Harden privileged command paths and drop the committed binary

[TheLinuxITGuy]

This PR audits and hardens The Linux IT Guy Toolbox: identifier validation, safer privilege handling, secret hygiene, helper-script cleanup, removal of the committed binary, and CI.

The product behavior is unchanged at a high level (install/remove catalog apps, Administration tab, Arch/Debian/Fedora). Branding and the MIT license are unchanged. GitHub Releases are unchanged.

Follow-ups on this branch

• README Quick Start stays clone → cargo build --release → ./target/release/linux-it-guy-toolbox, with a rustup installer one-liner and Requirements wording that no longer mentions a Quick Start script.
• Catalog discovery now walks up from the executable (so target/release finds the repo-root apps_config.csv), also checks beside the helper scripts, then falls back to the current working directory. The Process Log lists the directories that were searched instead of implying ./apps_config.csv.
• Missing Flatpak no longer hangs the Process Log. The runner detects a missing flatpak binary, installs the flatpak package with sudo -S (pacman/apt/dnf), then continues the catalog Flatpak install. main.sh will not spawn flatpak unless it is on PATH.

Findings by severity

High

• Unvalidated catalog and CLI identifiers reached privileged package tools. CSV fields and main.sh arguments were passed through to pacman/apt/dnf/flatpak without checking that they looked like package names or Flatpak IDs. Values that look like flags or contain unexpected characters are now rejected in both Rust and bash.
• Every helper script ran as root. The GUI wrapped the entire task in sudo -S bash …, so Flatpak remotes, catalog scripts, and other user-level work inherited root. Scripts now run as the invoking user. sudo is cached once with sudo -S -v and used only where the scripts already call it.
• Committed ELF binary. An ~11MB stripped linux-it-guy-toolbox was tracked in git. It is removed; .gitignore already excluded rebuilds.

Medium

• Sudo password handling. The password was cloned into the worker, written as a formatted string, and process output was logged without redaction. It is now taken out of the UI struct, never placed on argv/env/disk, redacted from captured output, overwritten after use, and the sudo timestamp is dropped with sudo -k.
• Surprise system upgrades and repo edits. Installing one Arch package ran pacman -Syu --noconfirm and, for Steam, uncommented [multilib] in pacman.conf. Single-package installs now use pacman -S --needed only. Steam on Arch fails with a clear message if multilib is not already enabled. Full upgrades stay on the explicit Update System task.
• Helper scripts trusted cwd and unquoted globs. The VMware helper now uses set -euo pipefail, requires exactly one bundle under ~/Downloads, and uses explicit paths. Install scripts resolve SCRIPT_DIR and source shared validators.

Low

• Silent catalog failures. A missing or unreadable apps_config.csv produced an empty UI with no explanation. Load errors and skipped rows now appear in the process log.
• Package-manager detection used a shell. Detection now walks PATH with argv-only checks.
• No CI beyond FUNDING.yml.

Unsafe / FFI

No unsafe, transmute, FFI, or raw-pointer use was found in first-party code. Nothing to isolate.

What changed

• Split privileged logic out of src/main.rs into validate.rs, catalog.rs, runner.rs, and system.rs.
• Commands are argv arrays (bash + allowlisted script + validated flags). Admin scripts take no extra arguments.
• New toolbox-lib.sh validates package names, Flatpak IDs, labels, and actions. main.sh and install helpers source it.
• Flatpak install/remove from the catalog uses the user installation (no extra root). If flatpak is missing, the runner installs that package first via the existing sudo flow.
• README Quick Start builds with cargo build --release and points at GitHub Releases.
• Cargo.toml records rust-version = "1.92" (eframe 0.34.1’s MSRV).
• GitHub Actions: cargo fmt --check, clippy --all-targets -- -D warnings, cargo test, cargo audit.
• Tests cover identifier validation, CSV skipping, command construction, helper allowlists, secret redaction, bash/Rust validator agreement, catalog lookup order, and Flatpak bootstrap argv / ENOENT (38 tests).

Dependencies / cargo audit

Kept Cargo.lock. Bumped transitive webbrowser 1.2.1 → 1.2.2 and memmap2 0.9.10 → 0.9.11.

Remaining (ignored in .cargo/audit.toml, re-check when eframe/winit can move):

• RUSTSEC-2026-0194 / RUSTSEC-2026-0195 — quick-xml 0.39.2 via wayland-scanner 0.31.10 (eframe/winit). Scanner pins ^0.39. Moving to eframe 0.35+ raises MSRV (1.92+) and changes the UI stack. This parser is used at build time for Wayland protocol XML, not on toolbox catalog input.

Intentionally left

• --noconfirm / -y on GUI-driven package commands so the UI cannot hang on prompts. Full-system Arch upgrades remain only on Update System.
• VMware helper is still a standalone Mint/Ubuntu script (not in the Administration tab). It is hardened but still downloads a pinned host-modules archive.
• eframe 0.34.1 kept to avoid a UI-stack rewrite.
• Edition 2024 kept; rustc 1.92+ is required to build.
• No LICENSE file was added (crate metadata was already MIT).

Verification

Locally: cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, cargo test --all-targets (38 passed), cargo audit (remaining two advisories ignored as above). Helper scripts pass bash -n.

Please rebuild in ~/Documents/Toolbox and retry a Flatpak-only app on a machine without flatpak installed. The Process Log should show the package install, then Flathub, without sitting until a timeout.