fixed stack overflow

  package verification was still using async sha1 verify and called
  its callback without nextTick. This used to be necessary with async
  when the zip library was still async, but the current zip lib is
  synchronous. thus the callback without tick caused an overflow after
  a certain number of files.

  now the package verification is synchronous after loading the zip
  into memory and there is no issue anymore
bugfix release (stack overflow)