update sources before anything else happens (because the box is stale)!