Comment 6 for bug 1644364

Upstream uses the throw a tarball over the wall model of development rather than open development in a tracked repo. This greatly complicates security support for this type of package.