it's a little bit weird for a public repo to depend on a private repo?