created a custom resource type to download a remote package and install it. its suprising that package source cant take a url