in reply to
(sort of OT) cvs/vendor supplied modules/our own modifications
But, given that CVS really is the solution you are stuck with, the procedure you outline is the recommended one. CVS supports this with the import command:
Import sources into CVS, using vendor branches
· Synopsis: import [-options] repository vendortag releasetag..
There are many alternatives to CVS, perforce and subversion being proprietary and free options respectively, and many of them may handle this task more or less better than CVS. But the real complexity is in the subsequent merge of the vendor branch into your mainline. None of the VC systems do this hard work for you.
"Even if you are on the right track, you'll get run over if you just sit there." - Will Rogers