use curl instead of hg to download deps