Source modules from code hosts

[DanielThomas]

The first two prototypes of the tool that became ja supported fetching code via SCM tools and assembling modules deterministically from source. I came to the conclusion that the landscape has changed sufficiently in the intervening months to make the problems of source integration, provenance, tag immutability, essentially untenable. With the rise of agent driven supply chain attacks and the security posture they require, it felt more important than ever to lean into the strengths of the existing Java binary supply chain.

We leave that door ajar by design, by ensuring that deployed sources should be all that is required to assemble a module, but it's not a goal to resurrect this idea.