diff --git a/base/.local/share/buddy-up/includes/utils.sh b/base/.local/share/buddy-up/includes/utils.sh
new file mode 100644
index 0000000..c386bd3
--- /dev/null
+++ b/base/.local/share/buddy-up/includes/utils.sh
@@ -0,0 +1,102 @@
+#ft=sh
+
+bail () {
+    >&2 echo "ERROR: $1"
+    exit 1
+}
+
+must_be_root () {
+    if [ "$(id --user)" != 0 ]; then
+        bail "must run as root"
+    fi
+}
+
+get_os () {
+    case $(uname -s) in
+        Linux*)     echo linux;;
+        Darwin*)    echo darwin;;
+        *)          bail "unsupported os: $(uname -s)" ;;
+    esac
+}
+
+get_arch () {
+    case $(uname -m) in
+        x86_64*)    echo amd64;;
+        amd64*)     echo amd64;;
+        *)          bail "unsupported architecture: $(uname -m)" ;;
+    esac
+}
+
+set_current_link () {
+    prefix="${1}"
+    version="${2}"
+    sudo="${3}"
+    current="${prefix}/current"
+    if [ -s "${current}" ] ; then
+        $sudo unlink "${current}"
+    fi
+    $sudo ln --symbolic --relative "${prefix}/${version}" "${current}"
+}
+
+extract_tarball () {
+    url="${1}"
+    dest="${2}"
+    args="${3}"
+    sudo="${4}"
+
+    if [ -d "${dest}" ]; then
+        return
+    fi
+    $sudo mkdir -p "${dest}"
+
+    tmp_dir="$(mktemp --directory)"
+    tarball=${tmp_dir}/release.tar.gz
+    curl --silent --location --output "${tarball}" "${url}"
+    # shellcheck disable=SC2086
+    $sudo tar xf "${tarball}" --directory "${dest}" ${args}
+    rm -rf "${tmp_dir}"
+}
+
+relative_path() {
+    # both $1 and $2 are absolute paths beginning with /
+    # $1 must be a canonical path; that is none of its directory
+    # components may be ".", ".." or a symbolic link
+    #
+    # returns relative path to $2/$target from $1/$src
+    src=$1
+    target=$2
+
+    common_part=$src
+    result=
+
+    while [ "${target#"$common_part"}" = "$target" ]; do
+        # no match, means that candidate common part is not correct
+        # go up one level (reduce common part)
+        common_part=$(dirname "$common_part")
+        # and record that we went back, with correct / handling
+        if [ -z "$result" ]; then
+            result=..
+        else
+            result=../$result
+        fi
+    done
+
+    if [ "$common_part" = / ]; then
+        # special case for root (no common path)
+        result=$result/
+    fi
+
+    # since we now have identified the common part,
+    # compute the non-common part
+    forward_part=${target#"$common_part"}
+
+    # and now stick all parts together
+    if [ -n "$result" ] && [ -n "$forward_part" ]; then
+        result=$result$forward_part
+    elif [ -n "$forward_part" ]; then
+        # extra slash removal
+        result=${forward_part#?}
+    fi
+
+    printf '%s' "$result"
+}
diff --git a/base/.zshrc b/base/.zshrc
index 7f5f679..5fe723a 100644
--- a/base/.zshrc
+++ b/base/.zshrc
@@ -9,7 +9,7 @@ if [[ -d "${XDG_CONFIG_HOME}/zsh/env.d" ]]; then
     done
 fi
 
-if [ -d "${XDG_CONFIG_HOME}/zsh/zshrc.d" ]; then
+if [[ -d "${XDG_CONFIG_HOME}/zsh/zshrc.d" ]]; then
     for file in "${XDG_CONFIG_HOME}"/zsh/zshrc.d/*.zsh(N); do
         if [ -r "$file" ]; then
             #shellcheck disable=1090
diff --git a/go/.config/profile/profile.d/go.sh b/go/.config/profile/profile.d/go.sh
index 4a9dcf4..ae12dba 100644
--- a/go/.config/profile/profile.d/go.sh
+++ b/go/.config/profile/profile.d/go.sh
@@ -1,6 +1,9 @@
-if [ -d /usr/local/go/bin ] ; then
-    PATH="${PATH}:/usr/local/go/bin"
+__APPS_GO_PATH=/usr/local/apps/golang/current/bin
+if [ -d "${__APPS_GO_PATH}" ] && ! echo "${PATH}" | grep -q ${__APPS_GO_PATH} ; then
+    PATH="$__APPS_GO_PATH:${PATH}"
 fi
-if [ -d "${HOME}/go/bin" ] ; then
+unset __APPS_GO_PATH
+
+if [ -d "${HOME}/go/bin" ] && ! echo "$PATH" | grep -q "${HOME}/go/bin" ; then
     PATH="${PATH}:${HOME}/go/bin"
 fi
diff --git a/go/.local/bin/install-go-system b/go/.local/bin/install-go-system
new file mode 100755
index 0000000..883b212
--- /dev/null
+++ b/go/.local/bin/install-go-system
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -e
+
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
+
+VERSION=${VERSION:-1.16.2}
+DEST=/usr/local/apps/golang
+URL=https://dl.google.com/go/go${VERSION}.$(get_os)-$(get_arch).tar.gz
+DEST_BIN=$DEST/current/bin
+
+extract_tarball "${URL}" "${DEST}/${VERSION}" "--strip-components 1" sudo
+set_current_link "${DEST}" "${VERSION}" sudo
+
+if [[ ! -f /etc/profile.d/go-path.sh ]]; then
+    cat <<EOF | sudo tee /etc/profile.d/go-path.sh
+if [ -d "$DEST_BIN" ] && ! echo "\$PATH" | grep -q "$DEST_BIN" ; then
+    export PATH=$DEST_BIN:\$PATH
+fi
+EOF
+fi
diff --git a/go/.local/bin/install-gomock-home b/go/.local/bin/install-gomock-home
new file mode 100755
index 0000000..220e6db
--- /dev/null
+++ b/go/.local/bin/install-gomock-home
@@ -0,0 +1,22 @@
+#!/usr/bin/env bash
+
+set -e
+
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
+
+VERSION=${VERSION:-1.5.0}
+DEST="${XDG_DATA_HOME}/buddy-up/apps/gomock"
+URL=https://github.com/golang/mock/releases/download/v${VERSION}/mock_${VERSION}_$(get_os)_$(get_arch).tar.gz
+
+extract_tarball "${URL}" "${DEST}/${VERSION}" "--strip-components 1"
+set_current_link "${DEST}" "${VERSION}"
+
+if [[ -L "$XDG_BIN_HOME/mockgen" ]]; then
+    unlink "$XDG_BIN_HOME/mockgen"
+fi
+
+cd "$XDG_BIN_HOME"
+ln --symbolic \
+    "$(relative_path "${XDG_BIN_HOME}" "${XDG_DATA_HOME}/buddy-up/apps/gomock/current/mockgen")" \
+    mockgen
diff --git a/install-scripts/.local/bin/install-etcd-system b/install-scripts/.local/bin/install-etcd-system
index a4b78c5..145fb13 100755
--- a/install-scripts/.local/bin/install-etcd-system
+++ b/install-scripts/.local/bin/install-etcd-system
@@ -2,63 +2,23 @@
 
 set -e
 
-VERSION=${VERSION:-v3.4.4}
-
-PREFIX_DIR=/usr/local
-BIN_DIR=${PREFIX_DIR}/bin
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
 
 APP=etcd
-
-APP_PREFIX_DIR=${PREFIX_DIR}/${APP}
-APP_DEST_DIR=${APP_PREFIX_DIR}/${VERSION}
-APP_CURRENT=${APP_PREFIX_DIR}/current
-
-OS=
-if [[ $OSTYPE =~ linux ]]; then
-    OS=linux
-elif [[  $OSTYPE =~ darwin ]]; then
-    OS=darwin
-else
-    echo unknown os: "$OSTYPE"
-    exit 1
-fi
-
-ARCH=
-if [[ $(uname -m) == x86_64 ]]; then
-    ARCH=amd64
-else
-    echo arch not yet supported: "$(uname -m)"
-    exit 1
-fi
-URL=https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-${OS}-${ARCH}.tar.gz
-
-[[ -d ${APP_DEST_DIR} ]] || sudo mkdir -p "${APP_DEST_DIR}"
-
-TMP_DIR=
-if [[ ! -d ${APP_DEST_DIR}/bin ]]; then
-    TMP_DIR=$(mktemp --directory)
-    DEST_FILE=$TMP_DIR/${APP}.tar.gz
-    echo downloading "${APP}" "${VERSION}" to temp directory "${TMP_DIR}"
-    curl --silent --location --output "${DEST_FILE}" "${URL}"
-
-    sudo tar xf "${DEST_FILE}" --directory "${APP_DEST_DIR}" --strip-components 1
-    sudo chown --recursive root:root "${APP_DEST_DIR}"
-else
-    echo "${APP}" "${VERSION}" already installed
-fi
-
-cd ${APP_PREFIX_DIR}
-[[ -s current ]] && sudo unlink current
-sudo ln --symbolic "${APP_DEST_DIR}" current
-echo current version set to "${VERSION}"
-
-cd ${BIN_DIR}
-# shellcheck disable=SC2044
-for bin in $(find ${APP_CURRENT}/ -maxdepth 1 -executable -type f -exec basename {} \;); do
-    [[ -s $bin ]] || sudo ln --symbolic "${APP_CURRENT}/$bin"
+VERSION=${VERSION:-v3.4.15}
+APPS_DIR=/usr/local/apps/${APP}
+URL=https://github.com/etcd-io/etcd/releases/download/${VERSION}/etcd-${VERSION}-$(get_os)-$(get_arch).tar
+
+extract_tarball "${URL}" "${APPS_DIR}/${VERSION}" "--strip-components 1" sudo
+set_current_link "${APPS_DIR}" "${VERSION}" sudo
+
+apps=$(find ${APPS_DIR}/current/ -maxdepth 1 -executable -type f -exec basename {} \;)
+cd /usr/local/bin
+for bin in $apps; do
+    if [[ ! -s $bin ]]; then
+        sudo ln --symbolic \
+            "$(relative_path "/usr/local/bin" "${APPS_DIR}/current/${bin}")" \
+            "${bin}"
+    fi
 done
-
-if [[ $TMP_DIR != "" ]]; then
-    rm -rf "${TMP_DIR}"
-    echo removed up temp directory "${TMP_DIR}"
-fi
diff --git a/install-scripts/.local/bin/install-go-system b/install-scripts/.local/bin/install-go-system
deleted file mode 100755
index 1ed050f..0000000
--- a/install-scripts/.local/bin/install-go-system
+++ /dev/null
@@ -1,59 +0,0 @@
-#!/usr/bin/env bash
-
-set -e
-
-GO_VERSION=${GO_VERSION:-1.15.2}
-
-PREFIX_DIR=/usr/local
-#BIN_DIR=${PREFIX_DIR}/bin
-
-GO_PREFIX_DIR=${PREFIX_DIR}/golang
-GO_DEST_DIR=${GO_PREFIX_DIR}/${GO_VERSION}
-
-OS=
-if [[ $OSTYPE =~ linux ]]; then
-    OS=linux
-elif [[  $OSTYPE =~ darwin ]]; then
-    OS=darwin
-else
-    echo unknown os: "$OSTYPE"
-    exit 1
-fi
-
-ARCH=
-if [[ $(uname -m) == x86_64 ]]; then
-    ARCH=amd64
-else
-    echo arch not yet supported: "$(uname -m)"
-    exit 1
-fi
-
-[[ -d ${GO_DEST_DIR} ]] || sudo mkdir -p "${GO_DEST_DIR}"
-
-TMP_DIR=
-if [[ ! -d ${GO_DEST_DIR}/bin ]]; then
-    TMP_DIR=$(mktemp --directory)
-    DEST_FILE=$TMP_DIR/go.tar.gz
-    URL=https://dl.google.com/go/go${GO_VERSION}.${OS}-${ARCH}.tar.gz
-    echo downloading go "$GO_VERSION" to temp directory "${TMP_DIR}"
-    curl --silent --output "${DEST_FILE}" "${URL}"
-
-    sudo tar xf "${DEST_FILE}" --directory "${GO_DEST_DIR}" --strip-components 1
-    sudo chown --recursive root:root "${GO_DEST_DIR}"
-else
-    echo go "$GO_VERSION" already installed
-fi
-
-cd ${PREFIX_DIR}
-[[ -s go ]] && sudo unlink go
-sudo ln --symbolic "${GO_DEST_DIR}" go
-echo current version set to "${GO_VERSION}"
-
-[[ -f /etc/profile.d/go-path.sh ]] \
-    || echo "export PATH=\$PATH:/usr/local/go/bin" \
-    | sudo tee /etc/profile.d/go-path.sh
-
-if [[ $TMP_DIR != "" ]]; then
-    rm -rf "${TMP_DIR}"
-    echo removed up temp directory "${TMP_DIR}"
-fi
diff --git a/install-scripts/.local/bin/install-hugo-home b/install-scripts/.local/bin/install-hugo-home
index 4fd6e32..4792683 100755
--- a/install-scripts/.local/bin/install-hugo-home
+++ b/install-scripts/.local/bin/install-hugo-home
@@ -1,34 +1,30 @@
 #!/usr/bin/env bash
 
-set -x
 set -e
+set -x
 
-VERSION=${VERSION:-0.79.0}
-
-LOCAL="${LOCAL:-${XDG_DATA_HOME:-${HOME}/.local}}"
-SHARE_DIR="${LOCAL}/share/buddy-up"
-DATA_DIR="${SHARE_DIR}/apps"
-BIN_DIR="${BIN_DIR:-${XDG_BIN_HOME:-${LOCAL}/bin}}"
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
 
-TMP_DIR=
-if [[ ! -f "${DATA_DIR}/hugo/${VERSION}/hugo" ]] ; then
-    URL=https://github.com/gohugoio/hugo/releases/download/v${VERSION}/hugo_${VERSION}_$(uname -s)-64bit.tar.gz
-    TMP_DIR=$(mktemp --directory)
-    cd "${TMP_DIR}"
-    curl --location --silent --output release.tar.gz "${URL}"
-    tar xvzf release.tar.gz
-    mkdir -p "${DATA_DIR}/hugo/${VERSION}"
-    mv ./hugo "${DATA_DIR}/hugo/${VERSION}/hugo"
-fi
+APP=hugo
+VERSION=${VERSION:-0.81.0}
+APPS_DIR=${XDG_DATA_HOME}/buddy-up/apps/${APP}
 
-cd "${DATA_DIR}/hugo/"
-[[ -s current ]] && unlink current
-ln -s "${VERSION}" current
+ARCH=
+case $(get_arch) in
+        amd64)  ARCH=64bit
+esac
+URL=https://github.com/gohugoio/hugo/releases/download/v${VERSION}/hugo_${VERSION}_$(uname)-${ARCH}.tar.gz
 
-cd "${BIN_DIR}"
-[[ -L "hugo" ]] || ln --symbolic "${DATA_DIR}/hugo/current/hugo" hugo
+extract_tarball "${URL}" "${APPS_DIR}/${VERSION}"
+set_current_link "${APPS_DIR}" "${VERSION}"
 
-if [[ "${TMP_DIR}" != "" ]]; then
-    rm -rf "${TMP_DIR}"
-    echo removed up temp directory "${TMP_DIR}"
-fi
+apps=$(find "${APPS_DIR}/current/" -maxdepth 1 -executable -type f -exec basename {} \;)
+cd "${XDG_BIN_HOME}"
+for bin in $apps; do
+    if [[ ! -s $bin ]]; then
+        ln --symbolic \
+            "$(relative_path "${XDG_BIN_HOME}" "${APPS_DIR}/current/${bin}")" \
+            "${bin}"
+    fi
+done
diff --git a/install-scripts/.local/bin/install-lego-system b/install-scripts/.local/bin/install-lego-system
index 6cae5f5..59184ad 100755
--- a/install-scripts/.local/bin/install-lego-system
+++ b/install-scripts/.local/bin/install-lego-system
@@ -2,64 +2,23 @@
 
 set -e
 
-VERSION=${VERSION:-v4.1.0}
-
-PREFIX_DIR=/usr/local
-BIN_DIR=${PREFIX_DIR}/bin
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
 
 APP=lego
-
-APP_PREFIX_DIR=${PREFIX_DIR}/apps/${APP}
-APP_DEST_DIR=${APP_PREFIX_DIR}/${VERSION}
-APP_CURRENT=${APP_PREFIX_DIR}/current
-
-OS=
-if [[ $OSTYPE =~ linux ]]; then
-    OS=linux
-elif [[  $OSTYPE =~ darwin ]]; then
-    OS=darwin
-else
-    echo unknown os: "$OSTYPE"
-    exit 1
-fi
-
-ARCH=
-if [[ $(uname -m) == x86_64 ]]; then
-    ARCH=amd64
-else
-    echo arch not yet supported: "$(uname -m)"
-    exit 1
-fi
-
-URL=https://github.com/go-acme/lego/releases/download/${VERSION}/lego_${VERSION}_${OS}_${ARCH}.tar.gz
-
-[[ -d ${APP_DEST_DIR} ]] || sudo mkdir -p "${APP_DEST_DIR}"
-
-TMP_DIR=
-if [[ ! -f ${APP_DEST_DIR}/lego ]]; then
-    TMP_DIR=$(mktemp --directory)
-    DEST_FILE=$TMP_DIR/${APP}.tar.gz
-    echo downloading "${APP}" "${VERSION}" to temp directory "${TMP_DIR}"
-    curl --silent --location --output "${DEST_FILE}" "${URL}"
-
-    sudo tar xf "${DEST_FILE}" --directory "${APP_DEST_DIR}"
-    sudo chown --recursive root:root "${APP_DEST_DIR}"
-else
-    echo "${APP}" "${VERSION}" already installed
-fi
-
-cd ${APP_PREFIX_DIR}
-[[ -s current ]] && sudo unlink current
-sudo ln --symbolic "${APP_DEST_DIR}" current
-echo current version set to "${VERSION}"
-
-cd ${BIN_DIR}
-# shellcheck disable=SC2044
-for bin in $(find ${APP_CURRENT}/ -maxdepth 1 -executable -type f -exec basename {} \;); do
-    [[ -s $bin ]] || sudo ln --symbolic "${APP_CURRENT}/$bin"
+VERSION=${VERSION:-v4.3.1}
+APPS_DIR=/usr/local/apps/${APP}
+URL=https://github.com/go-acme/lego/releases/download/${VERSION}/lego_${VERSION}_$(get_os)_$(get_arch).tar.gz
+
+extract_tarball "${URL}" "${APPS_DIR}/${VERSION}" "" sudo
+set_current_link "${APPS_DIR}" "${VERSION}" sudo
+
+apps=$(find ${APPS_DIR}/current/ -maxdepth 1 -executable -type f -exec basename {} \;)
+cd /usr/local/bin
+for bin in $apps; do
+    if [[ ! -s $bin ]]; then
+        sudo ln --symbolic \
+            "$(relative_path "/usr/local/bin" "${APPS_DIR}/current/${bin}")" \
+            "${bin}"
+    fi
 done
-
-if [[ $TMP_DIR != "" ]]; then
-    rm -rf "${TMP_DIR}"
-    echo removed up temp directory "${TMP_DIR}"
-fi
diff --git a/install-scripts/.local/bin/install-minikube-system b/install-scripts/.local/bin/install-minikube-system
index be12382..65c0745 100755
--- a/install-scripts/.local/bin/install-minikube-system
+++ b/install-scripts/.local/bin/install-minikube-system
@@ -2,56 +2,27 @@
 
 set -e
 
-MINIKUBE_VERSION=${MINIKUBE_VERSION:-v1.9.2}
-
-PREFIX_DIR=/usr/local
-BIN_DIR=${PREFIX_DIR}/bin
-
-MINIKUBE_PREFIX_DIR=${PREFIX_DIR}/apps/minikube
-MINIKUBE_DEST_DIR=${MINIKUBE_PREFIX_DIR}/${MINIKUBE_VERSION}
-MINIKUBE_CURRENT=${MINIKUBE_PREFIX_DIR}/current
-
-if [[ $(uname) =~ Linux ]]; then
-    OS=linux
-elif [[  $(uname) =~ Darwin ]]; then
-    OS=darwin
-else
-    echo "unsupported os: $(uname)"
-    exit 1
-fi
-
-ARCH=
-if [[ $(uname -m) == x86_64 ]]; then
-    ARCH=amd64
-else
-    echo arch not yet supported: "$(uname -m)"
-    exit 1
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
+
+APP=minikube
+VERSION=${VERSION:-v1.18.1}
+APPS_DIR=/usr/local/apps/${APP}
+URL=https://github.com/kubernetes/minikube/releases/download/${VERSION}/minikube-$(get_os)-$(get_arch).tar.gz
+
+extract_tarball "${URL}" "${APPS_DIR}/${VERSION}" "--strip-components 1" sudo
+sudo chown --recursive root:root "${APPS_DIR}/${VERSION}"
+set_current_link "${APPS_DIR}" "${VERSION}" sudo
+
+cd /usr/local/bin
+if [[ ! -L minikube ]]; then
+    sudo ln --symbolic \
+        "$(relative_path "/usr/local/bin" "${APPS_DIR}/current/minikube-linux-amd64")" \
+        minikube
 fi
 
-TMP_DIR=
-if [[ ! -d ${MINIKUBE_DEST_DIR} ]]; then
-    sudo mkdir -p "${MINIKUBE_DEST_DIR}"
-    TMP_DIR=$(mktemp --directory)
-    DEST_FILE="${TMP_DIR}"/minikube
-    URL="https://github.com/kubernetes/minikube/releases/download/${MINIKUBE_VERSION}/minikube-${OS}-${ARCH}"
-    echo downloading minikube "${MINIKUBE_VERSION}" to temp directory "${TMP_DIR}"
-    curl --silent --location --output "${DEST_FILE}" "${URL}"
-
-    sudo chmod 755 "${DEST_FILE}"
-    sudo mv "${DEST_FILE}" "${MINIKUBE_DEST_DIR}"
-    sudo chown --recursive root:root "${MINIKUBE_DEST_DIR}"
-else
-    echo minikube "${MINIKUBE_VERSION}" already installed
-fi
-
-cd "${MINIKUBE_PREFIX_DIR}"
-[[ -s current ]] && sudo unlink current
-sudo ln --symbolic "${MINIKUBE_VERSION}"/ current
-echo current version set to "${MINIKUBE_VERSION}"
-cd ${BIN_DIR}
-[[ -L ${BIN_DIR}/minikube ]] || sudo ln --symbolic ${MINIKUBE_CURRENT}/minikube
-
-if [[ $TMP_DIR != "" ]]; then
-    rm -rf "${TMP_DIR}"
-    echo removed up temp directory "${TMP_DIR}"
+if [[ ! -L docker-machine-driver-kvm2 ]]; then
+    sudo ln --symbolic \
+        "$(relative_path "/usr/local/bin" "${APPS_DIR}/current/docker-machine-driver-kvm2")" \
+        docker-machine-driver-kvm2
 fi
diff --git a/install-scripts/.local/bin/install-protoc b/install-scripts/.local/bin/install-protoc-system
similarity index 58%
rename from install-scripts/.local/bin/install-protoc
rename to install-scripts/.local/bin/install-protoc-system
index eebfd02..2d58862 100755
--- a/install-scripts/.local/bin/install-protoc
+++ b/install-scripts/.local/bin/install-protoc-system
@@ -3,12 +3,19 @@
 set -x
 set -e
 
-PROTOC_VERSION=${PROTOC_VERSION:-3.7.1}
+# shellcheck disable=SC1090
+source "${XDG_DATA_HOME}/buddy-up/includes/utils.sh"
+
+PROTOC_VERSION=${PROTOC_VERSION:-3.15.6}
 PROTOC_ZIP=protoc-$PROTOC_VERSION-linux-x86_64.zip
 TMP_DIR=$(mktemp --directory)
 DEST_FILE=$TMP_DIR/$PROTOC_ZIP
 URL=https://github.com/protocolbuffers/protobuf/releases/download/v$PROTOC_VERSION/$PROTOC_ZIP
+
 curl --output "$DEST_FILE" --location "$URL"
 sudo unzip -o "$DEST_FILE" -d /usr/local bin/protoc
+sudo chmod 755 /usr/local/bin/protoc
 sudo unzip -o "$DEST_FILE" -d /usr/local 'include/*'
+sudo find /usr/local/include/google -type f -exec chmod 644 {} \;
+sudo find /usr/local/include/google -type d -exec chmod 755 {} \;
 rm -rfv "$TMP_DIR"