About the binary file, in theory I agree with you, but that archive contains 5 or 6 subdirectories with a few almost empty files.

Of course I can write a script that recreates that situation, but does it make sense when I can just tar and untar it?
And what should be the security threat in a tar.gz file?

Anyway it doesn't matter and sure I will try to use plain text in the future..

About the bug, for what I can understand the bug comes from pkg_resources:
/usr/lib/python2.7/site-packages/pkg_resources.py is owned by python2-distribute 0.6.24-1

and/or from how the import mechanism works on namespace packages, not from setuptools..
Should I still move the bug report to somewhere else?