It's nothing Gradle-specific - as you say it's the Maven scheme and used by almost all JVM dependency managers. Note also there's a convention of using a domain you control in reverse order as the groupId (i.e. com.mycompany:myproject:1.0) which makes collisions extremely unlikely. Finally it's very easy in the maven ecosystem to run a "proxy repository" for your organization that indefinitely caches all the artifacts you depend on, thus ensuring that your builds will always be reproducible.