John>noone packaging for a released OS (using rpm, deb, etc) is going
to want to pull from git
I'm afraid you are missing the point.
Here's the URL I recommend:
https://github.com/pgjdbc/pgjdbc/archive/REL9.4.1207.tar.gz
It is a HTTPS URL of a file that never changes. That exact contents
was used to build pgjdbc 9.4.1207.
Alternatively, you might use a URL with commit ID (see [1]). Commit id
is somewhat harder to identify, but it is protected from tampering
(git tag can be recreated with different contents, but the contents of
a particular git commit id would be always the same).
What's the problem with using those kind of links?
[1]: https://github.com/pgjdbc/pgjdbc/archive/f17e2f3074a95dc767d6d896ffd696e045b48466.tar.gz
Vladimir