allow an empty source url for fake packages