the tarball entry paths dont always start with `package`?
wont the suggested regexp actually *not* catch the most common form?