ensure strictSSL
fix getPackageConfig to use versions