fix tarballUrl to use https