It's pretty doable to create reproducible builds with gradle or maven: https://reproducible-builds.org/docs/jvm/ https://reproducible-builds.org/docs/jvm/ Also

It's pretty doable to create reproducible builds with gradle or maven: https://reproducible-builds.org/docs/jvm/ https://reproducible-builds.org/docs/jvm/ Also, releases on maven central typically include a sources.jar along with the binaries. It's required to provide that as well as javadoc to publish on maven central, I think. They also require jars to be signed and there are some manual checks before they activate your account to verify e.g. domain ownership and metadata of your project. It's not perfect but it's better than what many other packagemanagers do. It's actually a bit of a PITA to setup; I've wasted quite a bit of time getting some stuff published there just trying to figure out their convoluted processes and tools and error messages. This stuff is way too hard in it's current form. Not all projects that use these build tools are fully reproducible but that is probably pretty easy to fix if people raise awareness of issues around this topic. There's even a website that tracks reproducibility for some common libraries on maven central: https://github.com/jvm-repo-rebuild/reproducible-central#readme https://github.com/jvm-repo-rebuild/reproducible-central#rea... If you want to use artififacts produced straight from git hashes, tags, or branches, jitpack.io is pretty neat.