The objective of this issue is that people can give some feedback so we can converge towards a solution and an implementation.
Follow up of: #105 and #8
People often find bugs on their dependencies …
Most repos are not yet pulling from their upstream to make maintenance easier. Some don't really have an upstream besides versioned tarballs (e.g. zlib). Workflows need established/documented.