fix: add better security guarentees

Author: richards-ensono

.github/copilot-instructions.md

@@ -61,6 +61,7 @@ ansible-playbook scripts/ansible/playbook.yml -c local
 
 - Edit source `dot_*` files and `*.tmpl` templates. Examples: `dot_bashrc`, `dot_config/nvim/init.lua.tmpl`.
 - Avoid editing rendered/user files on remote machines; those are managed by chezmoi and will be overwritten.
+- **Avoid allowing Ansible to modify dotfiles (e.g. via `lineinfile` or `blockinfile`) as these are managed by chezmoi.** If a tool requires configuration in a dotfile, add the logic to the `dot_` source file itself (using templates or conditionals if necessary) rather than having Ansible patch it post-creation.
 - If you change package lists or provisioning logic, update `scripts/ansible/playbook.yml` and corresponding `roles/` implementations.
 - Under no circumstances should unsigned commits be created, if GPG signing fails then defer to the user to resolve.
 

scripts/ansible/roles/foundry/tasks/main.yml

@@ -16,12 +16,25 @@
     path: "{{ ansible_env.HOME }}/.foundry/bin/foundryup"
   register: foundryup_stat
 
-- name: Download and install Foundry
-  shell: "curl -L https://foundry.paradigm.xyz | bash"
+- name: Download Foundry installer
+  get_url:
+    url: "https://foundry.paradigm.xyz"
+    dest: "/tmp/foundry_install.sh"
+    mode: '0755'
+  when: not foundryup_stat.stat.exists
+
+- name: Run Foundry installer
+  command: "/bin/bash /tmp/foundry_install.sh"
   args:
     creates: "{{ ansible_env.HOME }}/.foundry/bin/foundryup"
   when: not foundryup_stat.stat.exists
 
+- name: Remove Foundry installer
+  file:
+    path: "/tmp/foundry_install.sh"
+    state: absent
+  when: not foundryup_stat.stat.exists
+
 - name: Initialize Foundry
   shell: "{{ ansible_env.HOME }}/.foundry/bin/foundryup"
   args:

scripts/ansible/roles/nvm/defaults/main.yml

@@ -0,0 +1,4 @@
+---
+nvm_version: "v0.40.3"
+nvm_install_url: "https://raw.githubusercontent.com/nvm-sh/nvm/{{ nvm_version }}/install.sh"
+nvm_install_checksum: "sha256:2d8359a64a3cb07c02389ad88ceecd43f2fa469c06104f92f98df5b6f315275f"

scripts/ansible/roles/nvm/tasks/main.yml

@@ -1,6 +1,18 @@
 ---
+- name: Download nvm installer
+  ansible.builtin.get_url:
+    url: "{{ nvm_install_url }}"
+    dest: "/tmp/nvm_install.sh"
+    mode: '0755'
+    checksum: "{{ nvm_install_checksum }}"
+
 - name: Install nvm
   ansible.builtin.shell: >
-    curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.3/install.sh | bash
+    /tmp/nvm_install.sh
   args:
     creates: "{{ ansible_facts['env'].HOME }}/.nvm/nvm.sh"
+
+- name: Remove nvm installer
+  ansible.builtin.file:
+    path: "/tmp/nvm_install.sh"
+    state: absent

scripts/ansible/roles/oh-my-posh/defaults/main.yml

@@ -7,7 +7,14 @@ oh_my_posh_arch_map:
   aarch64: "arm64"
   riscv64: "riscv64"
 
+oh_my_posh_version: "v29.0.1"
+
+oh_my_posh_checksums:
+  amd64: "sha256:57088003d36ab5089de45c0ff3d6a713fabeff4668c165c7ac50042ed8c9abaf"
+  # Add other architectures' checksums here when needed
+
 oh_my_posh_arch: "{{ oh_my_posh_arch_map[ansible_architecture] | default('amd64') }}"
+oh_my_posh_checksum: "{{ oh_my_posh_checksums[oh_my_posh_arch] | default(omit) }}"
 oh_my_posh_supported_architectures:
   - x86_64
   - aarch64

scripts/ansible/roles/oh-my-posh/tasks/main.yml

@@ -16,9 +16,10 @@
 
 - name: Download Oh My Posh binary
   ansible.builtin.get_url:
-    url: "https://github.com/JanDeDobbeleer/oh-my-posh/releases/latest/download/posh-linux-{{ oh_my_posh_arch }}"
+    url: "https://github.com/JanDeDobbeleer/oh-my-posh/releases/download/{{ oh_my_posh_version }}/posh-linux-{{ oh_my_posh_arch }}"
     dest: "{{ oh_my_posh_bin_path }}"
     mode: '0755'
+    checksum: "{{ oh_my_posh_checksum | default(omit) }}"
   become: true
 
 - name: Verify Oh My Posh installation

scripts/ansible/roles/tmux/defaults/main.yml

@@ -0,0 +1,3 @@
+---
+tmux_version: "3.6a"
+tmux_checksum: "sha256:b6d8d9c76585db8ef5fa00d4931902fa4b8cbe8166f528f44fc403961a3f3759"

scripts/ansible/roles/tmux/tasks/main.yml

@@ -17,31 +17,17 @@
     state: present
   when: ansible_facts['os_family'] == "Debian"
 
-- name: Get latest tmux release info
-  uri:
-    url: "https://api.github.com/repos/tmux/tmux/releases/latest"
-    return_content: true
-  register: github_response
-
-- name: Extract latest tarball URL
-  set_fact:
-    tmux_tarball_url: "{{ github_response.json.tarball_url }}"
-    tmux_version: "{{ github_response.json.tag_name }}"
-
-- name: Debug - Show latest tmux version
-  debug:
-    msg: "Latest tmux version: {{ tmux_version }}"
-
 - name: Create source directory
   file:
     path: "{{ tmux_src_dir }}"
     state: directory
     mode: "0755"
 
-- name: Download latest tmux source code
+- name: Download tmux source code
   get_url:
-    url: "{{ tmux_tarball_url }}"
+    url: "https://github.com/tmux/tmux/releases/download/{{ tmux_version }}/tmux-{{ tmux_version }}.tar.gz"
     dest: "{{ tmux_src_dir }}/tmux.tar.gz"
+    checksum: "{{ tmux_checksum }}"
 
 - name: Extract tmux source
   ansible.builtin.unarchive:

scripts/ansible/roles/uv/defaults/main.yml

@@ -0,0 +1,6 @@
+---
+uv_version: "0.9.22"
+uv_platform: "x86_64-unknown-linux-gnu"
+uv_download_url: "https://github.com/astral-sh/uv/releases/download/{{ uv_version }}/uv-{{ uv_platform }}.tar.gz"
+uv_checksum: "sha256:e170aed70ac0225feee612e855d3a57ae73c61ffb22c7e52c3fd33b87c286508"
+uv_install_dir: "{{ ansible_env.HOME }}/.local/bin"

scripts/ansible/roles/uv/tasks/main.yml

@@ -5,34 +5,53 @@
   ignore_errors: true
   changed_when: false
 
-- name: Install uv using the official standalone installer
-  shell: "curl -fsSL {{ uv_install_script_url }} | sh"
-  register: uv_install_result
-  when: uv_check.rc != 0
-  environment:
-    UV_INSTALL_DIR: "{{ ansible_env.HOME }}/.local/bin"
-  args:
-    executable: /bin/bash
-
-- name: Add uv shell completion for zsh
-  lineinfile:
-    path: "{{ ansible_env.HOME }}/.zshrc"
-    line: 'eval "$(uv generate-shell-completion zsh)"'
-    create: true
-  when: uv_check.rc == 0 or uv_install_result.changed
-
-- name: Add uv shell completion for bash
-  lineinfile:
-    path: "{{ ansible_env.HOME }}/.bashrc"
-    line: 'eval "$(uv generate-shell-completion bash)"'
-    create: true
-  when: uv_check.rc == 0 or uv_install_result.changed
+- name: Create temporary directory for uv download
+  tempfile:
+    state: directory
+    suffix: uv_download
+  register: uv_temp_dir
+  when: uv_check.rc != 0 or uv_version not in uv_check.stdout
+
+- name: Download uv tarball
+  get_url:
+    url: "{{ uv_download_url }}"
+    dest: "{{ uv_temp_dir.path }}/uv.tar.gz"
+    checksum: "{{ uv_checksum }}"
+    mode: '0644'
+  when: uv_check.rc != 0 or uv_version not in uv_check.stdout
+
+- name: Extract uv tarball
+  unarchive:
+    src: "{{ uv_temp_dir.path }}/uv.tar.gz"
+    dest: "{{ uv_temp_dir.path }}"
+    remote_src: true
+  when: uv_check.rc != 0 or uv_version not in uv_check.stdout
+
+- name: Install uv binary
+  copy:
+    src: "{{ uv_temp_dir.path }}/uv-{{ uv_platform }}/uv"
+    dest: "{{ uv_install_dir }}/uv"
+    mode: '0755'
+  when: uv_check.rc != 0 or uv_version not in uv_check.stdout
+
+- name: Install uvx binary
+  copy:
+    src: "{{ uv_temp_dir.path }}/uv-{{ uv_platform }}/uvx"
+    dest: "{{ uv_install_dir }}/uvx"
+    mode: '0755'
+  when: uv_check.rc != 0 or uv_version not in uv_check.stdout
 
 - name: Verify uv installation
-  command: "{{ ansible_env.HOME }}/.local/bin/uv --version"
+  command: "{{ uv_install_dir }}/uv --version"
   register: uv_verify
   changed_when: false
 
+- name: Clean up temporary directory
+  file:
+    path: "{{ uv_temp_dir.path }}"
+    state: absent
+  when: uv_temp_dir.path is defined
+
 - name: Show uv version
   debug:
     msg: "uv installed: {{ uv_verify.stdout }}"