Most of the source tarballs are retrieved via http, but a few remain that are still downloaded via ftp. This causes some pain with corporate firewalls, so moving the last two URIs to http helps ease the build process.
Thanks for the patch!
Will apply with minor change: prefer https for sourceware.org.
Unfortunately, can't do the same for xmlsoft.org, because they are sharing same host with libvirt.org, but there is a misconfiguration in web server settings, so https://xmlsoft.org is actually a libvirt =\