"non-technical example of people using signals when players leave the board (in the bathroom, over a balcony etc) and in technical ways suggests that certain earpieces could pass checks or potentially other small devices"
A lot of projects publish to Central from cloud CIs. That means that private keys are stored in config/secrets. It is debatable whether that makes the artifacts more reliable since you have to trust the CI.
Disagree about being the death of Maven Central - they are different beasts.
- Central has a global namespace of artifacts. com.google.guava is the same for everyone. This will probably stay the default of open-source libraries.
- GitHub Package Registry has a per-user maven repository, so a local namespace (https://maven.pkg.github.com/OWNER). This is likely to be used by companies internally.
In order to use GH Registry instead of Central, I would have to add a dozen maven repositories to my settings.xml. I doubt many developers will be up for that.
I believe "reproducible build" is a more appropriate term.
Unfortunately its quite difficult to get a fully reproducible build with Maven as the post points out. Even if you manage to replicate the build environment and settings, Maven produced binaries will be slightly different on each run. File timestamps are saved in jar files so they change on every build.
I've found that Project Lombok solves this problem for me. Simply add a @Data or @Value annotation and it will generate getters/setters/hashCode/toString etc.
https://projectlombok.org/features/Value.html