Address audit findings: WSL config correctness, safer bootstrap installs, portable wallpaper script runtime, reproducible pytest deps

SETUP.md

@@ -49,7 +49,12 @@ gpg --import /path/to/backup/private.key
 
 ```bash
 # Install Homebrew first if not present
-/bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+install_script="$(mktemp /tmp/homebrew-install.XXXXXX.sh)"
+curl --fail --show-error --location --proto '=https' --tlsv1.2 \
+  -o "$install_script" \
+  https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh
+/bin/bash "$install_script"
+rm -f "$install_script"
 
 # Install packages (also runs automatically via chezmoi run_onchange)
 brew bundle --file=~/Brewfile.linux

dot_local/bin/executable_bootstrap

@@ -1,6 +1,10 @@
 #!/bin/bash
 # Dotfiles Bootstrap Script
-# Run on a fresh Mac: curl -sL https://raw.githubusercontent.com/KevinTCoughlin/dotfiles/main/bootstrap.sh | bash
+# Run on a fresh Mac:
+#   curl --fail --show-error --location --proto '=https' --tlsv1.2 \
+#     -o /tmp/bootstrap.sh \
+#     https://raw.githubusercontent.com/KevinTCoughlin/dotfiles/main/bootstrap.sh
+#   bash /tmp/bootstrap.sh
 
 set -e
 
@@ -26,7 +30,18 @@ fi
 # ─────────────────────────────────────────────────────────────────────────────
 if ! command -v brew &>/dev/null; then
     echo "[2/6] Installing Homebrew..."
-    /bin/bash -c "$(curl -fsSL https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh)"
+    install_script="$(mktemp -t homebrew-install.XXXXXX)"
+    if ! curl --fail --show-error --location --proto '=https' --tlsv1.2 \
+      -o "$install_script" \
+      https://raw.githubusercontent.com/Homebrew/install/HEAD/install.sh; then
+      rm -f "$install_script"
+      exit 1
+    fi
+    if ! /bin/bash "$install_script"; then
+      rm -f "$install_script"
+      exit 1
+    fi
+    rm -f "$install_script"
     eval "$(/opt/homebrew/bin/brew shellenv)"
 else
     echo "[2/6] Homebrew already installed"

dot_local/bin/private_executable_stylize-wallpaper

@@ -1,4 +1,4 @@
-#!/home/bazzite/.local/share/venvs/stylize/bin/python
+#!/usr/bin/env python3
 """Apply artistic style transfer to the current wallpaper using SD Turbo img2img."""
 
 import argparse

dot_wslconfig

@@ -1,16 +1,14 @@
 [wsl2]
 # Allocate more memory for WSL2 (half of 32GB system)
 memory=16GB
-# Use all available processors
-processors=22
+# Match current 12-core machine profile
+processors=12
 # Faster swap
 swap=8GB
 # Enable GPU passthrough (default but explicit)
 gpuSupport=true
 # Nested virtualization
 nestedVirtualization=true
-# Faster disk I/O
-autoMemoryReclaim=dropcache
 
 [experimental]
 # Sparse VHD for faster disk

tests/README.md

@@ -16,7 +16,9 @@ Automated tests for the scripts in this dotfiles repository.
 npm install -g bats
 
 # pytest (Python tests)
-pip install pytest pytest-asyncio websockets
+python3 -m venv .venv
+source .venv/bin/activate
+python -m pip install -r tests/requirements-dev.txt
 ```
 
 ## Running the tests

tests/requirements-dev.txt

@@ -0,0 +1,3 @@
+pytest>=8,<9
+pytest-asyncio>=0.23,<1
+websockets>=12,<16

tests/test_obs.py

@@ -2,7 +2,7 @@
 Tests for dot_local/bin/executable_obs
 
 Run with: pytest tests/test_obs.py -v
-Requires: pip install pytest pytest-asyncio websockets
+Requires: python -m pip install -r tests/requirements-dev.txt
 """
 
 import asyncio