It's all automated. Most third-party packages have their source code published as source JAR on Maven central and I just use that. JDK is the only exception, where I use OpenJDK's source code.