Primary hosting, but they can always have a fallback for at-risk projects or even just use p2p. Of course that already increases the risk of a potentially hacked provider/repo or just fake/malware versions in the wild