Transparency and user agency as principles for distributing and consuming open source software packages