build: use UPSTREAM_TAG and not VERSION to generate tarball