It has to be the source of the distribution the user currently has a copy of. So they can't just say "sure" and then wait until the next public release. I'm not sure about timeliness, though.