+1 a good dependency manager should 1) pull all necessary packages for you 2) build them if required. It's your job when downloading a package to use or when a

+1 a good dependency manager should 1) pull all necessary packages for you 2) build them if required. It's your job when downloading a package to use or when adding a dependency to make sure you trust the source - this is not a dependency management problem. A good dependency manager should help you better filter trusted sources or at least have a good build file layout to make it obvious what the sources are but that's it.