I also think that vendoring or at least caching your dependency tree somewhere local, so you can build everything from ground up to a known state.

It's not only an issue of availability or depending on circumstances you can't control, but a matter of reproducibility hence dependability.

I want to be able to compile critical software when a zombie apocalypse hits, and I have a growing discomfort about trusting outside parties for their availability and benevolence.