fix: traceback: accessing base.history from download_packages().

Under a non-root this tracebacks. There's no proof this in fact helps. If it
did, the proper fix is by locking the history access.