It's co-located with its Source for a number of reasons:

1) It's not a public class (instances are only ever returned from this Source)
2) We have two other such Sources and subclasses (InstalledModules and LocalTarball)
3) We eventually want these subclasses to go away entirely (the custom behavior in these ModuleRelease subclasses should be delegated to their Sources)
4) Their behavior at present is deeply intertwined with their Source(s).