3rd party repo policy followup