From 9c05cd36c0885324c6f3bce52ccc23d20323d2ca Mon Sep 17 00:00:00 2001
From: Tim Waugh <twaugh@redhat.com>
Date: Thu, 22 Oct 2026 14:30:37 +0100
Subject: [PATCH] gnulib-update.sh: avoid /tmp

Cloning into a predictable path in /tmp let another user on a
multi-user system pre-create that directory with their own
gnulib-tool, which would then be executed (the failed clone did not
stop the script, and the rm -rf afterwards removed the evidence).

Clone into gnulib-tmp/ inside the source tree instead, fail hard on
errors, and clean up on exit.

Assisted-by: GLM 5.3
---
 .gitignore       |  3 +++
 gnulib-update.sh | 10 +++++++---
 2 files changed, 10 insertions(+), 3 deletions(-)

diff --git a/.gitignore b/.gitignore
index 5af7afae..0586e0de 100644
--- a/.gitignore
+++ b/.gitignore
@@ -85,5 +85,8 @@ doc/svndiffview.1
 *~
 *.swp
 
+# gnulib-update.sh checkout
+/gnulib-tmp/
+
 # Tarballs
 patchutils-*.tar.?z*
diff --git a/gnulib-update.sh b/gnulib-update.sh
index f32196b1..d55265b8 100755
--- a/gnulib-update.sh
+++ b/gnulib-update.sh
@@ -2,8 +2,12 @@
 # Script to update gnulib modules
 # Run this when you want to update to newer gnulib versions
 
+set -e
+cd "$(dirname "$0")"
+GNULIB_DIR=gnulib-tmp
+trap 'rm -rf "$GNULIB_DIR"' EXIT
+
 echo "Updating gnulib modules..."
-git clone --depth 1 https://github.com/coreutils/gnulib.git /tmp/gnulib-update
-/tmp/gnulib-update/gnulib-tool --update
-rm -rf /tmp/gnulib-update
+git clone --depth 1 https://github.com/coreutils/gnulib.git "$GNULIB_DIR"
+"$GNULIB_DIR/gnulib-tool" --update
 echo "Gnulib updated. Please test and commit."