build: use HTTPS in the package URL