We are building our own Gerrit.war using operations/software/gerrit , that comes from a time when we had a lot of cherry picks and were not closely following upstream releases.
The sole purpose for building our own fork is currently for a single cherry pick to bring a json library 185bdc3a69370c3ab96cc94d20c0746fe6bade56. If we can get rid of it, I am confident we can then simply reuse the upstream release.
They are released at https://gerrit-releases.storage.googleapis.com/index.html
Or as signed artifacts on Maven Central https://search.maven.org/#search%7Cga%7C1%7Cg%3A%22com.google.gerrit%22
Thus tentatively we could have a script that borrows the material from Maven Central, verify the signature and send it to our Archiva?