use source tarball from mirrored third-party area