one alternative would be `http://sources.buildroot.net/file-5.18.tar.gz`, but that's not the official channel, so we better include an MD5 checksum too?