Secure dependency management

[Chris Piker]

Hi D

So one of the projects I've been working on is moving closer to 
production. Currently, the pull/build/test/install cycle is 
handled by git, dub and GNU make.

Currently I let dub fetch dependencies off the Internet, but for 
mission reliability I would like to be able to handle the process 
without Internet access.  Dub looks like it supports local 
repositories, but before just start "Doing something" are there 
any practices the community would recommend for D supply-chain 
management?

Thanks for any links and tips,