There is wip/mk/git-package.mk which is intended to ease building packages of upstream distributions that don't have real releases. I'm not sure if that's needed, or if the tarball-on-demand service is ok and the only issue is https. I think FETCH_USING=curl will allow https downloads.
Attachment:
pgpf4XyTiQwgP.pgp
Description: PGP signature