Not too long ago this wouldn't be a problem, as distributions were allowed to create packages for the official Sun Java, but then The Oracle in its infinite "wisdom" decided to revoke the
DLJ.
Besides, how is installing extra software from outside the repository (without signature, checksums, or other verification) different from installing software contained in the repository?