I'm assuming that the
github: key implies the possibility of non-github repositories being allowed. PHP's Composer does the same thing in a slightly more verbose way to support arbitrary repos and multiple VCS types. Packagist is less a centralized repository as a suggested but not necessary first choice, which in my opinion is how it should be.
It also uses a JSON file to define project dependencies. Probably not the worst model to copy.
