This code used to actually reach out to the internet to look for files.  This
is flaky, slow, and semantically WRONG.  The license that is upstream might
actually be different than what we have vendored.  Only look at local files.

This now passes back-to-back updates and verifies.