don't use https to obtain package (certificate expired or something)