implemented building an arbitrary tgz from source

this is not nice yet, as we cannot really read the package version before
it's downloaded. so the downloader will report the version (unknown). We'll
either need to rework the process flow (always download first, create a pkg then).
Or, we'll need a kind of a middle shift for pickle downloaders, to override
this kind of messages. Or, we'll need both of the above mixed.