fetch.py: fetches any missing source tarballs into SOURCES/