Create a temp directory with an exit trap

#!/usr/bin/env bash
# Create a private temp directory and always remove it on exit.
set -euo pipefail

src="${1:?usage: $0 FILE}"
workdir="$(mktemp -d "${TMPDIR:-/tmp}/stage.XXXXXXXX")"

cleanup() {
  rm -rf -- "$workdir"
}
trap cleanup EXIT

cp -- "$src" "$workdir/payload"
checksum="$(sha256sum -- "$workdir/payload" | cut -d' ' -f1)"
# sha256sum ships with GNU coreutils; on macOS use: shasum -a 256
printf 'staged %s in %s\n' "$checksum" "$workdir"