt`);
+  const data = await get(`${base}/${asset}`);
+  if (createHash('sha256').update(data).digest('hex') !== want) {
+    throw new Error(`Checksum mismatch for ${asset} from ${tag}`);
+  }
+  return data;
+}
+
+async function get(url) {
+  const res = await fetch(url, { redirect: 'follow' });
+  if (!res.ok) throw new Error(`Failed to download ${url}: HTTP ${res.status}`);
+  return Buffer.from(await res.arrayBuffer());
+}
+
+async function store(data, cached) {
+  const tmp = await tmpBeside(cached);
+  try {
+    await writeFile(tmp, data);
+    await commit(tmp, cached);
+  } finally {
+    await rm(tmp, { force: true });
+  }
+}