Same question about shell safeness for `sourcedir` and the basename of `destfile`