Hmm... that might be a perfectly valid URL. I think we should not get the filename from the URL at all but use something made up (maybe an MD5 sum). The only reason I use this here is probably to decide if I need to unzip or untar later. That however would be easier to check by magic bytes....