point to tarballs instead of git+https URLs (#581)