download sources with curl rather than wget, to avoid problems with certificates