Also switch to downloading tarball from official source URL to allows verification of digital signature.