Adding a dependency on `tar` is unfortunate, and will further limit the Windows version... but we might be tied to cygwin already because of the `ssh`... Is `tar` necessary, or could you use `zip`?  Go supports `zip` format natively in its libraries.