Extract archives into vendor dir to avoid permission errors, fixes #1765, fixes #1714