Why do we care about the validity of the package name? It's not like the package could end up on the blob without being specifically uploaded by us (which I assume is gated?)