As a Java / Hadoop / Spark / Scala fan, all I can say is, it's a little embarrassing, not sure how the Java ecosystem around hadoop became so sloppy (I witness it first hand on a daily basis). I wish more people who are concerned with security / ease of build would turn into contributing to maven, sbt, ivy and the hadoop project. Instead of hating the Java ecosystem, why not join it and make it better? Hadoop is ubiq…
All I need is a build tool. I can download a bunch of jar dependencies myself if needed. In the "old days" we just put them into the CVS repository or in a tarball to download along with the source and an ant script to build the whole thing.
Granted, this did lead to outdated libraries at times and thus potentially was a security threat in itself. But at least it didn't roll the concerns of obtaining dependencies and building into a single tool. Often it's nice to just get the dependencies and build the project your own way, e.g. in your IDE of choice. Or vice versa, obtain the depdencies on your own (e.g. plugging in a different version than recommended) and then use the automated build.
I think those things should be provided by separate, simple tools.