trust a tarball if found (to avoid "HEAD"ing)