Disambiguating version control system and repository

[adityasaky]

In OSPS-01:

The project's version control system MUST require multi-factor authentication for collaborators modifying the project repository settings or accessing sensitive data.

The definition for VCS points to examples like Git that cannot enforce multi-factor authentication. The definition for "repository" is closer to a source control platform (SCP) such as GitHub or GitLab that can enforce multi-factor authentication. I'm unsure if just replacing VCS with repository is sufficient, especially since the word "repository" doesn't always mean the centrally hosted copy to everyone.

Separately, does this requirement exclude other options for hosting source code? For example, I'm unsure if https://git.kernel.org/ can meet the MFA requirement.