The package system typically uses a git URL and tree hash to identify a package version. It supports private registries.

Is it really tied to github or is that just the path documented in tutorials?