I'd prefer to see package managers be more separate. Downloading dependencies involves interacting with third parties and has security implications. That's fine when you're downloading software intentionally from a source you trust, but I've had the experience of downloading source code and noticing that the build system is downloading from sources I don't recognize or without https, and that's not so good.
I think this is a good argument for having the location of sources be configurable separately from the place where sources are included - but not necessarily in a different tool.
Comments
I'd prefer to see package managers be more separate. Downloading dependencies involves interacting with third parties and has security implications. That's fine when you're downloading software intentionally from a source you trust, but I've had the experience of downloading source code and noticing that the build system is downloading from sources I don't recognize or without https, and that's not so good.
I think this is a good argument for having the location of sources be configurable separately from the place where sources are included - but not necessarily in a different tool.