In the test case for the tar assembler, actually verify the content by un-tar-ing the result again and comparing it to the tree. This would have spotted missing SELinux labels.