The source code for resolving dependencies in bob.jar can be found here:
As you can see, it is a java.net.HttpURLConnection that is used, which means that it can be loaded from literally any URL.
java.net.HttpURLConnection