There's typically a subdirectory called third_party, with subdirectories for each vendor, product and version. If the team is smart, they will also enact a rul

There's typically a subdirectory called third_party, with subdirectories for each vendor, product and version. If the team is smart, they will also enact a rule saying "only one version". If you're really, really smart, local changes are kept as a set of patches, keeping them separate from the imported tar file. So, for source deliveries: third_party/apache/httpd/2.4/release.tgz /patch.tgz /Makefile (or other config) third_party/apache/httpd/2.2/release.tgz /patch.tgz ...