A backdoor in xz

Git submodules are not that bad as long as the set of submodules doesn't change often and they're limited to a single level. If you have a package build system that can handle Git, you can have it download all the repos, change the URLs in the superrepo to the local clones and git-submodule-update will clone and check out the right commits.

E.g. see https://gitlab.archlinux.org/archlinux/packaging/packages...

Sources for Meson subprojects that aren't in the repo or tarball can also be provided; our Mesa PKGBUILD does this.

But yeah, I would prefer if git-subtree were more popular.