Harden privileged command paths and drop the committed binary

.cargo/audit.toml

@@ -0,0 +1,11 @@
+# Remaining advisories are transitive through eframe 0.34 / winit / wayland-scanner.
+# They are documented in the security cleanup PR. Do not ignore new findings.
+[advisories]
+ignore = [
+    # quick-xml 0.39.2 via wayland-scanner 0.31.10 (build-time XML protocol parser).
+    # wayland-scanner pins ^0.39; upgrading eframe to pick up a newer scanner also
+    # raises MSRV past 1.92 and changes the UI stack. The crate is not used on
+    # untrusted user input in this app.
+    "RUSTSEC-2026-0194",
+    "RUSTSEC-2026-0195",
+]

.github/workflows/ci.yml

@@ -0,0 +1,53 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+env:
+  CARGO_TERM_COLOR: always
+
+jobs:
+  rust:
+    name: fmt, clippy, test, audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+
+      - name: Install GUI build dependencies
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y --no-install-recommends \
+            libxcb-render0-dev \
+            libxcb-shape0-dev \
+            libxcb-xfixes0-dev \
+            libxkbcommon-dev \
+            libssl-dev \
+            pkg-config
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: rustfmt
+        run: cargo fmt --check
+
+      - name: clippy
+        run: cargo clippy --all-targets --all-features -- -D warnings
+
+      - name: test
+        run: cargo test --all-targets
+
+      - name: Install cargo-audit
+        uses: taiki-e/install-action@v2
+        with:
+          tool: cargo-audit
+
+      - name: cargo audit
+        run: cargo audit

Cargo.toml

@@ -2,6 +2,7 @@
 name = "linux-it-guy-toolbox"
 version = "0.1.0"
 edition = "2024"
+rust-version = "1.92"
 description = "A modern Rust desktop toolbox for Linux app installs and admin tasks."
 license = "MIT"
 

README.md

@@ -23,7 +23,19 @@ A fast Rust desktop app for installing/removing apps and running Linux admin tas
 ## 🚀 Quick Start
 
 ```bash
-git clone https://github.com/TheLinuxITGuy/Toolbox.git && cd Toolbox && chmod +x linux-it-guy-toolbox && ./linux-it-guy-toolbox
+git clone https://github.com/TheLinuxITGuy/Toolbox.git
+cd Toolbox
+cargo build --release
+./target/release/linux-it-guy-toolbox
+```
+
+Prebuilt binaries are published on the [GitHub Releases](https://github.com/TheLinuxITGuy/Toolbox/releases) page.
+
+If your distribution's `rustc`/`cargo` is older than 1.92:
+
+```bash
+curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh
+. "$HOME/.cargo/env"
 ```
 
 ## 📖 Usage
@@ -36,7 +48,7 @@ git clone https://github.com/TheLinuxITGuy/Toolbox.git && cd Toolbox && chmod +x
 
 ## 🔧 Requirements
 
-**If the Quick Start script runs into any issues, your distribution might be missing a few foundational packages.**
+**If `cargo build --release` fails, your distribution might be missing git or GUI build packages (xcb, xkbcommon, OpenSSL, and similar).**
 
 ### Arch
 ```bash

VMware Player Fix/vmware-fix.sh

@@ -1,46 +1,49 @@
-#!/bin/bash
-
-echo -e "\033[0;32m====================================="
-echo -e "\033[1;32mThe Linux IT Guy - Linux Mint Scripts"
-echo -e "\033[1;32mVMware Player Fix"
-echo -e "\033[0;32m=====================================\033[0m"
-
-# Change permissions to make the bundle executable
-chmod u+x ~/Downloads/VMware-*.bundle
-
-# Check if VMware Player bundle exists in ~/Downloads
-if [ ! -f ~/Downloads/VMware-*.bundle ]; then
-    echo "Run the script from ~/Downloads/"
+#!/usr/bin/env bash
+set -euo pipefail
+
+printf '=====================================\n'
+printf 'The Linux IT Guy - Linux Mint Scripts\n'
+printf 'VMware Player Fix\n'
+printf '=====================================\n'
+
+DOWNLOADS="${HOME}/Downloads"
+MODULE_VERSION="workstation-17.5.0"
+MODULE_URL="https://github.com/mkubecek/vmware-host-modules/archive/${MODULE_VERSION}.tar.gz"
+MODULE_ARCHIVE="${DOWNLOADS}/${MODULE_VERSION}.tar.gz"
+MODULE_DIR="${DOWNLOADS}/vmware-host-modules-${MODULE_VERSION}"
+
+if [[ ! -d "$DOWNLOADS" ]]; then
+    echo "Expected ${DOWNLOADS} to exist and contain the VMware Player bundle." >&2
     exit 1
 fi
 
-# Run the VMware Player installer
-sudo ~/Downloads/VMware-*.bundle
-
-# Change directory to ~/Downloads
-cd ~/Downloads 
-
-# Download the VMware host modules
-wget https://github.com/mkubecek/vmware-host-modules/archive/workstation-17.5.0.tar.gz
+shopt -s nullglob
+bundles=("${DOWNLOADS}"/VMware-*.bundle)
+if [[ ${#bundles[@]} -ne 1 ]]; then
+    echo "Place exactly one VMware-*.bundle file in ${DOWNLOADS} and rerun this script." >&2
+    exit 1
+fi
 
-# Extract the tarball
-tar -xzf workstation-17.5.0.tar.gz
+bundle=${bundles[0]}
+chmod u+x "$bundle"
+sudo "$bundle"
 
-# Change directory to the extracted folder
-cd vmware-host-modules-workstation-17.5.0/
+wget -O "$MODULE_ARCHIVE" "$MODULE_URL"
+tar -xzf "$MODULE_ARCHIVE" -C "$DOWNLOADS"
 
-# Create tarballs for vmmon and vmnet
-tar -cf vmmon.tar vmmon-only/
-tar -cf vmnet.tar vmnet-only/
+if [[ ! -d "$MODULE_DIR/vmmon-only" || ! -d "$MODULE_DIR/vmnet-only" ]]; then
+    echo "VMware host modules archive did not contain the expected directories." >&2
+    exit 1
+fi
 
-# Copy the tarballs to the VMware modules source directory
-sudo cp -v vmmon.tar vmnet.tar  /usr/lib/vmware/modules/source/
+tar -cf "${MODULE_DIR}/vmmon.tar" -C "$MODULE_DIR" vmmon-only
+tar -cf "${MODULE_DIR}/vmnet.tar" -C "$MODULE_DIR" vmnet-only
 
-# Run VMware modconfig to install all modules
+sudo cp -v "${MODULE_DIR}/vmmon.tar" "${MODULE_DIR}/vmnet.tar" /usr/lib/vmware/modules/source/
 sudo vmware-modconfig --console --install-all
 
-echo -e "\033[0;32m====================================="
-echo -e "\033[1;32mThe Linux IT Guy - Linux Mint Scripts"
-echo -e "\033[1;32mVMware Player Fix - Complete"
-echo -e "\033[1;32mFire up Super->Administration->VMware Player to complete the installation."
-echo -e "\033[0;32m=====================================\033[0m"
+printf '=====================================\n'
+printf 'The Linux IT Guy - Linux Mint Scripts\n'
+printf 'VMware Player Fix - Complete\n'
+printf 'Fire up Super->Administration->VMware Player to complete the installation.\n'
+printf '=====================================\n'

install-fastfetch.sh

@@ -1,25 +1,30 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=toolbox-lib.sh
+source "${SCRIPT_DIR}/toolbox-lib.sh"
+
 printf '=====================================\n'
 printf 'The Linux IT Guy Toolbox\n'
 printf 'Installing fastfetch\n'
 printf '=====================================\n'
 
+require_package_name "fastfetch"
+
 if command -v apt-get >/dev/null 2>&1; then
     if command -v nala >/dev/null 2>&1; then
         sudo nala update
         sudo nala install -y fastfetch
         sudo nala install -f -y
     else
         sudo apt-get update
-        sudo apt-get install -y fastfetch
+        sudo apt-get install -y -- fastfetch
     fi
 elif command -v pacman >/dev/null 2>&1; then
-    sudo pacman -Syu --noconfirm
-    sudo pacman -S --noconfirm fastfetch
+    sudo pacman -S --needed --noconfirm -- fastfetch
 elif command -v dnf >/dev/null 2>&1; then
-    sudo dnf install -y fastfetch
+    sudo dnf install -y -- fastfetch
 else
     echo "Unsupported distribution."
     exit 1

install-nala.sh

@@ -1,6 +1,10 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=toolbox-lib.sh
+source "${SCRIPT_DIR}/toolbox-lib.sh"
+
 printf '=====================================\n'
 printf 'The Linux IT Guy Toolbox\n'
 printf 'Configure nala mirrors\n'
@@ -11,10 +15,12 @@ if ! command -v apt-get >/dev/null 2>&1; then
     exit 1
 fi
 
+require_package_name "nala"
+
 if ! command -v nala >/dev/null 2>&1; then
     echo "Installing nala..."
     sudo apt-get update
-    sudo apt-get install -y nala
+    sudo apt-get install -y -- nala
 fi
 
 sudo nala fetch --auto

install-powertop.sh

@@ -1,25 +1,30 @@
 #!/usr/bin/env bash
 set -euo pipefail
 
+SCRIPT_DIR=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")" && pwd)
+# shellcheck source=toolbox-lib.sh
+source "${SCRIPT_DIR}/toolbox-lib.sh"
+
 printf '=====================================\n'
 printf 'The Linux IT Guy Toolbox\n'
 printf 'Installing powertop\n'
 printf '=====================================\n'
 
+require_package_name "powertop"
+
 if command -v apt-get >/dev/null 2>&1; then
     if command -v nala >/dev/null 2>&1; then
         sudo nala update
         sudo nala install -y powertop
         sudo nala install -f -y
     else
         sudo apt-get update
-        sudo apt-get install -y powertop
+        sudo apt-get install -y -- powertop
     fi
 elif command -v pacman >/dev/null 2>&1; then
-    sudo pacman -Syu --noconfirm
-    sudo pacman -S --noconfirm powertop
+    sudo pacman -S --needed --noconfirm -- powertop
 elif command -v dnf >/dev/null 2>&1; then
-    sudo dnf install -y powertop
+    sudo dnf install -y -- powertop
 else
     echo "Unsupported distribution."
     exit 1