In Yocto development I typically rely on external OSS repos to achieve the first builds but, yes, in production one can lock down the source in a local mirror.