bump revision
point to tarballs instead of git+https URLs (#581)