Correctly report where tarballs are fetched from
Prefer https