Add note about private package sources