code: function getTmp (config) {
    return path.join(config.tmpdir || '/tmp', ''+Date.now() + Math.random())
  }
docs: unpack a tarball to some target directory. recommend unpacking to tmpdir and then moving a following step. ALSO, should hash the file as we unpack it, and validate that we get the correct hash.