setup: built-in tar

[DJ Delorie]

> If I remember my GPL correctly all you have to do is make the sources
> available.  Posting them on the same server in a reasonably conspicuous
> location meets this requirement.

Until either tar or gzip is updated, then the version in setup no
longer matches the sources.  Or if someone wants to put setup on a
CD-ROM that doesn't happen to include tar or gzip.  Or if the person
building setup.exe (me) has a different version of tar or gzip
installed on their system than the one on sourceware.

> Just something to think about, how do we deal with their mucking for
> updates via "setup -u"?

IMO we should be keeping better track of what we're installing.
Perhaps keep a list of which files (and sizes/mtimes/checksums) came
from which tarballs.  Then, when we see that a given tarball needs to
be installed, we can see what was already installed and what's
currently on the disk, and make the needed corrections for the update.