Build systems may include features to fetch arbitrary remote code outside of normal MacPorts controls. An example is FetchContent in CMake. This can result in unexpected dependency versions and other surprises.
What are MacPorts guidelines for allowing or blocking remote fetching? I could not find an established policy. Should there be one?
