Install packages from GitHub via SHA1 and not via named reference

Reason: Named references can change, SHA1 cannot

It was necessary to download the .tar.gz file, because untar had weird problems with the zip file. Also, GitHub will download 

Closes #39 (=includes it).