A predictable temporary path in /tmp is a symlink attack and a collision between two concurrent runs, and both are avoided by three lines in a specific order.
#!/usr/bin/env bash
set -euo pipefail
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT # AFTER mktemp, not before
curl -fsS "$url" -o "$tmp/release.tar.gz"Registering the trap before mktemp runs against an unset variable, and under set -u that is an error inside the trap handler where it is hardest to see. trap ... EXIT fires on normal exit, on an error under set -e and on most signals, which covers everything except kill -9. Quoting the variable inside the trap matters as much as anywhere else and is easy to forget because the trap is a string.