download recommended via https instead of ssh