add support for cloning non npm hosted deps into a repo

hashing the original tarball now