[jimrandomh]

I'd prefer to see package managers be more separate. Downloading dependencies involves interacting with third parties and has security implications. That's fine when you're downloading software intentionally from a source you trust, but I've had the experience of downloading source code and noticing that the build system is downloading from sources I don't recognize or without https, and that's not so good.

[glenjamin]

I think this is a good argument for having the location of sources be configurable separately from the place where sources are included - but not necessarily in a different tool.