bug: only allow .tgz or .tar.gz file