Yesterday's CVE-fix changed the package source URL to an invalid location. Reverting this change to unbreak builds. Signed-off-by: Steven Barth <steven@midlink.org>