internal/rosa: helpers for common url formats

This cleans up call site of NewPackage.

Signed-off-by: Ophestra <cat@gensokyo.uk>

65 files changed, 471 insertions, 419 deletions

diff --git a/internal/rosa/acl.go b/internal/rosa/acl.go
index 1a76de35..1ed82a09 100644
--- a/internal/rosa/acl.go
+++ b/internal/rosa/acl.go
@@ -7,10 +7,10 @@ func (t Toolchain) newAttr() (pkg.Artifact, string) {
 		version  = "2.5.2"
 		checksum = "YWEphrz6vg1sUMmHHVr1CRo53pFXRhq_pjN-AlG8UgwZK1y6m7zuDhxqJhD0SV0l"
 	)
-	return t.NewPackage("attr", version, pkg.NewHTTPGetTar(
-		nil, "https://download.savannah.nongnu.org/releases/attr/"+
+	return t.NewPackage("attr", version, newTar(
+		"https://download.savannah.nongnu.org/releases/attr/"+
 			"attr-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{
@@ -81,10 +81,10 @@ func (t Toolchain) newACL() (pkg.Artifact, string) {
 		version  = "2.3.2"
 		checksum = "-fY5nwH4K8ZHBCRXrzLdguPkqjKI6WIiGu4dBtrZ1o0t6AIU73w8wwJz_UyjIS0P"
 	)
-	return t.NewPackage("acl", version, pkg.NewHTTPGetTar(
-		nil, "https://download.savannah.nongnu.org/releases/acl/"+
+	return t.NewPackage("acl", version, newTar(
+		"https://download.savannah.nongnu.org/releases/acl/"+
 			"acl-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// makes assumptions about uid_map/gid_map
diff --git a/internal/rosa/all.go b/internal/rosa/all.go
index e3f3e7b5..220a41c2 100644
--- a/internal/rosa/all.go
+++ b/internal/rosa/all.go
@@ -123,7 +123,7 @@ const (
 	PerlTermReadKey
 	PerlTextCharWidth
 	PerlTextWrapI18N
-	PerlUnicodeGCString
+	PerlUnicodeLineBreak
 	PerlYAMLTiny
 	PkgConfig
 	Procps
diff --git a/internal/rosa/argp-standalone.go b/internal/rosa/argp-standalone.go
index 32cb71c8..04d2e728 100644
--- a/internal/rosa/argp-standalone.go
+++ b/internal/rosa/argp-standalone.go
@@ -7,10 +7,10 @@ func (t Toolchain) newArgpStandalone() (pkg.Artifact, string) {
 		version  = "1.3"
 		checksum = "vtW0VyO2pJ-hPyYmDI2zwSLS8QL0sPAUKC1t3zNYbwN2TmsaE-fADhaVtNd3eNFl"
 	)
-	return t.NewPackage("argp-standalone", version, pkg.NewHTTPGetTar(
-		nil, "http://www.lysator.liu.se/~nisse/misc/"+
+	return t.NewPackage("argp-standalone", version, newTar(
+		"http://www.lysator.liu.se/~nisse/misc/"+
 			"argp-standalone-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Env: []string{
diff --git a/internal/rosa/bzip2.go b/internal/rosa/bzip2.go
index 776e90a8..d7dd1380 100644
--- a/internal/rosa/bzip2.go
+++ b/internal/rosa/bzip2.go
@@ -7,9 +7,9 @@ func (t Toolchain) newBzip2() (pkg.Artifact, string) {
 		version  = "1.0.8"
 		checksum = "cTLykcco7boom-s05H1JVsQi1AtChYL84nXkg_92Dm1Xt94Ob_qlMg_-NSguIK-c"
 	)
-	return t.NewPackage("bzip2", version, pkg.NewHTTPGetTar(
-		nil, "https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("bzip2", version, newTar(
+		"https://sourceware.org/pub/bzip2/bzip2-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable:    true,
diff --git a/internal/rosa/cmake.go b/internal/rosa/cmake.go
index bc27bead..78b2f69c 100644
--- a/internal/rosa/cmake.go
+++ b/internal/rosa/cmake.go
@@ -13,10 +13,11 @@ func (t Toolchain) newCMake() (pkg.Artifact, string) {
 		version  = "4.3.1"
 		checksum = "RHpzZiM1kJ5bwLjo9CpXSeHJJg3hTtV9QxBYpQoYwKFtRh5YhGWpShrqZCSOzQN6"
 	)
-	return t.NewPackage("cmake", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/Kitware/CMake/releases/download/"+
-			"v"+version+"/cmake-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("cmake", version, newFromGitHubRelease(
+		"Kitware/CMake",
+		"v"+version,
+		"cmake-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// test suite expects writable source tree
diff --git a/internal/rosa/connman.go b/internal/rosa/connman.go
index c59eea8b..64a7208e 100644
--- a/internal/rosa/connman.go
+++ b/internal/rosa/connman.go
@@ -7,10 +7,10 @@ func (t Toolchain) newConnman() (pkg.Artifact, string) {
 		version  = "2.0"
 		checksum = "MhVTdJOhndnZn2SWd8URKo_Pj7Zvc14tntEbrVOf9L3yVWJvpb3v3Q6104tWJgtW"
 	)
-	return t.NewPackage("connman", version, pkg.NewHTTPGetTar(
-		nil, "https://git.kernel.org/pub/scm/network/connman/connman.git/"+
+	return t.NewPackage("connman", version, newTar(
+		"https://git.kernel.org/pub/scm/network/connman/connman.git/"+
 			"snapshot/connman-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{
diff --git a/internal/rosa/curl.go b/internal/rosa/curl.go
index 38046fd8..4d411a02 100644
--- a/internal/rosa/curl.go
+++ b/internal/rosa/curl.go
@@ -7,9 +7,9 @@ func (t Toolchain) newCurl() (pkg.Artifact, string) {
 		version  = "8.19.0"
 		checksum = "YHuVLVVp8q_Y7-JWpID5ReNjq2Zk6t7ArHB6ngQXilp_R5l3cubdxu3UKo-xDByv"
 	)
-	return t.NewPackage("curl", version, pkg.NewHTTPGetTar(
-		nil, "https://curl.se/download/curl-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("curl", version, newTar(
+		"https://curl.se/download/curl-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		// remove broken test
diff --git a/internal/rosa/dbus.go b/internal/rosa/dbus.go
index b27d85a8..1e271c50 100644
--- a/internal/rosa/dbus.go
+++ b/internal/rosa/dbus.go
@@ -7,11 +7,11 @@ func (t Toolchain) newDBus() (pkg.Artifact, string) {
 		version  = "1.16.2"
 		checksum = "INwOuNdrDG7XW5ilW_vn8JSxEa444rRNc5ho97i84I1CNF09OmcFcV-gzbF4uCyg"
 	)
-	return t.NewPackage("dbus", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/dbus/dbus/-/archive/"+
-			"dbus-"+version+"/dbus-dbus-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("dbus", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"dbus/dbus",
+		"dbus-"+version,
+		checksum,
 	), &PackageAttr{
 		// OSError: [Errno 30] Read-only file system: '/usr/src/dbus/subprojects/packagecache'
 		Writable: true,
@@ -50,11 +50,10 @@ func (t Toolchain) newXDGDBusProxy() (pkg.Artifact, string) {
 		version  = "0.1.7"
 		checksum = "UW5Pe-TP-XAaN-kTbxrkOQ7eYdmlAQlr2pdreLtPT0uwdAz-7rzDP8V_8PWuZBup"
 	)
-	return t.NewPackage("xdg-dbus-proxy", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/flatpak/xdg-dbus-proxy/archive/"+
-			"refs/tags/"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("xdg-dbus-proxy", version, newFromGitHub(
+		"flatpak/xdg-dbus-proxy",
+		version,
+		checksum,
 	), nil, &MesonHelper{
 		Setup: []KV{
 			{"Dman", "disabled"},
diff --git a/internal/rosa/dtc.go b/internal/rosa/dtc.go
index de1336e2..602d8439 100644
--- a/internal/rosa/dtc.go
+++ b/internal/rosa/dtc.go
@@ -7,10 +7,10 @@ func (t Toolchain) newDTC() (pkg.Artifact, string) {
 		version  = "1.7.2"
 		checksum = "vUoiRynPyYRexTpS6USweT5p4SVHvvVJs8uqFkkVD-YnFjwf6v3elQ0-Etrh00Dt"
 	)
-	return t.NewPackage("dtc", version, pkg.NewHTTPGetTar(
-		nil, "https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/"+
+	return t.NewPackage("dtc", version, newTar(
+		"https://git.kernel.org/pub/scm/utils/dtc/dtc.git/snapshot/"+
 			"dtc-v"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// works around buggy test:
diff --git a/internal/rosa/elfutils.go b/internal/rosa/elfutils.go
index 52351323..b9b500f3 100644
--- a/internal/rosa/elfutils.go
+++ b/internal/rosa/elfutils.go
@@ -7,10 +7,10 @@ func (t Toolchain) newElfutils() (pkg.Artifact, string) {
 		version  = "0.194"
 		checksum = "Q3XUygUPv9vR1TkWucwUsQ8Kb1_F6gzk-KMPELr3cC_4AcTrprhVPMvN0CKkiYRa"
 	)
-	return t.NewPackage("elfutils", version, pkg.NewHTTPGetTar(
-		nil, "https://sourceware.org/elfutils/ftp/"+
+	return t.NewPackage("elfutils", version, newTar(
+		"https://sourceware.org/elfutils/ftp/"+
 			version+"/elfutils-"+version+".tar.bz2",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Env: []string{
diff --git a/internal/rosa/etc.go b/internal/rosa/etc.go
index 17723a17..7b5542db 100644
--- a/internal/rosa/etc.go
+++ b/internal/rosa/etc.go
@@ -135,10 +135,11 @@ func newIANAEtc() pkg.Artifact {
 		version  = "20251215"
 		checksum = "kvKz0gW_rGG5QaNK9ZWmWu1IEgYAdmhj_wR7DYrh3axDfIql_clGRHmelP7525NJ"
 	)
-	return pkg.NewHTTPGetTar(
-		nil, "https://github.com/Mic92/iana-etc/releases/download/"+
-			version+"/iana-etc-"+version+".tar.gz",
-		mustDecode(checksum),
+	return newFromGitHubRelease(
+		"Mic92/iana-etc",
+		version,
+		"iana-etc-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	)
 }
diff --git a/internal/rosa/fakeroot.go b/internal/rosa/fakeroot.go
index 75544b29..f0f1a100 100644
--- a/internal/rosa/fakeroot.go
+++ b/internal/rosa/fakeroot.go
@@ -7,11 +7,11 @@ func (t Toolchain) newFakeroot() (pkg.Artifact, string) {
 		version  = "1.37.2"
 		checksum = "4ve-eDqVspzQ6VWDhPS0NjW3aSenBJcPAJq_BFT7OOFgUdrQzoTBxZWipDAGWxF8"
 	)
-	return t.NewPackage("fakeroot", version, pkg.NewHTTPGetTar(
-		nil, "https://salsa.debian.org/clint/fakeroot/-/archive/upstream/"+
-			version+"/fakeroot-upstream-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("fakeroot", version, newFromGitLab(
+		"salsa.debian.org",
+		"clint/fakeroot",
+		"upstream/"+version,
+		checksum,
 	), &PackageAttr{
 		Patches: []KV{
 			{"remove-broken-docs", `diff --git a/doc/Makefile.am b/doc/Makefile.am
diff --git a/internal/rosa/flex.go b/internal/rosa/flex.go
index b318646e..b0d357cc 100644
--- a/internal/rosa/flex.go
+++ b/internal/rosa/flex.go
@@ -9,10 +9,11 @@ func (t Toolchain) newFlex() (pkg.Artifact, string) {
 		version  = "2.6.4"
 		checksum = "p9POjQU7VhgOf3x5iFro8fjhy0NOanvA7CTeuWS_veSNgCixIJshTrWVkc5XLZkB"
 	)
-	return t.NewPackage("flex", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/westes/flex/releases/download/"+
-			"v"+version+"/flex-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("flex", version, newFromGitHubRelease(
+		"westes/flex",
+		"v"+version,
+		"flex-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		M4,
diff --git a/internal/rosa/fuse.go b/internal/rosa/fuse.go
index ee8ab579..f190ecc8 100644
--- a/internal/rosa/fuse.go
+++ b/internal/rosa/fuse.go
@@ -7,10 +7,11 @@ func (t Toolchain) newFuse() (pkg.Artifact, string) {
 		version  = "3.18.2"
 		checksum = "iL-7b7eUtmlVSf5cSq0dzow3UiqSjBmzV3cI_ENPs1tXcHdktkG45j1V12h-4jZe"
 	)
-	return t.NewPackage("fuse", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/libfuse/libfuse/releases/download/"+
-			"fuse-"+version+"/fuse-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("fuse", version, newFromGitHubRelease(
+		"libfuse/libfuse",
+		"fuse-"+version,
+		"fuse-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MesonHelper{
 		Setup: []KV{
diff --git a/internal/rosa/git.go b/internal/rosa/git.go
index 9b9fa2d6..e1e68b98 100644
--- a/internal/rosa/git.go
+++ b/internal/rosa/git.go
@@ -12,10 +12,10 @@ func (t Toolchain) newGit() (pkg.Artifact, string) {
 		version  = "2.53.0"
 		checksum = "rlqSTeNgSeVKJA7nvzGqddFH8q3eFEPB4qRZft-4zth8wTHnbTbm7J90kp_obHGm"
 	)
-	return t.NewPackage("git", version, pkg.NewHTTPGetTar(
-		nil, "https://www.kernel.org/pub/software/scm/git/"+
+	return t.NewPackage("git", version, newTar(
+		"https://www.kernel.org/pub/software/scm/git/"+
 			"git-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		ScriptEarly: `
diff --git a/internal/rosa/glslang.go b/internal/rosa/glslang.go
index b57790e8..46bb2129 100644
--- a/internal/rosa/glslang.go
+++ b/internal/rosa/glslang.go
@@ -12,11 +12,10 @@ func (t Toolchain) newSPIRVHeaders() (pkg.Artifact, string) {
 		version  = "1.4.341.0"
 		checksum = "0PL43-19Iaw4k7_D8J8BvoJ-iLgCVSYZ2ThgDPGfAJwIJFtre7l0cnQtLjcY-JvD"
 	)
-	return t.NewPackage("spirv-headers", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/KhronosGroup/SPIRV-Headers/archive/"+
-			"refs/tags/vulkan-sdk-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("spirv-headers", version, newFromGitHub(
+		"KhronosGroup/SPIRV-Headers",
+		"vulkan-sdk-"+version,
+		checksum,
 	), nil, &CMakeHelper{
 		Cache: []KV{
 			{"CMAKE_BUILD_TYPE", "Release"},
@@ -59,11 +58,10 @@ func (t Toolchain) newSPIRVTools() (pkg.Artifact, string) {
 		version  = "2026.1"
 		checksum = "ZSQPQx8NltCDzQLk4qlaVxyWRWeI_JtsjEpeFt3kezTanl9DTHfLixSUCezMFBjv"
 	)
-	return t.NewPackage("spirv-tools", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/KhronosGroup/SPIRV-Tools/archive/"+
-			"refs/tags/v"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("spirv-tools", version, newFromGitHub(
+		"KhronosGroup/SPIRV-Tools",
+		"v"+version,
+		checksum,
 	), nil, &CMakeHelper{
 		Cache: []KV{
 			{"CMAKE_BUILD_TYPE", "Release"},
@@ -96,11 +94,10 @@ func (t Toolchain) newGlslang() (pkg.Artifact, string) {
 		version  = "16.2.0"
 		checksum = "6_UuF9reLRDaVkgO-9IfB3kMwme3lQZM8LL8YsJwPdUFkrjzxJtf2A9X3w9nFxj2"
 	)
-	return t.NewPackage("glslang", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/KhronosGroup/glslang/archive/"+
-			"refs/tags/"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("glslang", version, newFromGitHub(
+		"KhronosGroup/glslang",
+		version,
+		checksum,
 	), &PackageAttr{
 		// test suite writes to source
 		Writable: true,
diff --git a/internal/rosa/gnu.go b/internal/rosa/gnu.go
index 3bbc612f..2b93506d 100644
--- a/internal/rosa/gnu.go
+++ b/internal/rosa/gnu.go
@@ -11,9 +11,9 @@ func (t Toolchain) newM4() (pkg.Artifact, string) {
 		version  = "1.4.21"
 		checksum = "pPa6YOo722Jw80l1OsH1tnUaklnPFjFT-bxGw5iAVrZTm1P8FQaWao_NXop46-pm"
 	)
-	return t.NewPackage("m4", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("m4", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/m4/m4-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Writable: true,
@@ -43,9 +43,9 @@ func (t Toolchain) newBison() (pkg.Artifact, string) {
 		version  = "3.8.2"
 		checksum = "BhRM6K7URj1LNOkIDCFDctSErLS-Xo5d9ba9seg10o6ACrgC1uNhED7CQPgIY29Y"
 	)
-	return t.NewPackage("bison", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/bison/bison-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("bison", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/bison/bison-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		M4,
@@ -70,9 +70,9 @@ func (t Toolchain) newSed() (pkg.Artifact, string) {
 		version  = "4.9"
 		checksum = "pe7HWH4PHNYrazOTlUoE1fXmhn2GOPFN_xE62i0llOr3kYGrH1g2_orDz0UtZ9Nt"
 	)
-	return t.NewPackage("sed", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/sed/sed-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("sed", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/sed/sed-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Diffutils,
@@ -95,9 +95,9 @@ func (t Toolchain) newAutoconf() (pkg.Artifact, string) {
 		version  = "2.73"
 		checksum = "yGabDTeOfaCUB0JX-h3REYLYzMzvpDwFmFFzHNR7QilChCUNE4hR6q7nma4viDYg"
 	)
-	return t.NewPackage("autoconf", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("autoconf", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/autoconf/autoconf-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TExclusive,
@@ -135,9 +135,9 @@ func (t Toolchain) newAutomake() (pkg.Artifact, string) {
 		version  = "1.18.1"
 		checksum = "FjvLG_GdQP7cThTZJLDMxYpRcKdpAVG-YDs1Fj1yaHlSdh_Kx6nRGN14E0r_BjcG"
 	)
-	return t.NewPackage("automake", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/automake/automake-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("automake", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/automake/automake-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -179,9 +179,9 @@ func (t Toolchain) newLibtool() (pkg.Artifact, string) {
 		version  = "2.5.4"
 		checksum = "pa6LSrQggh8mSJHQfwGjysAApmZlGJt8wif2cCLzqAAa2jpsTY0jZ-6stS3BWZ2Q"
 	)
-	return t.NewPackage("libtool", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/libtool/libtool-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libtool", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/libtool/libtool-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		Check: []string{
@@ -210,9 +210,9 @@ func (t Toolchain) newGzip() (pkg.Artifact, string) {
 		version  = "1.14"
 		checksum = "NWhjUavnNfTDFkZJyAUonL9aCOak8GVajWX2OMlzpFnuI0ErpBFyj88mz2xSjz0q"
 	)
-	return t.NewPackage("gzip", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/gzip/gzip-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("gzip", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/gzip/gzip-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// dependency loop
@@ -236,9 +236,9 @@ func (t Toolchain) newGettext() (pkg.Artifact, string) {
 		version  = "1.0"
 		checksum = "3MasKeEdPeFEgWgzsBKk7JqWqql1wEMbgPmzAfs-mluyokoW0N8oQVxPQoOnSdgC"
 	)
-	return t.NewPackage("gettext", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/gettext/gettext-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("gettext", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/gettext/gettext-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -282,9 +282,9 @@ func (t Toolchain) newDiffutils() (pkg.Artifact, string) {
 		version  = "3.12"
 		checksum = "9J5VAq5oA7eqwzS1Yvw-l3G5o-TccUrNQR3PvyB_lgdryOFAfxtvQfKfhdpquE44"
 	)
-	return t.NewPackage("diffutils", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("diffutils", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/diffutils/diffutils-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -315,9 +315,9 @@ func (t Toolchain) newPatch() (pkg.Artifact, string) {
 		version  = "2.8"
 		checksum = "MA0BQc662i8QYBD-DdGgyyfTwaeALZ1K0yusV9rAmNiIsQdX-69YC4t9JEGXZkeR"
 	)
-	return t.NewPackage("patch", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/patch/patch-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("patch", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/patch/patch-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -347,9 +347,9 @@ func (t Toolchain) newBash() (pkg.Artifact, string) {
 		version  = "5.3"
 		checksum = "4LQ_GRoB_ko-Ih8QPf_xRKA02xAm_TOxQgcJLmFDT6udUPxTAWrsj-ZNeuTusyDq"
 	)
-	return t.NewPackage("bash", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/bash/bash-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("bash", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/bash/bash-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TEarly,
@@ -377,9 +377,9 @@ func (t Toolchain) newCoreutils() (pkg.Artifact, string) {
 		version  = "9.10"
 		checksum = "o-B9wssRnZySzJUI1ZJAgw-bZtj1RC67R9po2AcM2OjjS8FQIl16IRHpC6IwO30i"
 	)
-	return t.NewPackage("coreutils", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("coreutils", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/coreutils/coreutils-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -516,9 +516,9 @@ func (t Toolchain) newTexinfo() (pkg.Artifact, string) {
 		version  = "7.3"
 		checksum = "RRmC8Xwdof7JuZJeWGAQ_GeASIHAuJFQMbNONXBz5InooKIQGmqmWRjGNGEr5n4-"
 	)
-	return t.NewPackage("texinfo", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/texinfo/texinfo-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("texinfo", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/texinfo/texinfo-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// nonstandard glibc extension
@@ -549,9 +549,9 @@ func (t Toolchain) newGperf() (pkg.Artifact, string) {
 		version  = "3.3"
 		checksum = "RtIy9pPb_Bb8-31J2Nw-rRGso2JlS-lDlVhuNYhqR7Nt4xM_nObznxAlBMnarJv7"
 	)
-	return t.NewPackage("gperf", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gperf/gperf-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("gperf", version, newTar(
+		"https://ftpmirror.gnu.org/gperf/gperf-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Diffutils,
@@ -574,9 +574,9 @@ func (t Toolchain) newGawk() (pkg.Artifact, string) {
 		version  = "5.4.0"
 		checksum = "m0RkIolC-PI7EY5q8pcx5Y-0twlIW0Yp3wXXmV-QaHorSdf8BhZ7kW9F8iWomz0C"
 	)
-	return t.NewPackage("gawk", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/gawk/gawk-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("gawk", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/gawk/gawk-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TEarly,
@@ -602,9 +602,9 @@ func (t Toolchain) newGrep() (pkg.Artifact, string) {
 		version  = "3.12"
 		checksum = "qMB4RjaPNRRYsxix6YOrjE8gyAT1zVSTy4nW4wKW9fqa0CHYAuWgPwDTirENzm_1"
 	)
-	return t.NewPackage("grep", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/grep/grep-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("grep", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/grep/grep-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -666,9 +666,9 @@ func (t Toolchain) newBC() (pkg.Artifact, string) {
 		version  = "1.08.2"
 		checksum = "8h6f3hjV80XiFs6v9HOPF2KEyg1kuOgn5eeFdVspV05ODBVQss-ey5glc8AmneLy"
 	)
-	return t.NewPackage("bc", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/bc/bc-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("bc", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/bc/bc-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// source expected to be writable
@@ -695,9 +695,9 @@ func (t Toolchain) newLibiconv() (pkg.Artifact, string) {
 		version  = "1.19"
 		checksum = "UibB6E23y4MksNqYmCCrA3zTFO6vJugD1DEDqqWYFZNuBsUWMVMcncb_5pPAr88x"
 	)
-	return t.NewPackage("libiconv", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/libiconv/libiconv-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libiconv", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/libiconv/libiconv-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
@@ -718,9 +718,9 @@ func (t Toolchain) newTar() (pkg.Artifact, string) {
 		version  = "1.35"
 		checksum = "zSaoSlVUDW0dSfm4sbL4FrXLFR8U40Fh3zY5DWhR5NCIJ6GjU6Kc4VZo2-ZqpBRA"
 	)
-	return t.NewPackage("tar", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/tar/tar-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("tar", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/tar/tar-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		Configure: []KV{
@@ -760,9 +760,9 @@ func (t Toolchain) newParallel() (pkg.Artifact, string) {
 		version  = "20260322"
 		checksum = "gHoPmFkOO62ev4xW59HqyMlodhjp8LvTsBOwsVKHUUdfrt7KwB8koXmSVqQ4VOrB"
 	)
-	return t.NewPackage("parallel", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/parallel/parallel-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("parallel", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/parallel/parallel-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		Perl,
@@ -789,9 +789,9 @@ func (t Toolchain) newLibunistring() (pkg.Artifact, string) {
 		version  = "1.4.2"
 		checksum = "iW9BbfLoVlXjWoLTZ4AekQSu4cFBnLcZ4W8OHWbv0AhJNgD3j65_zqaLMzFKylg2"
 	)
-	return t.NewPackage("libunistring", version, pkg.NewHTTPGetTar(
-		nil, "https://ftp.gnu.org/gnu/libunistring/libunistring-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libunistring", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/libunistring/libunistring-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
@@ -822,9 +822,9 @@ func (t Toolchain) newLibtasn1() (pkg.Artifact, string) {
 		version  = "4.21.0"
 		checksum = "9DYI3UYbfYLy8JsKUcY6f0irskbfL0fHZA91Q-JEOA3kiUwpodyjemRsYRjUpjuq"
 	)
-	return t.NewPackage("libtasn1", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libtasn1", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/libtasn1/libtasn1-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
@@ -845,9 +845,9 @@ func (t Toolchain) newReadline() (pkg.Artifact, string) {
 		version  = "8.3"
 		checksum = "r-lcGRJq_MvvBpOq47Z2Y1OI2iqrmtcqhTLVXR0xWo37ZpC2uT_md7gKq5o_qTMV"
 	)
-	return t.NewPackage("readline", version, pkg.NewHTTPGetTar(
-		nil, "https://ftp.gnu.org/gnu/readline/readline-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("readline", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/readline/readline-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		Configure: []KV{
@@ -1060,9 +1060,9 @@ func (t Toolchain) newBinutils() (pkg.Artifact, string) {
 		version  = "2.46.0"
 		checksum = "4kK1_EXQipxSqqyvwD4LbiMLFKCUApjq6PeG4XJP4dzxYGqDeqXfh8zLuTyOuOVR"
 	)
-	return t.NewPackage("binutils", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/binutils/binutils-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("binutils", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/binutils/binutils-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		Bash,
@@ -1085,10 +1085,10 @@ func (t Toolchain) newGMP() (pkg.Artifact, string) {
 		version  = "6.3.0"
 		checksum = "yrgbgEDWKDdMWVHh7gPbVl56-sRtVVhfvv0M_LX7xMUUk_mvZ1QOJEAnt7g4i3k5"
 	)
-	return t.NewPackage("gmp", version, pkg.NewHTTPGetTar(
-		nil, "https://gcc.gnu.org/pub/gcc/infrastructure/"+
+	return t.NewPackage("gmp", version, newTar(
+		"https://gcc.gnu.org/pub/gcc/infrastructure/"+
 			"gmp-"+version+".tar.bz2",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Env: []string{
@@ -1115,10 +1115,10 @@ func (t Toolchain) newMPFR() (pkg.Artifact, string) {
 		version  = "4.2.2"
 		checksum = "wN3gx0zfIuCn9r3VAn_9bmfvAYILwrRfgBjYSD1IjLqyLrLojNN5vKyQuTE9kA-B"
 	)
-	return t.NewPackage("mpfr", version, pkg.NewHTTPGetTar(
-		nil, "https://gcc.gnu.org/pub/gcc/infrastructure/"+
+	return t.NewPackage("mpfr", version, newTar(
+		"https://gcc.gnu.org/pub/gcc/infrastructure/"+
 			"mpfr-"+version+".tar.bz2",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		GMP,
@@ -1190,10 +1190,10 @@ func (t Toolchain) newGCC() (pkg.Artifact, string) {
 		configureExtra = append(configureExtra, KV{"with-multilib-list", "''"})
 	}
 
-	return t.NewPackage("gcc", version, pkg.NewHTTPGetTar(
-		nil, "https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"+
+	return t.NewPackage("gcc", version, newTar(
+		"https://ftp.tsukuba.wide.ad.jp/software/gcc/releases/"+
 			"gcc-"+version+"/gcc-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Patches: []KV{
diff --git a/internal/rosa/go.go b/internal/rosa/go.go
index c582a1c6..83f9266e 100644
--- a/internal/rosa/go.go
+++ b/internal/rosa/go.go
@@ -21,9 +21,9 @@ cd /work/system/go/src
 chmod -R +w ..
 
 ./make.bash
-`, pkg.Path(AbsUsrSrc.Append("go"), false, pkg.NewHTTPGetTar(
-		nil, "https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz",
-		mustDecode(checksum),
+`, pkg.Path(AbsUsrSrc.Append("go"), false, newTar(
+		"https://dl.google.com/go/go1.4-bootstrap-20171003.tar.gz",
+		checksum,
 		pkg.TarGzip,
 	)))
 }
@@ -55,9 +55,9 @@ ln -s \
 	../go/bin/go \
 	../go/bin/gofmt \
 	/work/system/bin
-`, pkg.Path(AbsUsrSrc.Append("go"), false, pkg.NewHTTPGetTar(
-		nil, "https://go.dev/dl/go"+version+".src.tar.gz",
-		mustDecode(checksum),
+`, pkg.Path(AbsUsrSrc.Append("go"), false, newTar(
+		"https://go.dev/dl/go"+version+".src.tar.gz",
+		checksum,
 		pkg.TarGzip,
 	)))
 }
diff --git a/internal/rosa/hakurei_release.go b/internal/rosa/hakurei_release.go
index 684ee436..1746edac 100644
--- a/internal/rosa/hakurei_release.go
+++ b/internal/rosa/hakurei_release.go
@@ -7,10 +7,10 @@ import "hakurei.app/internal/pkg"
 const hakureiVersion = "0.4.0"
 
 // hakureiSource is the source code of a hakurei release.
-var hakureiSource = pkg.NewHTTPGetTar(
-	nil, "https://git.gensokyo.uk/rosa/hakurei/archive/"+
+var hakureiSource = newTar(
+	"https://git.gensokyo.uk/rosa/hakurei/archive/"+
 		"v"+hakureiVersion+".tar.gz",
-	mustDecode("wfQ9DqCW0Fw9o91wj-I55waoqzB-UqzzuC0_2h-P-1M78SgZ1WHSPCDJMth6EyC2"),
+	"wfQ9DqCW0Fw9o91wj-I55waoqzB-UqzzuC0_2h-P-1M78SgZ1WHSPCDJMth6EyC2",
 	pkg.TarGzip,
 )
 
diff --git a/internal/rosa/kernel.go b/internal/rosa/kernel.go
index 5b92fd50..508c52d5 100644
--- a/internal/rosa/kernel.go
+++ b/internal/rosa/kernel.go
@@ -4,10 +4,10 @@ import "hakurei.app/internal/pkg"
 
 const kernelVersion = "6.12.80"
 
-var kernelSource = pkg.NewHTTPGetTar(
-	nil, "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/"+
+var kernelSource = newTar(
+	"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/"+
 		"snapshot/linux-"+kernelVersion+".tar.gz",
-	mustDecode("_iJEAYoQISJxefuWZYfv0RPWUmHHIjHQw33Fapix-irXrEIREP5ruK37UJW4uMZO"),
+	"_iJEAYoQISJxefuWZYfv0RPWUmHHIjHQw33Fapix-irXrEIREP5ruK37UJW4uMZO",
 	pkg.TarGzip,
 )
 
@@ -1285,11 +1285,11 @@ func (t Toolchain) newFirmware() (pkg.Artifact, string) {
 		version  = "20260309"
 		checksum = "M1az8BxSiOEH3LA11Trc5VAlakwAHhP7-_LKWg6k-SVIzU3xclMDO4Tiujw1gQrC"
 	)
-	return t.NewPackage("firmware", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.com/kernel-firmware/linux-firmware/-/"+
-			"archive/"+version+"/linux-firmware-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("firmware", version, newFromGitLab(
+		"gitlab.com",
+		"kernel-firmware/linux-firmware",
+		version,
+		checksum,
 	), &PackageAttr{
 		// dedup creates temporary file
 		Writable: true,
diff --git a/internal/rosa/kmod.go b/internal/rosa/kmod.go
index ddb2a178..380b3846 100644
--- a/internal/rosa/kmod.go
+++ b/internal/rosa/kmod.go
@@ -7,10 +7,10 @@ func (t Toolchain) newKmod() (pkg.Artifact, string) {
 		version  = "34.2"
 		checksum = "0K7POeTKxMhExsaTsnKAC6LUNsRSfe6sSZxWONPbOu-GI_pXOw3toU_BIoqfBhJV"
 	)
-	return t.NewPackage("kmod", version, pkg.NewHTTPGetTar(
-		nil, "https://www.kernel.org/pub/linux/utils/kernel/"+
+	return t.NewPackage("kmod", version, newTar(
+		"https://www.kernel.org/pub/linux/utils/kernel/"+
 			"kmod/kmod-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), nil, &MesonHelper{
 		Setup: []KV{
diff --git a/internal/rosa/libcap.go b/internal/rosa/libcap.go
index 221053b9..a35a5743 100644
--- a/internal/rosa/libcap.go
+++ b/internal/rosa/libcap.go
@@ -7,10 +7,10 @@ func (t Toolchain) newLibcap() (pkg.Artifact, string) {
 		version  = "2.78"
 		checksum = "wFdUkBhFMD9InPnrBZyegWrlPSAg_9JiTBC-eSFyWWlmbzL2qjh2mKxr9Kx2a8ut"
 	)
-	return t.NewPackage("libcap", version, pkg.NewHTTPGetTar(
-		nil, "https://git.kernel.org/pub/scm/libs/libcap/libcap.git/"+
+	return t.NewPackage("libcap", version, newTar(
+		"https://git.kernel.org/pub/scm/libs/libcap/libcap.git/"+
 			"snapshot/libcap-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// uses source tree as scratch space
diff --git a/internal/rosa/libev.go b/internal/rosa/libev.go
index b4c7fe8a..30e3b8d8 100644
--- a/internal/rosa/libev.go
+++ b/internal/rosa/libev.go
@@ -7,9 +7,9 @@ func (t Toolchain) newLibev() (pkg.Artifact, string) {
 		version  = "4.33"
 		checksum = "774eSXV_4k8PySRprUDChbEwsw-kzjIFnJ3MpNOl5zDpamBRvC3BqPyRxvkwcL6_"
 	)
-	return t.NewPackage("libev", version, pkg.NewHTTPGetTar(
-		nil, "https://dist.schmorp.de/libev/Attic/libev-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libev", version, newTar(
+		"https://dist.schmorp.de/libev/Attic/libev-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
diff --git a/internal/rosa/libexpat.go b/internal/rosa/libexpat.go
index 8adba6ec..457409b5 100644
--- a/internal/rosa/libexpat.go
+++ b/internal/rosa/libexpat.go
@@ -11,11 +11,11 @@ func (t Toolchain) newLibexpat() (pkg.Artifact, string) {
 		version  = "2.7.5"
 		checksum = "vTRUjjg-qbHSXUBYKXgzVHkUO7UNyuhrkSYrE7ikApQm0g-OvQ8tspw4w55M-1Tp"
 	)
-	return t.NewPackage("libexpat", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/libexpat/libexpat/releases/download/"+
-			"R_"+strings.ReplaceAll(version, ".", "_")+"/"+
-			"expat-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("libexpat", version, newFromGitHubRelease(
+		"libexpat/libexpat",
+		"R_"+strings.ReplaceAll(version, ".", "_"),
+		"expat-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		Bash,
diff --git a/internal/rosa/libffi.go b/internal/rosa/libffi.go
index 9a778bfb..0e2c5e14 100644
--- a/internal/rosa/libffi.go
+++ b/internal/rosa/libffi.go
@@ -7,10 +7,11 @@ func (t Toolchain) newLibffi() (pkg.Artifact, string) {
 		version  = "3.5.2"
 		checksum = "2_Q-ZNBBbVhltfL5zEr0wljxPegUimTK4VeMSiwJEGksls3n4gj3lV0Ly3vviSFH"
 	)
-	return t.NewPackage("libffi", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/libffi/libffi/releases/download/"+
-			"v"+version+"/libffi-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libffi", version, newFromGitHubRelease(
+		"libffi/libffi",
+		"v"+version,
+		"libffi-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		KernelHeaders,
diff --git a/internal/rosa/libgd.go b/internal/rosa/libgd.go
index 460cafdf..e92ce9f0 100644
--- a/internal/rosa/libgd.go
+++ b/internal/rosa/libgd.go
@@ -7,10 +7,10 @@ func (t Toolchain) newLibgd() (pkg.Artifact, string) {
 		version  = "2.3.3"
 		checksum = "8T-sh1_FJT9K9aajgxzh8ot6vWIF-xxjcKAHvTak9MgGUcsFfzP8cAvvv44u2r36"
 	)
-	return t.NewPackage("libgd", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/libgd/libgd/releases/download/"+
-			"gd-"+version+"/libgd-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libgd", version, newFromGitHubRelease(
+		"libgd/libgd",
+		"gd-"+version,
+		"libgd-"+version+".tar.gz", checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Env: []string{
diff --git a/internal/rosa/libpsl.go b/internal/rosa/libpsl.go
index 4f1cd40b..43ecdf8b 100644
--- a/internal/rosa/libpsl.go
+++ b/internal/rosa/libpsl.go
@@ -7,10 +7,11 @@ func (t Toolchain) newLibpsl() (pkg.Artifact, string) {
 		version  = "0.21.5"
 		checksum = "XjfxSzh7peG2Vg4vJlL8z4JZJLcXqbuP6pLWkrGCmRxlnYUFTKNBqWGHCxEOlCad"
 	)
-	return t.NewPackage("libpsl", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/rockdaboot/libpsl/releases/download/"+
-			version+"/libpsl-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libpsl", version, newFromGitHubRelease(
+		"rockdaboot/libpsl",
+		version,
+		"libpsl-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Writable: true,
diff --git a/internal/rosa/libseccomp.go b/internal/rosa/libseccomp.go
index 0eb15c1e..d4a9025d 100644
--- a/internal/rosa/libseccomp.go
+++ b/internal/rosa/libseccomp.go
@@ -7,10 +7,11 @@ func (t Toolchain) newLibseccomp() (pkg.Artifact, string) {
 		version  = "2.6.0"
 		checksum = "mMu-iR71guPjFbb31u-YexBaanKE_nYPjPux-vuBiPfS_0kbwJdfCGlkofaUm-EY"
 	)
-	return t.NewPackage("libseccomp", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/seccomp/libseccomp/releases/download/"+
-			"v"+version+"/libseccomp-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("libseccomp", version, newFromGitHubRelease(
+		"seccomp/libseccomp",
+		"v"+version,
+		"libseccomp-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		ScriptEarly: `
diff --git a/internal/rosa/libucontext.go b/internal/rosa/libucontext.go
index 5b267dc7..99e7f8fc 100644
--- a/internal/rosa/libucontext.go
+++ b/internal/rosa/libucontext.go
@@ -7,11 +7,10 @@ func (t Toolchain) newLibucontext() (pkg.Artifact, string) {
 		version  = "1.5"
 		checksum = "Ggk7FMmDNBdCx1Z9PcNWWW6LSpjGYssn2vU0GK5BLXJYw7ZxZbA2m_eSgT9TFnIG"
 	)
-	return t.NewPackage("libucontext", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/kaniini/libucontext/archive/refs/tags/"+
-			"libucontext-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("libucontext", version, newFromGitHub(
+		"kaniini/libucontext",
+		"libucontext-"+version,
+		checksum,
 	), &PackageAttr{
 		// uses source tree as scratch space
 		Writable:    true,
diff --git a/internal/rosa/llvm.go b/internal/rosa/llvm.go
index 6e34eb2f..9d7b3da5 100644
--- a/internal/rosa/llvm.go
+++ b/internal/rosa/llvm.go
@@ -164,11 +164,10 @@ ln -s ld.lld /work/system/bin/ld
 		}...)
 	}
 
-	return t.NewPackage("llvm", llvmVersion, pkg.NewHTTPGetTar(
-		nil, "https://github.com/llvm/llvm-project/archive/refs/tags/"+
-			"llvmorg-"+llvmVersion+".tar.gz",
-		mustDecode(llvmChecksum),
-		pkg.TarGzip,
+	return t.NewPackage("llvm", llvmVersion, newFromGitHub(
+		"llvm/llvm-project",
+		"llvmorg-"+llvmVersion,
+		llvmChecksum,
 	), &PackageAttr{
 		Patches: slices.Concat(attr.patches, []KV{
 			{"increase-stack-size-unconditional", `diff --git a/llvm/lib/Support/Threading.cpp b/llvm/lib/Support/Threading.cpp
diff --git a/internal/rosa/make.go b/internal/rosa/make.go
index dd795c82..5dbfc684 100644
--- a/internal/rosa/make.go
+++ b/internal/rosa/make.go
@@ -20,9 +20,9 @@ cd "$(mktemp -d)"
 	--disable-dependency-tracking
 ./build.sh
 ./make DESTDIR=/work install check
-`, pkg.Path(AbsUsrSrc.Append("make"), false, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/make/make-"+version+".tar.gz",
-		mustDecode(checksum),
+`, pkg.Path(AbsUsrSrc.Append("make"), false, newTar(
+		"https://ftpmirror.gnu.org/gnu/make/make-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	))), version
 }
diff --git a/internal/rosa/mesa.go b/internal/rosa/mesa.go
index 43a95219..33881a29 100644
--- a/internal/rosa/mesa.go
+++ b/internal/rosa/mesa.go
@@ -7,11 +7,11 @@ func (t Toolchain) newLibglvnd() (pkg.Artifact, string) {
 		version  = "1.7.0"
 		checksum = "eIQJK2sgFQDHdeFkQO87TrSUaZRFG4y2DrwA8Ut-sGboI59uw1OOiIVqq2AIwnGY"
 	)
-	return t.NewPackage("libglvnd", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/glvnd/libglvnd/-/archive/"+
-			"v"+version+"/libglvnd-v"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("libglvnd", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"glvnd/libglvnd",
+		"v"+version,
+		checksum,
 	), nil, (*MesonHelper)(nil),
 		Binutils, // symbols check fail with llvm nm
 	), version
@@ -33,11 +33,11 @@ func (t Toolchain) newLibdrm() (pkg.Artifact, string) {
 		version  = "2.4.131"
 		checksum = "riHPSpvTnvCPbR-iT4jt7_X-z4rpwm6oNh9ZN2zP6RBFkFVxBRKmedG4eEXSADIh"
 	)
-	return t.NewPackage("libdrm", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/mesa/libdrm/-/archive/"+
-			"libdrm-"+version+"/libdrm-libdrm-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("libdrm", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"mesa/libdrm",
+		"libdrm-"+version,
+		checksum,
 	), nil, (*MesonHelper)(nil),
 		Binutils, // symbols check fail with llvm nm
 
diff --git a/internal/rosa/meson.go b/internal/rosa/meson.go
index 946c8044..bf7018ca 100644
--- a/internal/rosa/meson.go
+++ b/internal/rosa/meson.go
@@ -23,10 +23,11 @@ python3 setup.py \
 	install \
 	--prefix=/system \
 	--root=/work
-`, pkg.Path(AbsUsrSrc.Append("meson"), true, pkg.NewHTTPGetTar(
-		nil, "https://github.com/mesonbuild/meson/releases/download/"+
-			version+"/meson-"+version+".tar.gz",
-		mustDecode(checksum),
+`, pkg.Path(AbsUsrSrc.Append("meson"), true, newFromGitHubRelease(
+		"mesonbuild/meson",
+		version,
+		"meson-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	))), version
 }
diff --git a/internal/rosa/mksh.go b/internal/rosa/mksh.go
index 1fc10157..fde25270 100644
--- a/internal/rosa/mksh.go
+++ b/internal/rosa/mksh.go
@@ -26,10 +26,9 @@ cp -v lksh /work/system/bin/sh
 
 mkdir -p /work/bin/
 ln -vs ../system/bin/sh /work/bin/
-`, pkg.Path(AbsUsrSrc.Append("mksh"), false, pkg.NewHTTPGetTar(
-		nil,
+`, pkg.Path(AbsUsrSrc.Append("mksh"), false, newTar(
 		"https://mbsd.evolvis.org/MirOS/dist/mir/mksh/mksh-R"+version+".tgz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	))), version
 }
diff --git a/internal/rosa/musl-fts.go b/internal/rosa/musl-fts.go
index 1b12c24b..e27d02cc 100644
--- a/internal/rosa/musl-fts.go
+++ b/internal/rosa/musl-fts.go
@@ -7,11 +7,10 @@ func (t Toolchain) newMuslFts() (pkg.Artifact, string) {
 		version  = "1.2.7"
 		checksum = "N_p_ZApX3eHt7xoDCw1hLf6XdJOw7ZSx7xPvpvAP0knG2zgU0zeN5w8tt5Pg60XJ"
 	)
-	return t.NewPackage("musl-fts", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/void-linux/musl-fts/archive/refs/tags/"+
-			"v"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("musl-fts", version, newFromGitHub(
+		"void-linux/musl-fts",
+		"v"+version,
+		checksum,
 	), &PackageAttr{
 		Env: []string{
 			"CC=cc -fPIC",
diff --git a/internal/rosa/musl-obstack.go b/internal/rosa/musl-obstack.go
index 595d4dbf..fe77ea9b 100644
--- a/internal/rosa/musl-obstack.go
+++ b/internal/rosa/musl-obstack.go
@@ -7,11 +7,10 @@ func (t Toolchain) newMuslObstack() (pkg.Artifact, string) {
 		version  = "1.2.3"
 		checksum = "tVRY_KjIlkkMszcaRlkKdBVQHIXTT_T_TiMxbwErlILXrOBosocg8KklppZhNdCG"
 	)
-	return t.NewPackage("musl-obstack", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/void-linux/musl-obstack/archive/refs/tags/"+
-			"v"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("musl-obstack", version, newFromGitHub(
+		"void-linux/musl-obstack",
+		"v"+version,
+		checksum,
 	), &PackageAttr{
 		Env: []string{
 			"CC=cc -fPIC",
diff --git a/internal/rosa/musl.go b/internal/rosa/musl.go
index 546c6563..f6ad8bb6 100644
--- a/internal/rosa/musl.go
+++ b/internal/rosa/musl.go
@@ -37,9 +37,9 @@ rmdir -v /work/lib
 		helper.Script = ""
 	}
 
-	return t.NewPackage(name, version, pkg.NewHTTPGetTar(
-		nil, "https://musl.libc.org/releases/musl-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage(name, version, newTar(
+		"https://musl.libc.org/releases/musl-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		NonStage0: extra,
diff --git a/internal/rosa/ncurses.go b/internal/rosa/ncurses.go
index ec1022d9..3d15da45 100644
--- a/internal/rosa/ncurses.go
+++ b/internal/rosa/ncurses.go
@@ -7,9 +7,9 @@ func (t Toolchain) newNcurses() (pkg.Artifact, string) {
 		version  = "6.6"
 		checksum = "XvWp4xi6hR_hH8XUoGY26L_pqBSDapJYulhzZqPuR0KNklqypqNc1yNXU-nOjf5w"
 	)
-	return t.NewPackage("ncurses", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/ncurses/ncurses-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("ncurses", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/ncurses/ncurses-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// "tests" are actual demo programs, not a test suite.
diff --git a/internal/rosa/netfilter.go b/internal/rosa/netfilter.go
index 08512681..84570c59 100644
--- a/internal/rosa/netfilter.go
+++ b/internal/rosa/netfilter.go
@@ -7,10 +7,10 @@ func (t Toolchain) newLibmnl() (pkg.Artifact, string) {
 		version  = "1.0.5"
 		checksum = "DN-vbbvQDpxXJm0TJ6xlluILvfrB86avrCTX50XyE9SEFSAZ_o8nuKc5Gu0Am7-u"
 	)
-	return t.NewPackage("libmnl", version, pkg.NewHTTPGetTar(
-		nil, "https://www.netfilter.org/projects/libmnl/files/"+
+	return t.NewPackage("libmnl", version, newTar(
+		"https://www.netfilter.org/projects/libmnl/files/"+
 			"libmnl-"+version+".tar.bz2",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Patches: []KV{
diff --git a/internal/rosa/nettle.go b/internal/rosa/nettle.go
index a9d7f181..7c43d46f 100644
--- a/internal/rosa/nettle.go
+++ b/internal/rosa/nettle.go
@@ -7,9 +7,9 @@ func (t Toolchain) newNettle() (pkg.Artifact, string) {
 		version  = "4.0"
 		checksum = "6agC-vHzzoqAlaX3K9tX8yHgrm03HLqPZzVzq8jh_ePbuPMIvpxereu_uRJFmQK7"
 	)
-	return t.NewPackage("nettle", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("nettle", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		M4,
diff --git a/internal/rosa/nettle3.go b/internal/rosa/nettle3.go
index 3fc3eefd..4ecee9aa 100644
--- a/internal/rosa/nettle3.go
+++ b/internal/rosa/nettle3.go
@@ -7,9 +7,9 @@ func (t Toolchain) newNettle3() (pkg.Artifact, string) {
 		version  = "3.10.2"
 		checksum = "07aXlj10X5llf67jIqRQAA1pgLSgb0w_JYggZVPuKNoc-B-_usb5Kr8FrfBe7g1S"
 	)
-	return t.NewPackage("nettle", version, pkg.NewHTTPGetTar(
-		nil, "https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("nettle", version, newTar(
+		"https://ftpmirror.gnu.org/gnu/nettle/nettle-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		M4,
diff --git a/internal/rosa/ninja.go b/internal/rosa/ninja.go
index bcb7f85c..9302ba4d 100644
--- a/internal/rosa/ninja.go
+++ b/internal/rosa/ninja.go
@@ -21,17 +21,17 @@ python3 /usr/src/ninja/configure.py \
 mkdir -p /work/system/bin/
 cp ninja /work/system/bin/
 `, pkg.Path(AbsUsrSrc.Append("googletest"), false,
-		pkg.NewHTTPGetTar(
-			nil, "https://github.com/google/googletest/releases/download/"+
-				"v1.16.0/googletest-1.16.0.tar.gz",
-			mustDecode("NjLGvSbgPy_B-y-o1hdanlzEzaYeStFcvFGxpYV3KYlhrWWFRcugYhM3ZMzOA9B_"),
+		newFromGitHubRelease(
+			"google/googletest",
+			"v1.16.0",
+			"googletest-1.16.0.tar.gz",
+			"NjLGvSbgPy_B-y-o1hdanlzEzaYeStFcvFGxpYV3KYlhrWWFRcugYhM3ZMzOA9B_",
 			pkg.TarGzip,
 		)), pkg.Path(AbsUsrSrc.Append("ninja"), true, t.NewPatchedSource(
-		"ninja", version, pkg.NewHTTPGetTar(
-			nil, "https://github.com/ninja-build/ninja/archive/refs/tags/"+
-				"v"+version+".tar.gz",
-			mustDecode(checksum),
-			pkg.TarGzip,
+		"ninja", version, newFromGitHub(
+			"ninja-build/ninja",
+			"v"+version,
+			checksum,
 		), false,
 	))), version
 }
diff --git a/internal/rosa/nss.go b/internal/rosa/nss.go
index 9b7c8c45..fe35dfdf 100644
--- a/internal/rosa/nss.go
+++ b/internal/rosa/nss.go
@@ -14,11 +14,10 @@ func (t Toolchain) newNSS() (pkg.Artifact, string) {
 		version0  = "4_38_2"
 		checksum0 = "25x2uJeQnOHIiq_zj17b4sYqKgeoU8-IsySUptoPcdHZ52PohFZfGuIisBreWzx0"
 	)
-	return t.NewPackage("nss", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/nss-dev/nss/archive/refs/tags/"+
-			"NSS_"+strings.Join(strings.SplitN(version, ".", 2), "_")+"_RTM.tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.NewPackage("nss", version, newFromGitHub(
+		"nss-dev/nss",
+		"NSS_"+strings.Join(strings.SplitN(version, ".", 2), "_")+"_RTM",
+		checksum,
 	), &PackageAttr{
 		Paths: []pkg.ExecPath{
 			pkg.Path(AbsUsrSrc.Append("nspr.zip"), false, pkg.NewHTTPGet(
diff --git a/internal/rosa/openssl.go b/internal/rosa/openssl.go
index cdc91584..6c79019b 100644
--- a/internal/rosa/openssl.go
+++ b/internal/rosa/openssl.go
@@ -7,10 +7,11 @@ func (t Toolchain) newOpenSSL() (pkg.Artifact, string) {
 		version  = "3.6.2"
 		checksum = "jH004dXTiE01Hp0kyShkWXwrSHEksZi4i_3v47D9H9Uz9LQ1aMwF7mrl2Tb4t_XA"
 	)
-	return t.NewPackage("openssl", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/openssl/openssl/releases/download/"+
-			"openssl-"+version+"/openssl-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("openssl", version, newFromGitHubRelease(
+		"openssl/openssl",
+		"openssl-"+version,
+		"openssl-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Env: []string{
diff --git a/internal/rosa/pcre2.go b/internal/rosa/pcre2.go
index cb4091f9..8aa89514 100644
--- a/internal/rosa/pcre2.go
+++ b/internal/rosa/pcre2.go
@@ -9,10 +9,11 @@ func (t Toolchain) newPCRE2() (pkg.Artifact, string) {
 		version  = "10.47"
 		checksum = "IbC24vVayju6nB9EhrBPSDexk22wDecdpyrjgC3nCZXkwTnUjq4CD2q5sopqu6CW"
 	)
-	return t.NewPackage("pcre2", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/PCRE2Project/pcre2/releases/download/"+
-			"pcre2-"+version+"/pcre2-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("pcre2", version, newFromGitHubRelease(
+		"PCRE2Project/pcre2",
+		"pcre2-"+version,
+		"pcre2-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		ScriptEarly: `
diff --git a/internal/rosa/perl.go b/internal/rosa/perl.go
index 19a224a8..622171fa 100644
--- a/internal/rosa/perl.go
+++ b/internal/rosa/perl.go
@@ -11,9 +11,9 @@ func (t Toolchain) newPerl() (pkg.Artifact, string) {
 		version  = "5.42.2"
 		checksum = "Me_xFfgkRnVyG0sE6a74TktK2OUq9Z1LVJNEu_9RdZG3S2fbjfzNiuk2SJqHAgbm"
 	)
-	return t.NewPackage("perl", version, pkg.NewHTTPGetTar(
-		nil, "https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("perl", version, newTar(
+		"https://www.cpan.org/src/5.0/perl-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// uses source tree as scratch space
@@ -91,10 +91,10 @@ func (t Toolchain) newPerlModuleBuild() (pkg.Artifact, string) {
 		version  = "0.4234"
 		checksum = "ZKxEFG4hE1rqZt52zBL2LRZBMkYzhjb5-cTBXcsyA52EbPeeYyVxU176yAea8-Di"
 	)
-	return t.newViaPerlModuleBuild("Module-Build", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/L/LE/LEONT/"+
+	return t.newViaPerlModuleBuild("Module-Build", version, newTar(
+		"https://cpan.metacpan.org/authors/id/L/LE/LEONT/"+
 			"Module-Build-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), nil), version
 }
@@ -145,11 +145,11 @@ func (t Toolchain) newPerlLocaleGettext() (pkg.Artifact, string) {
 		version  = "1.07"
 		checksum = "cFq4BKFD1MWSoa7lsrPjpdo9kzPqd0jlRcBFUyL1L1isw8m3D_Sge_ff0MAu_9J3"
 	)
-	return t.newViaPerlMakeMaker("Locale::gettext", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/P/PV/PVANDRY/"+
-			"Locale-gettext-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Locale::gettext", version, newFromCPAN(
+		"PVANDRY",
+		"Locale-gettext",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -167,11 +167,11 @@ func (t Toolchain) newPerlPodParser() (pkg.Artifact, string) {
 		version  = "1.67"
 		checksum = "RdURu9mOfExk_loCp6abxlcQV3FycSNbTqhRS9i6JUqnYfGGEgercK30g0gjYyqe"
 	)
-	return t.newViaPerlMakeMaker("Pod::Parser", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/M/MA/MAREKR/"+
-			"Pod-Parser-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Pod::Parser", version, newFromCPAN(
+		"MAREKR",
+		"Pod-Parser",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -189,11 +189,11 @@ func (t Toolchain) newPerlSGMLS() (pkg.Artifact, string) {
 		version  = "1.1"
 		checksum = "aZijn4MUqD-wfyZgdcCruCwl4SgDdu25cNmJ4_UvdAk9a7uz4gzMQdoeB6DQ6QOy"
 	)
-	return t.newViaPerlMakeMaker("SGMLS", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/R/RA/RAAB/"+
-			"SGMLSpm-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("SGMLS", version, newFromCPAN(
+		"RAAB",
+		"SGMLSpm",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -211,11 +211,11 @@ func (t Toolchain) newPerlTermReadKey() (pkg.Artifact, string) {
 		version  = "2.38"
 		checksum = "qerL8Xo7kD0f42PZoiEbmE8Roc_S9pOa27LXelY4DN_0UNy_u5wLrGHI8utNlaiI"
 	)
-	return t.newViaPerlMakeMaker("Term::ReadKey", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/J/JS/JSTOWE/"+
-			"TermReadKey-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Term::ReadKey", version, newFromCPAN(
+		"JSTOWE",
+		"TermReadKey",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -233,11 +233,11 @@ func (t Toolchain) newPerlTextCharWidth() (pkg.Artifact, string) {
 		version  = "0.04"
 		checksum = "G2p5RHU4_HiZ23ZusBA_enTlVMxz0J4esUx4CGcOPhY6xYTbp-aXWRN6lYZpzBw2"
 	)
-	return t.newViaPerlMakeMaker("Text::CharWidth", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/K/KU/KUBOTA/"+
-			"Text-CharWidth-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Text::CharWidth", version, newFromCPAN(
+		"KUBOTA",
+		"Text-CharWidth",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -255,11 +255,11 @@ func (t Toolchain) newPerlTextWrapI18N() (pkg.Artifact, string) {
 		version  = "0.06"
 		checksum = "Vmo89qLgxUqyQ6QmWJVqu60aQAUjrNKRjFQSXGnvClxofzRjiCa6idzPgJ4VkixM"
 	)
-	return t.newViaPerlMakeMaker("Text::WrapI18N", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/K/KU/KUBOTA/"+
-			"Text-WrapI18N-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Text::WrapI18N", version, newFromCPAN(
+		"KUBOTA",
+		"Text-WrapI18N",
+		version,
+		checksum,
 	), nil,
 		PerlTextCharWidth,
 	), version
@@ -283,11 +283,11 @@ func (t Toolchain) newPerlMIMECharset() (pkg.Artifact, string) {
 		version  = "1.013.1"
 		checksum = "Ou_ukcrOa1cgtE3mptinb-os3bdL1SXzbRDFZQF3prrJj-drc3rp_huay7iDLJol"
 	)
-	return t.newViaPerlMakeMaker("MIME::Charset", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/N/NE/NEZUMI/"+
-			"MIME-Charset-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("MIME::Charset", version, newFromCPAN(
+		"NEZUMI",
+		"MIME-Charset",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
@@ -300,25 +300,25 @@ func init() {
 	}
 }
 
-func (t Toolchain) newPerlUnicodeGCString() (pkg.Artifact, string) {
+func (t Toolchain) newPerlUnicodeLineBreak() (pkg.Artifact, string) {
 	const (
 		version  = "2019.001"
 		checksum = "ZHVkh7EDgAUHnTpvXsnPAuWpgNoBImtY_9_8TIbo2co_WgUwEb0MtXPhI8pAZ5OH"
 	)
-	return t.newViaPerlMakeMaker("Unicode::GCString", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/N/NE/NEZUMI/"+
-			"Unicode-LineBreak-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("Unicode::LineBreak", version, newFromCPAN(
+		"NEZUMI",
+		"Unicode-LineBreak",
+		version,
+		checksum,
 	), nil,
 		PerlMIMECharset,
 	), version
 }
 func init() {
-	artifactsM[PerlUnicodeGCString] = Metadata{
-		f: Toolchain.newPerlUnicodeGCString,
+	artifactsM[PerlUnicodeLineBreak] = Metadata{
+		f: Toolchain.newPerlUnicodeLineBreak,
 
-		Name:        "perl-Unicode::GCString",
+		Name:        "perl-Unicode::LineBreak",
 		Description: "String as Sequence of UAX #29 Grapheme Clusters",
 		Website:     "https://metacpan.org/release/Unicode-LineBreak",
 
@@ -333,11 +333,11 @@ func (t Toolchain) newPerlYAMLTiny() (pkg.Artifact, string) {
 		version  = "1.76"
 		checksum = "V1MV4KPym1LxSw8CRXqPR3K-l1hGHbT5Ob4t-9xju6R9X_CWyw6hI8wsMaNdHdBY"
 	)
-	return t.newViaPerlMakeMaker("YAML::Tiny", version, pkg.NewHTTPGetTar(
-		nil, "https://cpan.metacpan.org/authors/id/E/ET/ETHER/"+
-			"YAML-Tiny-"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+	return t.newViaPerlMakeMaker("YAML::Tiny", version, newFromCPAN(
+		"ETHER",
+		"YAML-Tiny",
+		version,
+		checksum,
 	), nil), version
 }
 func init() {
diff --git a/internal/rosa/pkg-config.go b/internal/rosa/pkg-config.go
index f0f219cf..cea1992c 100644
--- a/internal/rosa/pkg-config.go
+++ b/internal/rosa/pkg-config.go
@@ -7,11 +7,11 @@ func (t Toolchain) newPkgConfig() (pkg.Artifact, string) {
 		version  = "0.29.2"
 		checksum = "6UsGqEMA8EER_5b9N0b32UCqiRy39B6_RnPfvuslWhtFV1qYD4DfS10crGZN_TP2"
 	)
-	return t.NewPackage("pkg-config", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/pkg-config/pkg-config/-/archive"+
-			"/pkg-config-"+version+"/pkg-config-pkg-config-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("pkg-config", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"pkg-config/pkg-config",
+		"pkg-config-"+version,
+		checksum,
 	), nil, &MakeHelper{
 		Generate: "./autogen.sh --no-configure",
 		Configure: []KV{
diff --git a/internal/rosa/procps.go b/internal/rosa/procps.go
index e7a70882..c5dc01b4 100644
--- a/internal/rosa/procps.go
+++ b/internal/rosa/procps.go
@@ -7,11 +7,11 @@ func (t Toolchain) newProcps() (pkg.Artifact, string) {
 		version  = "4.0.6"
 		checksum = "pl_fZLvDlv6iZTkm8l_tHFpzTDVFGCiSJEs3eu0zAX6u36AV36P_En8K7JPScRWM"
 	)
-	return t.NewPackage("procps", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.com/procps-ng/procps/-/archive/"+
-			"v"+version+"/procps-v"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("procps", version, newFromGitLab(
+		"gitlab.com",
+		"procps-ng/procps",
+		"v"+version,
+		checksum,
 	), nil, &MakeHelper{
 		Generate: "./autogen.sh",
 		Configure: []KV{
diff --git a/internal/rosa/python.go b/internal/rosa/python.go
index 373f7fcf..ce5ca365 100644
--- a/internal/rosa/python.go
+++ b/internal/rosa/python.go
@@ -13,10 +13,10 @@ func (t Toolchain) newPython() (pkg.Artifact, string) {
 		version  = "3.14.4"
 		checksum = "X0VRAAGOlCVldh4J9tRAE-YrJtDvqfQTJaqxKPXNX6YTPlwpR9GwA5WRIZDO-63s"
 	)
-	return t.NewPackage("python", version, pkg.NewHTTPGetTar(
-		nil, "https://www.python.org/ftp/python/"+version+
+	return t.NewPackage("python", version, newTar(
+		"https://www.python.org/ftp/python/"+version+
 			"/Python-"+version+".tgz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// test_synopsis_sourceless assumes this is writable and checks __pycache__
@@ -142,11 +142,9 @@ pip3 install \
 	--prefix=/system \
 	--root=/work \
 	/usr/src/setuptools
-`, pkg.Path(AbsUsrSrc.Append("setuptools"), true, pkg.NewHTTPGetTar(
-		nil, "https://github.com/pypa/setuptools/archive/refs/tags/"+
-			"v"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+`, pkg.Path(AbsUsrSrc.Append("setuptools"), true, newFromGitHub(
+		"pypa/setuptools",
+		"v"+version, checksum,
 	))), version
 }
 func init() {
diff --git a/internal/rosa/qemu.go b/internal/rosa/qemu.go
index 40e95c8a..1b561286 100644
--- a/internal/rosa/qemu.go
+++ b/internal/rosa/qemu.go
@@ -7,9 +7,9 @@ func (t Toolchain) newQEMU() (pkg.Artifact, string) {
 		version  = "10.2.2"
 		checksum = "uNzRxlrVoLWe-EmZmBp75SezymgE512iE5XN90Bl7wi6CjE_oQGQB-9ocs7E16QG"
 	)
-	return t.NewPackage("qemu", version, pkg.NewHTTPGetTar(
-		nil, "https://download.qemu.org/qemu-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("qemu", version, newTar(
+		"https://download.qemu.org/qemu-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), &PackageAttr{
 		Patches: []KV{
diff --git a/internal/rosa/rdfind.go b/internal/rosa/rdfind.go
index e3792375..da2c3ddb 100644
--- a/internal/rosa/rdfind.go
+++ b/internal/rosa/rdfind.go
@@ -7,9 +7,9 @@ func (t Toolchain) newRdfind() (pkg.Artifact, string) {
 		version  = "1.8.0"
 		checksum = "PoaeJ2WIG6yyfe5VAYZlOdAQiR3mb3WhAUMj2ziTCx_IIEal4640HMJUb4SzU9U3"
 	)
-	return t.NewPackage("rdfind", version, pkg.NewHTTPGetTar(
-		nil, "https://rdfind.pauldreik.se/rdfind-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("rdfind", version, newTar(
+		"https://rdfind.pauldreik.se/rdfind-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// test suite hard codes /bin/echo
diff --git a/internal/rosa/rosa.go b/internal/rosa/rosa.go
index 556ed44b..c70774d2 100644
--- a/internal/rosa/rosa.go
+++ b/internal/rosa/rosa.go
@@ -4,6 +4,7 @@ package rosa
 import (
 	"errors"
 	"log"
+	"path"
 	"runtime"
 	"slices"
 	"strconv"
@@ -603,3 +604,54 @@ cd '/usr/src/` + name + `/'
 		})...,
 	)
 }
+
+// newTar wraps [pkg.NewHTTPGetTar] with a simpler function signature.
+func newTar(url, checksum string, compression uint32) pkg.Artifact {
+	return pkg.NewHTTPGetTar(nil, url, mustDecode(checksum), compression)
+}
+
+// newFromCPAN is a helper for downloading release from CPAN.
+func newFromCPAN(author, name, version, checksum string) pkg.Artifact {
+	return newTar(
+		"https://cpan.metacpan.org/authors/id/"+
+			author[:1]+"/"+author[:2]+"/"+author+"/"+
+			name+"-"+version+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	)
+}
+
+// newFromGitLab is a helper for downloading source from GitLab.
+func newFromGitLab(domain, suffix, ref, checksum string) pkg.Artifact {
+	return newTar(
+		"https://"+domain+"/"+suffix+"/-/archive/"+
+			ref+"/"+path.Base(suffix)+"-"+
+			strings.ReplaceAll(ref, "/", "-")+".tar.bz2",
+		checksum,
+		pkg.TarBzip2,
+	)
+}
+
+// newFromGitHub is a helper for downloading source from Microsoft Github.
+func newFromGitHub(suffix, tag, checksum string) pkg.Artifact {
+	return newTar(
+		"https://github.com/"+suffix+
+			"/archive/refs/tags/"+tag+".tar.gz",
+		checksum,
+		pkg.TarGzip,
+	)
+}
+
+// newFromGitHubRelease is a helper for downloading release tarball from
+// Microsoft Github.
+func newFromGitHubRelease(
+	suffix, tag, name, checksum string,
+	compression uint32,
+) pkg.Artifact {
+	return newTar(
+		"https://github.com/"+suffix+
+			"/releases/download/"+tag+"/"+name,
+		checksum,
+		compression,
+	)
+}
diff --git a/internal/rosa/rsync.go b/internal/rosa/rsync.go
index 1bf5cf60..fa9cb889 100644
--- a/internal/rosa/rsync.go
+++ b/internal/rosa/rsync.go
@@ -7,10 +7,10 @@ func (t Toolchain) newRsync() (pkg.Artifact, string) {
 		version  = "3.4.1"
 		checksum = "VBlTsBWd9z3r2-ex7GkWeWxkUc5OrlgDzikAC0pK7ufTjAJ0MbmC_N04oSVTGPiv"
 	)
-	return t.NewPackage("rsync", version, pkg.NewHTTPGetTar(
-		nil, "https://download.samba.org/pub/rsync/src/"+
+	return t.NewPackage("rsync", version, newTar(
+		"https://download.samba.org/pub/rsync/src/"+
 			"rsync-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		Flag: TEarly,
diff --git a/internal/rosa/squashfs.go b/internal/rosa/squashfs.go
index 43c9f2e4..3ac6e6d0 100644
--- a/internal/rosa/squashfs.go
+++ b/internal/rosa/squashfs.go
@@ -7,10 +7,11 @@ func (t Toolchain) newSquashfsTools() (pkg.Artifact, string) {
 		version  = "4.7.5"
 		checksum = "rF52wLQP-jeAmcD-48wqJcck8ZWRFwkax3T-7snaRf5EBnCQQh0YypMY9lwcivLz"
 	)
-	return t.NewPackage("squashfs-tools", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/plougher/squashfs-tools/releases/"+
-			"download/"+version+"/squashfs-tools-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("squashfs-tools", version, newFromGitHubRelease(
+		"plougher/squashfs-tools",
+		version,
+		"squashfs-tools-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// uses source tree as scratch space
diff --git a/internal/rosa/stage0.go b/internal/rosa/stage0.go
index b1e217f5..0fc0f8f7 100644
--- a/internal/rosa/stage0.go
+++ b/internal/rosa/stage0.go
@@ -60,14 +60,14 @@ var (
 // NewStage0 returns a stage0 distribution created from curing [Stage0].
 func NewStage0() pkg.Artifact {
 	stage0Once.Do(func() {
-		stage0 = pkg.NewHTTPGetTar(
-			nil, "https://hakurei.app/seed/20260210/"+
+		stage0 = newTar(
+			"https://hakurei.app/seed/20260210/"+
 				"stage0-"+triplet()+".tar.bz2",
-			mustDecode(perArch[string]{
+			perArch[string]{
 				"amd64":   "tqM1Li15BJ-uFG8zU-XjgFxoN_kuzh1VxrSDVUVa0vGmo-NeWapSftH739sY8EAg",
 				"arm64":   "CJj3ZSnRyLmFHlWIQtTPQD9oikOZY4cD_mI3v_-LIYc2hhg-cq_CZFBLzQBAkFIn",
 				"riscv64": "FcszJjcVWdKAnn-bt8qmUn5GUUTjv_xQjXOWkUpOplRkG3Ckob3StUoAi5KQ5-QF",
-			}.unwrap()),
+			}.unwrap(),
 			pkg.TarBzip2,
 		)
 	})
diff --git a/internal/rosa/tamago.go b/internal/rosa/tamago.go
index 7a082cbd..594a91e0 100644
--- a/internal/rosa/tamago.go
+++ b/internal/rosa/tamago.go
@@ -31,11 +31,10 @@ rm \
 	os/root_unix_test.go
 
 ./all.bash
-`, pkg.Path(AbsUsrSrc.Append("tamago"), false, pkg.NewHTTPGetTar(
-		nil, "https://github.com/usbarmory/tamago-go/archive/refs/tags/"+
-			"tamago-go"+version+".tar.gz",
-		mustDecode(checksum),
-		pkg.TarGzip,
+`, pkg.Path(AbsUsrSrc.Append("tamago"), false, newFromGitHub(
+		"usbarmory/tamago-go",
+		"tamago-go"+version,
+		checksum,
 	))), version
 }
 func init() {
diff --git a/internal/rosa/toybox.go b/internal/rosa/toybox.go
index 86a66246..7a86fb80 100644
--- a/internal/rosa/toybox.go
+++ b/internal/rosa/toybox.go
@@ -7,9 +7,9 @@ func (t Toolchain) newToybox(suffix, script string) (pkg.Artifact, string) {
 		version  = "0.8.13"
 		checksum = "rZ1V1ATDte2WeQZanxLVoiRGdfPXhMlEo5-exX-e-ml8cGn9qOv0ABEUVZpX3wTI"
 	)
-	return t.NewPackage("toybox"+suffix, version, pkg.NewHTTPGetTar(
-		nil, "https://landley.net/toybox/downloads/toybox-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("toybox"+suffix, version, newTar(
+		"https://landley.net/toybox/downloads/toybox-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		// uses source tree as scratch space
diff --git a/internal/rosa/unzip.go b/internal/rosa/unzip.go
index b8fa3de3..7dd8f01c 100644
--- a/internal/rosa/unzip.go
+++ b/internal/rosa/unzip.go
@@ -22,11 +22,11 @@ make -f unix/Makefile generic1
 mkdir -p /work/system/bin/
 mv unzip /work/system/bin/
 `, pkg.Path(AbsUsrSrc.Append("unzip"), true, t.NewPatchedSource(
-		"unzip", version, pkg.NewHTTPGetTar(
-			nil, "https://downloads.sourceforge.net/project/infozip/"+
+		"unzip", version, newTar(
+			"https://downloads.sourceforge.net/project/infozip/"+
 				"UnZip%206.x%20%28latest%29/UnZip%20"+version+"/"+
 				"unzip"+strings.ReplaceAll(version, ".", "")+".tar.gz",
-			mustDecode(checksum),
+			checksum,
 			pkg.TarGzip,
 		), false,
 	))), version
diff --git a/internal/rosa/util-linux.go b/internal/rosa/util-linux.go
index 39e3ceb1..08075bc8 100644
--- a/internal/rosa/util-linux.go
+++ b/internal/rosa/util-linux.go
@@ -11,11 +11,11 @@ func (t Toolchain) newUtilLinux() (pkg.Artifact, string) {
 		version  = "2.42"
 		checksum = "Uy8Nxg9DsW5YwDoeaZeZTyQJ2YmnaaL_fSsQXsLUiFFUd7wnZeD_3SEaVO7ClJlk"
 	)
-	return t.NewPackage("util-linux", version, pkg.NewHTTPGetTar(
-		nil, "https://www.kernel.org/pub/linux/utils/util-linux/"+
+	return t.NewPackage("util-linux", version, newTar(
+		"https://www.kernel.org/pub/linux/utils/util-linux/"+
 			"v"+strings.Join(strings.SplitN(version, ".", 3)[:2], ".")+
 			"/util-linux-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), &PackageAttr{
 		ScriptEarly: `
diff --git a/internal/rosa/wayland.go b/internal/rosa/wayland.go
index 573b9785..3e77f52e 100644
--- a/internal/rosa/wayland.go
+++ b/internal/rosa/wayland.go
@@ -7,11 +7,11 @@ func (t Toolchain) newWayland() (pkg.Artifact, string) {
 		version  = "1.25.0"
 		checksum = "q-4dYXme46JPgLGtXAxyZGTy7udll9RfT0VXtcW2YRR1WWViUhvdZXZneXzLqpCg"
 	)
-	return t.NewPackage("wayland", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/wayland/wayland/"+
-			"-/archive/"+version+"/wayland-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("wayland", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"wayland/wayland",
+		version,
+		checksum,
 	), &PackageAttr{
 		Writable: true,
 		ScriptEarly: `
@@ -57,11 +57,11 @@ func (t Toolchain) newWaylandProtocols() (pkg.Artifact, string) {
 		version  = "1.48"
 		checksum = "xvfHCBIzXGwOqOu9b8dfhGw_U29Pd-g4JBwpYIaxee8SwEbxi6NaVU-Y1Q7wY4jK"
 	)
-	return t.NewPackage("wayland-protocols", version, pkg.NewHTTPGetTar(
-		nil, "https://gitlab.freedesktop.org/wayland/wayland-protocols/"+
-			"-/archive/"+version+"/wayland-protocols-"+version+".tar.bz2",
-		mustDecode(checksum),
-		pkg.TarBzip2,
+	return t.NewPackage("wayland-protocols", version, newFromGitLab(
+		"gitlab.freedesktop.org",
+		"wayland/wayland-protocols",
+		version,
+		checksum,
 	), &PackageAttr{
 		Patches: []KV{
 			{"build-only", `From 8b4c76275fa1b6e0a99a53494151d9a2c907144d Mon Sep 17 00:00:00 2001
diff --git a/internal/rosa/x.go b/internal/rosa/x.go
index 85abeeab..23ec203e 100644
--- a/internal/rosa/x.go
+++ b/internal/rosa/x.go
@@ -7,10 +7,10 @@ func (t Toolchain) newUtilMacros() (pkg.Artifact, string) {
 		version  = "1.20.2"
 		checksum = "Ze8QH3Z3emC0pWFP-0nUYeMy7aBW3L_dxBBmVgcumIHNzEKc1iGTR-yUFR3JcM1G"
 	)
-	return t.NewPackage("util-macros", version, pkg.NewHTTPGetTar(
-		nil, "https://www.x.org/releases/individual/util/"+
+	return t.NewPackage("util-macros", version, newTar(
+		"https://www.x.org/releases/individual/util/"+
 			"util-macros-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil)), version
 }
@@ -31,10 +31,10 @@ func (t Toolchain) newXproto() (pkg.Artifact, string) {
 		version  = "7.0.31"
 		checksum = "Cm69urWY5RctKpR78eGzuwrjDEfXGkvHRdodj6sjypOGy5FF4-lmnUttVHYV1ydg"
 	)
-	return t.NewPackage("xproto", version, pkg.NewHTTPGetTar(
-		nil, "https://www.x.org/releases/individual/proto/"+
+	return t.NewPackage("xproto", version, newTar(
+		"https://www.x.org/releases/individual/proto/"+
 			"xproto-"+version+".tar.bz2",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarBzip2,
 	), nil, &MakeHelper{
 		// ancient configure script
@@ -63,10 +63,10 @@ func (t Toolchain) newLibXau() (pkg.Artifact, string) {
 		version  = "1.0.12"
 		checksum = "G9AjnU_C160q814MCdjFOVt_mQz_pIt4wf4GNOQmGJS3UuuyMw53sfPvJ7WOqwXN"
 	)
-	return t.NewPackage("libXau", version, pkg.NewHTTPGetTar(
-		nil, "https://www.x.org/releases/individual/lib/"+
+	return t.NewPackage("libXau", version, newTar(
+		"https://www.x.org/releases/individual/lib/"+
 			"libXau-"+version+".tar.gz",
-		mustDecode(checksum),
+		checksum,
 		pkg.TarGzip,
 	), nil, &MakeHelper{
 		// ancient configure script
diff --git a/internal/rosa/xcb.go b/internal/rosa/xcb.go
index 1f3a944a..1d00a2a0 100644
--- a/internal/rosa/xcb.go
+++ b/internal/rosa/xcb.go
@@ -7,9 +7,9 @@ func (t Toolchain) newXCBProto() (pkg.Artifact, string) {
 		version  = "1.17.0"
 		checksum = "_NtbKaJ_iyT7XiJz25mXQ7y-niTzE8sHPvLXZPcqtNoV_-vTzqkezJ8Hp2U1enCv"
 	)
-	return t.NewPackage("xcb-proto", version, pkg.NewHTTPGetTar(
-		nil, "https://xcb.freedesktop.org/dist/xcb-proto-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("xcb-proto", version, newTar(
+		"https://xcb.freedesktop.org/dist/xcb-proto-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Python,
@@ -32,9 +32,9 @@ func (t Toolchain) newXCB() (pkg.Artifact, string) {
 		version  = "1.17.0"
 		checksum = "hjjsc79LpWM_hZjNWbDDS6qRQUXREjjekS6UbUsDq-RR1_AjgNDxhRvZf-1_kzDd"
 	)
-	return t.NewPackage("xcb", version, pkg.NewHTTPGetTar(
-		nil, "https://xcb.freedesktop.org/dist/libxcb-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("xcb", version, newTar(
+		"https://xcb.freedesktop.org/dist/libxcb-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, (*MakeHelper)(nil),
 		Python,
diff --git a/internal/rosa/xz.go b/internal/rosa/xz.go
index 3a94623c..a211bded 100644
--- a/internal/rosa/xz.go
+++ b/internal/rosa/xz.go
@@ -7,10 +7,11 @@ func (t Toolchain) newXZ() (pkg.Artifact, string) {
 		version  = "5.8.3"
 		checksum = "nCdayphPGdIdVoAZ2hR4vYlhDG9LeVKho_i7ealTud4Vxy5o5dWe0VwFlN7utuUL"
 	)
-	return t.NewPackage("xz", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/tukaani-project/xz/releases/download/"+
-			"v"+version+"/xz-"+version+".tar.bz2",
-		mustDecode(checksum),
+	return t.NewPackage("xz", version, newFromGitHubRelease(
+		"tukaani-project/xz",
+		"v"+version,
+		"xz-"+version+".tar.bz2",
+		checksum,
 		pkg.TarBzip2,
 	), nil, (*MakeHelper)(nil),
 		Diffutils,
diff --git a/internal/rosa/zlib.go b/internal/rosa/zlib.go
index 3d5d14f0..7ec605ba 100644
--- a/internal/rosa/zlib.go
+++ b/internal/rosa/zlib.go
@@ -7,9 +7,9 @@ func (t Toolchain) newZlib() (pkg.Artifact, string) {
 		version  = "1.3.2"
 		checksum = "KHZrePe42vL2XvOUE3KlJkp1UgWhWkl0jjT_BOvFhuM4GzieEH9S7CioepOFVGYB"
 	)
-	return t.NewPackage("zlib", version, pkg.NewHTTPGetTar(
-		nil, "https://www.zlib.net/fossils/zlib-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("zlib", version, newTar(
+		"https://www.zlib.net/fossils/zlib-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &CMakeHelper{
 		Cache: []KV{
diff --git a/internal/rosa/zstd.go b/internal/rosa/zstd.go
index 9e39d3cf..0a3043df 100644
--- a/internal/rosa/zstd.go
+++ b/internal/rosa/zstd.go
@@ -7,10 +7,11 @@ func (t Toolchain) newZstd() (pkg.Artifact, string) {
 		version  = "1.5.7"
 		checksum = "4XhfR7DwVkwo1R-TmYDAJOcx9YXv9WSFhcFUe3hWEAMmdMLPhFaznCqYIA19_xxV"
 	)
-	return t.NewPackage("zstd", version, pkg.NewHTTPGetTar(
-		nil, "https://github.com/facebook/zstd/releases/download/"+
-			"v"+version+"/zstd-"+version+".tar.gz",
-		mustDecode(checksum),
+	return t.NewPackage("zstd", version, newFromGitHubRelease(
+		"facebook/zstd",
+		"v"+version,
+		"zstd-"+version+".tar.gz",
+		checksum,
 		pkg.TarGzip,
 	), nil, &CMakeHelper{
 		Append: []string{"build", "cmake"},