get publicly accessible tarball via the GitHub API