I had an interesting problem today. I had uploaded a new version of the MDSF plugin to http://plugins.atlassian.com (PAC) but when I tried to install it from within JIRA using the plugin manager, I got the errors "Check that the file is a valid plugin" and "not a valid plugin: Could not open the file as a jar". The odd thing was the plugin jar file could be downloaded just fine from PAC and installed with no errors.
In this case the actual plugin jar file is stored as an attachment in the MDSF space of https://studio.plugins.atlassian.com and that was the root of the problem. I eventually tracked the bug down to a permission problem where anonymous users such as JIRA's plugin manager couldn't access the attachment. Once I set the View permission for Anonymous users in Space Admin everything worked nicely.
I think the reason it worked fine from within PAC is that I had saved the userid and password for SPAC, so I never saw a login screen and mistakenly assumed that no-one else did. There was also the question of whether it mattered that the attachment used an 'http' or 'https' connection - I think it made no difference.