It's the only sane location atm and we miss more by *not* checking (and adding an override for the unlikely case that s.th. is e.g. maintained e.g. on salsa within the upstream repo)