Separating fetching from building for better security

If you have a custom registry (and a security minded focus) you can probably manage everything in your custom registry and then block internet access completely. Or you can use a tls terminating sandbox and limit access to specific repositories on e.g. github.com.