The intension was to unpack into the "normal" GeoServer data directory location rather then a temporary file. As for multiprocess safe this code should be in position to use a resource lock inside r.out() to avoid multiple threads unpacking at the same time.

Do we want to use resource lock during read operations such as this?