Upstream switch to bz2 for auth tarballs