mktemp -d and a trap, in every script that writes anything

A predictable temporary path in /tmp is a symlink attack and a collision between two concurrent runs, and both are avoided by the same three lines.

#!/usr/bin/env bash
set -euo pipefail

tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT

curl -fsS "$url" -o "$tmp/release.tar.gz"
tar -xzf "$tmp/release.tar.gz" -C "$tmp/extract"

Registering the trap immediately after creating the directory is what makes it correct — a trap set before mktemp runs against an unset variable, and under set -u that is an error inside the trap handler where it is hardest to see. trap ... EXIT fires on normal exit, on an error under set -e, and on most signals, which covers everything except kill -9. Quoting the variable inside the trap matters as much as anywhere else.