From ff571e9138f5ba43d460ad25a2c1a86685ba27f5 Mon Sep 17 00:00:00 2001
From: Preston Hunt <me@prestonhunt.com>
Date: Fri, 28 Aug 2026 12:25:17 -0700
Subject: [PATCH 1/2] downloads: stage in mktemp dirs rather than predictable
 /tmp paths

install_rofi_greenclip and create_gruvbox_terminal_profile downloaded to
fixed paths in the world-writable /tmp and then executed or installed
the result -- create_gruvbox_terminal_profile ran 'bash /tmp/create-gruvbox'
directly. Another local user can pre-create or replace those paths
between the download and the use.

'mktemp -d' gives a 0700 directory owned by the invoking user, which
closes the window. Clean up afterwards so repeated runs do not litter.

install_ripgrep has the same pattern; it is dropped entirely on the
ripgrep-from-apt branch rather than fixed here.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---
 setup | 14 ++++++++++----
 1 file changed, 10 insertions(+), 4 deletions(-)

diff --git a/setup b/setup
index df939ed..65dc51d 100755
--- a/setup
+++ b/setup
@@ -334,8 +334,11 @@ install_fd() {
 
 install_rofi_greenclip() {
     install_package rofi
-    get_internet_file "https://github.com/erebe/greenclip/releases/download/v4.2/greenclip" /tmp/greenclip
-    sudo install /tmp/greenclip /usr/local/bin
+    local tmp
+    tmp=$(mktemp -d)
+    get_internet_file "https://github.com/erebe/greenclip/releases/download/v4.2/greenclip" "$tmp/greenclip"
+    sudo install "$tmp/greenclip" /usr/local/bin
+    rm -rf "$tmp"
 }
 
 install_kitty_terminfo() {
@@ -546,8 +549,11 @@ auto_start_terminal() {
 }
 
 create_gruvbox_terminal_profile() {
-    get_prestobuntu_file "create-gruvbox" /tmp/create-gruvbox
-    bash /tmp/create-gruvbox
+    local tmp
+    tmp=$(mktemp -d)
+    get_prestobuntu_file "create-gruvbox" "$tmp/create-gruvbox"
+    bash "$tmp/create-gruvbox"
+    rm -rf "$tmp"
 }
 
 _systemctl() { sudo systemctl "$@" ; }

From 41c8f7b2b9c48debaacfff444e9c46ebfb58d366 Mon Sep 17 00:00:00 2001
From: Preston Hunt <me@prestonhunt.com>
Date: Fri, 28 Aug 2026 14:08:55 -0700
Subject: [PATCH 2/2] Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
---
 setup | 12 +++++++-----
 1 file changed, 7 insertions(+), 5 deletions(-)

diff --git a/setup b/setup
index 65dc51d..d4ad886 100755
--- a/setup
+++ b/setup
@@ -334,11 +334,13 @@ install_fd() {
 
 install_rofi_greenclip() {
     install_package rofi
-    local tmp
-    tmp=$(mktemp -d)
-    get_internet_file "https://github.com/erebe/greenclip/releases/download/v4.2/greenclip" "$tmp/greenclip"
-    sudo install "$tmp/greenclip" /usr/local/bin
-    rm -rf "$tmp"
+    (
+        local tmp
+        tmp=$(mktemp -d)
+        trap 'rm -rf -- "$tmp"' EXIT
+        get_internet_file "https://github.com/erebe/greenclip/releases/download/v4.2/greenclip" "$tmp/greenclip"
+        sudo install "$tmp/greenclip" /usr/local/bin
+    )
 }
 
 install_kitty_terminfo() {