new non-https mirror, avoid icudt download twice on multiarch building