doing a PR to the third-party repository just to download two files from the sqlite release page is easy, but whoever has to review it must make sure that it actually matches the files downloaded from the sqlite website