pointed dependencies to tarballs