Repository navigation
Verify the prebuilt backend against its sha256 sidecar, refuse plain-http mirrors, and run npm through node on Windows - #61
Merged
Conversation
…http mirrors and run npm shell-free on Windows - downloadPrebuilt fetches backend-<version>.tar.gz.sha256 beside the archive (the framework attaches it from the release after 1.148.0 on), compares the download's digest and discards a mismatch with the previous build untouched; a release without the sidecar unpacks as before and the build log says it was unverified. - A2UI5_MCP_PREBUILT_URL must be https: - a plain http: URL off the loopback address is refused before anything is fetched unless the new A2UI5_MCP_PREBUILT_INSECURE=1 is set. tar unpacks with --no-same-owner. - npmCommand runs npm on Windows as `node npm-cli.js`, so no argument reaches cmd.exe; the quoted npm.cmd path remains only for a Node installation without npm-cli.js. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Qid1F6VFxWyQLPvqsr1woq
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Review of 2026-10-22.
downloadPrebuiltfetches<asset>.sha256(abap2UI5 ships it from the next release on) and verifies the archive beforermSync/untar; a mismatch keeps the previous build. Without a sidecar it logs one "unverified" line and continues, so existing releases keep working.A2UI5_MCP_PREBUILT_URLrefuses a plainhttp:URL unless the host is a loopback address orA2UI5_MCP_PREBUILT_INSECURE=1is set.tar -xzf … --no-same-owner.npm-backend.mjs: on Windows npm runs asnode npm-cli.jswithout a shell; the quotednpm.cmd+shell:truepath remains only when nonpm-cli.jsis found.npm run check: 567 pass, 0 fail.Generated by Claude Code