Literally every package manager already does this.