getSourceForPkgRecord installs from GitHub via SHA1 and not via file name
use https for GitHub access
download .tar.gz file