Thanks, Vladimir, this helps a lot understanding the Maven/Gradle situation.
There are several ways to build and package pgjdbc:
a) Build from Git sources. That requires Gradle, and it enables running more tests, so you have better confidence in the resulting artifact
and the purpose is to add convenience for cases like Debian that lack Gradle. The set of tests and features is reduced, however, the driver should still work in most cases.
I already have a 42.3.0 Portfile reverting back to Maven builds using source release but, as I would like to add tests to the Portfile in the future, I think I'll switch to Git sources and stay with Gradle builds.
You are right: some large codebase like JDK are indeed using upstream binaries, but pgjdbc is not that large... :-) Here, I think I'll stay old school and limit potential "supply chain" issues ;-)
Thanks again :-)
Georges