BLD: use https instead of git to retrieve deps