Why not just /src/mariux/downloads or /src/mariux/patches ? I don't see the advantage of the md5 tree.

• security
• availability.
• the identity and source of the files in downloads|patches is unstable
• there are packages which have a github realease, assets or otherwse stored source URL and all with the same name, but different contents
• there is no check (yet) to prove "this package has been build with this downloaded file"
• once in a while you just rebuild a new revision and the source might have removed the source.
• even when trusting the https-URL the contents might change
• when the srcurl is down and you change the source it might also change contents

It's not a question of "this might happen" but "this happened" and could be changed easily.

Okay, this

even when trusting the https-URL the contents might change

justifies the md5 for me.