I think we should go for immutable packages. It makes the package managed infinitely simpler: if the file is there, use it. If not, download it, then use it. Since it's immutable, you can always use your file. How do you push updates then? Easy - change the name. Put the version number in the module name.