use safer tempfile, interact more easily with call_command, and set execute permissions on .sh files