[jpollock]

There's typically a subdirectory called third_party, with subdirectories for each vendor, product and version. If the team is smart, they will also enact a rule saying "only one version". If you're really, really smart, local changes are kept as a set of patches, keeping them separate from the imported tar file.

So, for source deliveries:

  third_party/apache/httpd/2.4/release.tgz
                              /patch.tgz
                              /Makefile (or other config)
  third_party/apache/httpd/2.2/release.tgz
                             /patch.tgz                             
  ...

[cpeterso]

For example, here is Chromium's third_party directory:

https://chromium.googlesource.com/chromium/src.git/+/master/...