Use zip instead of tar (has checksums)

Signed-off-by: Fabian Deutsch <fabiand@fedoraproject.org>