Mount an approved SMB share read-only

Keep credentials out of shell history and process arguments. Create a temporary credential file owned by the current user:

umask 077
cat > "$HOME/.smb-approved-share" <<'CREDS'
username=APPROVED_USER
password=ENTER_INTERACTIVELY_BEFORE_USE
domain=APPROVED_DOMAIN
CREDS
chmod 600 "$HOME/.smb-approved-share"

Mount the named share with a current SMB dialect and restrictive client options:

sudo install -d -m 0750 /mnt/approved_share
sudo mount.cifs //APPROVED_HOST/APPROVED_SHARE /mnt/approved_share \
  -o credentials="$HOME/.smb-approved-share",vers=3.1.1,sec=ntlmssp,ro,nosuid,nodev,noexec,uid="$(id -u)",gid="$(id -g)"

Confirm the mount is read-only, copy only the approved file, and record its checksum. Then clean up:

findmnt /mnt/approved_share
sudo umount /mnt/approved_share

Remove the temporary credential file through the operating system's approved secret-cleanup process after the test.