Fixes: CVE-2017-13089, CVE-2017-13090 switch to gz as there is no xz tarball for 1.19.2 Signed-off-by: Peter Wagner <tripolar@gmx.at>