I have worked at a place with serious opsec and none of that was allowed. Everything pointed at private mirrors containing vetted packages. Very few people had the permissions to write to those repos.