validate_cmd: Make sure tmpfile is always closed and unlinked