bip: use debian mirror so we don't need UnsafeCurlDownloadStrategy