OpenSSL is the last instance where the build downloads content. I think it's possible to change the external project to use a submodule, and perhaps switch to an out-of-source build. I can experiment with this later in the week. But I may fumble around due to lack of experience with the external project methods/macros.