From b0d1bba1ebf69a2dea1470dc3b78a2a692bc1daf Mon Sep 17 00:00:00 2001
From: Brad Stein <Brad.Stein@gmail.com>
Date: Thu, 30 Apr 2026 12:07:31 -0300
Subject: [PATCH] release: ship lesavka 0.16.2

---
 Cargo.lock                                      | 6 +++---
 client/Cargo.toml                               | 2 +-
 common/Cargo.toml                               | 2 +-
 scripts/install/client.sh                       | 2 +-
 server/Cargo.toml                               | 2 +-
 testing/tests/client_install_script_contract.rs | 4 ++++
 6 files changed, 11 insertions(+), 7 deletions(-)

diff --git a/Cargo.lock b/Cargo.lock
index ee43994..e5b3f54 100644
--- a/Cargo.lock
+++ b/Cargo.lock
@@ -1652,7 +1652,7 @@ checksum = "09edd9e8b54e49e587e4f6295a7d29c3ea94d469cb40ab8ca70b288248a81db2"
 
 [[package]]
 name = "lesavka_client"
-version = "0.16.1"
+version = "0.16.2"
 dependencies = [
  "anyhow",
  "async-stream",
@@ -1686,7 +1686,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_common"
-version = "0.16.1"
+version = "0.16.2"
 dependencies = [
  "anyhow",
  "base64",
@@ -1698,7 +1698,7 @@ dependencies = [
 
 [[package]]
 name = "lesavka_server"
-version = "0.16.1"
+version = "0.16.2"
 dependencies = [
  "anyhow",
  "base64",
diff --git a/client/Cargo.toml b/client/Cargo.toml
index f312687..254811f 100644
--- a/client/Cargo.toml
+++ b/client/Cargo.toml
@@ -4,7 +4,7 @@ path                    = "src/main.rs"
 
 [package]
 name                    = "lesavka_client"
-version                 = "0.16.1"
+version                 = "0.16.2"
 edition                 = "2024"
 
 [dependencies]
diff --git a/common/Cargo.toml b/common/Cargo.toml
index 59d2fed..cdeecd7 100644
--- a/common/Cargo.toml
+++ b/common/Cargo.toml
@@ -1,6 +1,6 @@
 [package]
 name                    = "lesavka_common"
-version                 = "0.16.1"
+version                 = "0.16.2"
 edition                 = "2024"
 build                   = "build.rs"
 
diff --git a/scripts/install/client.sh b/scripts/install/client.sh
index 4b9d29a..1821ae6 100755
--- a/scripts/install/client.sh
+++ b/scripts/install/client.sh
@@ -113,7 +113,7 @@ fetch_client_pki_bundle() {
   local host=${CLIENT_PKI_SSH_SOURCE%%:*}
   local remote_path=${CLIENT_PKI_SSH_SOURCE#*:}
   local tmp_bundle
-  tmp_bundle=$(mktemp --suffix=.tar.gz)
+  tmp_bundle=$(run_as_user mktemp --tmpdir="$TMPDIR" lesavka-client-pki.XXXXXX.tar.gz)
   if run_as_user scp -q -o BatchMode=yes -o ConnectTimeout=5 \
     "$host:$remote_path" "$tmp_bundle" >/dev/null 2>&1; then
     printf '%s\n' "$tmp_bundle"
diff --git a/server/Cargo.toml b/server/Cargo.toml
index c4abce3..4d96022 100644
--- a/server/Cargo.toml
+++ b/server/Cargo.toml
@@ -10,7 +10,7 @@ bench                   = false
 
 [package]
 name                    = "lesavka_server"
-version                 = "0.16.1"
+version                 = "0.16.2"
 edition                 = "2024"
 autobins                = false
 
diff --git a/testing/tests/client_install_script_contract.rs b/testing/tests/client_install_script_contract.rs
index 6145f1f..48a46fb 100644
--- a/testing/tests/client_install_script_contract.rs
+++ b/testing/tests/client_install_script_contract.rs
@@ -42,4 +42,8 @@ fn client_install_accepts_server_generated_tls_bundle() {
         CLIENT_INSTALL.contains("scp -q -o BatchMode=yes"),
         "client installer should auto-fetch the server enrollment bundle without hanging"
     );
+    assert!(
+        CLIENT_INSTALL.contains("run_as_user mktemp"),
+        "auto-fetch destination should be owned by the user who runs scp"
+    );
 }