Picking up some more modules to review and I can see some of you go to great length to find external binary in Maven Central (or elsewhere), even where an exact match doesn't exist. (by exact match I mean where the hash doesn't match)
More specifically: Some external jars in the old NetBeans build have been stripped of their signatures. Why? See Matthias' comment here: https://github.com/apache/incubator-netbeans/pull/118#issuecomment-336624270 In general: How much should I try to find the external binary in some repo?
