Tighten package source names that are considered local paths
Allow source packages to be tarballs