Yeah, it's how software should be. Learn from other mistake. However, I'd also like to point out that I think it's better to focus on build system ergonomic rather than a package management ergonomic. Let git be the package repository and the build system be aware of git repo. That way I think it would solve a lot of supply chain issue being centralized