The sp-unpack program

sp-unpack [$SP_ROOT]/package/admin/foo-2.0 [...]

sp-unpack unpacks one or more package tarballs. It is typically invoked by way of sp-install. For /package/admin/foo-2.0, it first runs "sp-download /package/admin/foo-2.0", then looks for foo-2.0.tar, possibly with an extension of .gz, .bz2, or .Z, in $SP_TARDIR_FLAT (if that variable is set), $SP_TARDIR/admin (if that variable is set), $SP_ROOT/usr/local/src/package/admin, and /usr/local/src/package/admin. If a compressed file is found, temporary files are created in $TMPDIR (defaulting to /tmp).

If the given package directory already exists, sp-unpack will not unpack the tarball again, to save time and preserve local modifications. You can set $SP_REUNPACK=y to force sp-unpack to unpack a tarball even when the directory exists.

If $SP_COMPILE_USER is set, sp-unpack will create the package directory, chown it to $SP_COMPILE_USER, unpack the tarball as $SP_COMPILE_USER, and chown it back to the calling user and group. This ensures that a tarball cannot overwrite any files outside its own package directory, assuming no other files under $SP_ROOT/pakcage are owned by that user.