A repository with history is not enough. It's easy to circumvent. You need software packages reviewed and signed by trusted parties - aka a traditional Linux distro.