You avoid dependency hell (and a whole raft of other things) better when you limit the number of external repositories you use. Since you can't guarantee the quality, long-term availablility, and timeliness of the contents of those repositories, it is a very poor move to rely on their contents (and continued existence).
As a concrete example, I've previous seen examples where semi-official third-party repositories of packages for a stable Linux distribution had packages come and go over time. This caused a great deal of trouble, because we might build up a few machines at one time, which all got the same version of a critical package. Some time later, when we went to build more machines, the version we had specified was no longer available (superceded by a newer, shinier version) and we had to test everything again to make sure the newer package still worked properly.
This isn't the worst possibility. What if we didn't test the new package, and it had a critical bug in it? Bummer. Of course, the version we choose may turn out to have a security flaw in it, but that's OK, because as responsible packagers we keep an eye on upstream security announcements and ensure that any vulnerabilities are patched appropriately.
The cautious administrator only installs packages onto his/her systems from two places:
- The distribution's official repositories (appropriately cryptographically verified for authenticity, of course), where the policies and practices of the manner in which packages are added and removed is known and complies with your own risk management assessment; and
- An internally managed package repository or repositories (again, cryptographically verified).
The contents of that internal repository set can be populated by several different means:
- Download packages from external, third-part repositories, verify their utility and stability in a testing environment, and then add them to the repo.
- If you are moderately paranoid, you rebuild the source packages from the above repos, then test and add.
- If you're properly paranoid, you shut yourself in a small room without any computers or electronic equipment whatsoever.