Reference to package repositories

[NNaikp]

In the first pilot submission we referenced an MRAN repo together with packaging packages into .txt files through pkglite.
I'm unsure whether this would be the same approach when you are submitting as a company.

We've been discussing internally whether we should make the IP for our package management system outward facing, such that we could point directly to that in the ADRG (essentially also avoiding the need to use pkglite in this case). But then there is also a dilemma in whether we are "offering" authorities a service to get an unfair advantage.

How are you approaching this in your company?