It looks like tarfile.extract() does not preserve the modification
times of files that get extracted. My reading of the Python API is that
tarfile.extractall() does preserver these times. I can't tell whether
permissions are being preserved or not. That is, all files seem to
be world readable and directories world readable-executable, but
I don't know if that's because the permissions are being preserved, or
just because the umask for /Users/birch has those permissions.

In any case, it might be worth trying tarfile.extractall(). The other
reason is that tarfile.extract() is very very slow on canolaoil. It
took 8 hours to do an update on canola oil. That, of course, is a
real worst case situation, but if, by chance tarfile.extract() performs
better, that would be a plus.