[packages] bmxd: use the read-only source url