makefile: add download-secret command