Don't forget that if it's a RPM that comes out of the process you can gpg sign it, and verify the files that it provided when your server gets hacked. Sure, yeah, you can do that with a tar file, but it's pretty easy to run one command on a server and see what's changed.