don't call tar through the shell (avoid need to escape shell meta-chars)