bugfixes:
    - In fetch action, avoid using slurp return to set up dest, also ensure no dir traversal CVE-2019-3828.