don't use ssh urls for sources

(they will fail for users who don't have write access to the repos)