Some metadata files declare a "code repository", which is usually a VCS URL. This could be used to discover other origins; eg. if we found the file in a package manager but don't know about the development repo.