> And version pinning in and of itself doesn't really solve this problem either: if you're relying on an external source for reproducible builds, you've got a p

> And version pinning in and of itself doesn't really solve this problem either: if you're relying on an external source for reproducible builds, you've got a potential point of failure I grammerred badly, but this is what I meant when I said: "As you keep an onsite cache of the packages" In Nuget land this is quite easy but then you have some housekeeping to ensure the copy of the packages is backed up. This could be done with a separate source repo if you want to use that hammer.