using tarball for github dependency