This is the way it's worked for PHP's composer packages, and it's worked well.