ExternalProject use is discouraged.
- Most package build systems do not allow any fetching on
configure/build stage
- It's insecure the way it's used now, as it does not specify commit
hash, so it may fetch whatever malicous code and it'll come
unoticed
