I wonder if you can't just get the md5 from the tar.gz and compare them w/o extracting and comparing contents. It would be more efficient but not more effective; so, it's purely a "I wonder".