Will be using the repository's unique ID.

Note that if the repo is coming off github, we need to verify that the
cpmURL in the JSON file matches up with the filename. Otherwise, the
source will not be allowed.