Both mariadb.com and mariadb.org appear to be canonical upstream sources, and
have identical sha256 hashes at these URLs.
For the third-party mirrors, if we are just going to provide one URL, it should
be an HTTPS url instead of FTP or SSH, which many users may not be able to
access due to network security configurations.
3bb305515f