Refactor SRI script to use local variables and safe trap expansion

Author: myoshi2891

calc_sri_fix.sh

@@ -3,9 +3,10 @@
 set -euo pipefail
 
 calculate_sri() {
-    url="$1"
+    local url="$1"
+    local temp_file
     temp_file=$(mktemp)
-    trap 'rm -f "$temp_file"' RETURN
+    trap "rm -f \"$temp_file\"" RETURN
 
     # curl options: -f (fail on HTTP error), -S (show error), -s (silent equivalent), -L (follow redirects)
     if ! curl -fS -sL "$url" -o "$temp_file"; then
@@ -19,6 +20,7 @@ calculate_sri() {
         return 1
     fi
 
+    local hash
     hash=$(openssl dgst -sha384 -binary < "$temp_file" | openssl base64 -A)
     echo "$url sha384-$hash"
     rm -f "$temp_file"