That's what I was thinking. In the interest of security, I've decided to instead simply have them download .zip files and allow them to upload it into their own installation.