We're using checksum as file name and verify that all externally-controllable path components are harmless.
