The source distribution contains binaries (probably for testing) that
make the Avira virus scanner treat it as malware on account of a “bad
ELF header”. Apart from being preferable in general, the HTTPS download
makes the file opaque to the overeager AV scanner in transparent
proxying setups.
Also adapt to the fact that the canonical downloads now point to a URL
like this:
https://releases.llvm.org/4.0.1/llvm-4.0.1.src.tar.xz
0e2e3afd65