The previous attempt at this was running the reproducable-build-maven-plugin after jarsigning, which results in the jar not verifying correctly.
410eacfd6a