package updater: hackage: fix url, handle mirror://, clean up