Install packages from GitHub via SHA1 and not via named reference

Reason: Named references can change, SHA1 cannot

It is now necessary to download the .tar.gz file, because untar had weird problems with the zip file.

Closes #39 (=includes it).