[boxes-1.1.1] fix source download URL (use github) and sha1sum