pex accesses the network, and thats a violation for most definitions of "hermeticity"... in practice though, network access is necessary in a bunch of cases.