Pex has logic for its own vendoring its dependencies, that you might be able to reuse.