From 1a2b78e9db07accc61060c840b0403d496e29887 Mon Sep 17 00:00:00 2001
From: Asad Iqbal <asad.dsoft@gmail.com>
Date: Fri, 6 Mar 2026 23:20:51 +0500
Subject: [PATCH 1/3] Refactor k3d installation process in setup-linux.sh

- Changed the installation method for k3d to download the script to a temporary file before executing, enhancing security and reliability.
- Added a check to ensure the k3d binary is executable after installation, improving usability.
---
 scripts/lib/setup-linux.sh | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/scripts/lib/setup-linux.sh b/scripts/lib/setup-linux.sh
index 40be029f..e54fba54 100755
--- a/scripts/lib/setup-linux.sh
+++ b/scripts/lib/setup-linux.sh
@@ -101,9 +101,21 @@ install_k3d() {
     return 0
   fi
 
-  if ! spin_cmd "Installing system tools…" bash -c 'set -euo pipefail; curl -fsSL --tlsv1.2 https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh | bash'; then
+  local k3d_script
+  k3d_script="$(mktemp)"
+  retry 3 5 curl -fsSL $CURL_SECURE \
+    https://raw.githubusercontent.com/k3d-io/k3d/main/install.sh -o "$k3d_script"
+  chmod +x "$k3d_script"
+
+  if ! spin_cmd "Installing system tools…" sudo bash "$k3d_script"; then
+    rm -f "$k3d_script"
     error "System tool installation failed. See the install log for details."
   fi
+  rm -f "$k3d_script"
+
+  if [[ -f /usr/local/bin/k3d && ! -x /usr/local/bin/k3d ]]; then
+    sudo chmod +x /usr/local/bin/k3d
+  fi
 
   if ! has k3d; then
     error "System tool installation completed but not found on PATH."

From 26f171af3b497075eb270d873e5fd717d1b0cdb2 Mon Sep 17 00:00:00 2001
From: Asad Iqbal <asad.dsoft@gmail.com>
Date: Fri, 6 Mar 2026 23:26:50 +0500
Subject: [PATCH 2/3] Remove redundant executable check for k3d in
 setup-linux.sh

- Eliminated the check for setting executable permissions on the k3d binary, as it is no longer necessary with the updated installation method.
- This change streamlines the installation process and reduces potential errors related to file permissions.
---
 scripts/lib/setup-linux.sh | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/scripts/lib/setup-linux.sh b/scripts/lib/setup-linux.sh
index e54fba54..3102fd05 100755
--- a/scripts/lib/setup-linux.sh
+++ b/scripts/lib/setup-linux.sh
@@ -113,10 +113,6 @@ install_k3d() {
   fi
   rm -f "$k3d_script"
 
-  if [[ -f /usr/local/bin/k3d && ! -x /usr/local/bin/k3d ]]; then
-    sudo chmod +x /usr/local/bin/k3d
-  fi
-
   if ! has k3d; then
     error "System tool installation completed but not found on PATH."
   fi

From 69c6692fb6a9fc57e3fd7308fbcf096c8f376c4e Mon Sep 17 00:00:00 2001
From: Asad Iqbal <asad.dsoft@gmail.com>
Date: Fri, 6 Mar 2026 23:30:41 +0500
Subject: [PATCH 3/3] Relax umask setting during tool installations in
 setup-linux.sh

- Adjusted umask to 022 temporarily while installing system tools to ensure proper executable permissions for binaries in /usr/local/bin/.
- Restored the original umask after installations to maintain security settings.
---
 scripts/lib/setup-linux.sh | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/scripts/lib/setup-linux.sh b/scripts/lib/setup-linux.sh
index 3102fd05..a3dc8f4e 100755
--- a/scripts/lib/setup-linux.sh
+++ b/scripts/lib/setup-linux.sh
@@ -166,8 +166,16 @@ install_linux() {
   setup_pm
   install_docker_engine
   install_system_deps
+
+  # umask 077 (set in common.sh) would make binaries in /usr/local/bin/
+  # executable only by root — relax to 022 for system tool installs
+  local _saved_umask
+  _saved_umask=$(umask)
+  umask 022
   install_kubectl
   install_k3d
   install_helm
+  umask "$_saved_umask"
+
   dispatch_gpu_setup
 }