I know. the issue comes when he uses a github repo or a tarball as the dependancy.