Signed JARs may be modified during a native build

[gastaldi]

Describe the bug

While working in quarkiverse/quarkus-jgit#121, I noticed that Quarkus performs a filtering in the project dependencies, which in some cases may be a signed JAR, failing the build with a SecurityException (see quarkiverse/quarkus-jgit#121 (comment))

Expected behavior

Do not modify signed JARs files or if modified, unsign them

Actual behavior

The JAR is modified and the build fails with a SecurityException

How to Reproduce?

See quarkiverse/quarkus-jgit#121 (comment)

Output of uname -a or ver

macOS m1

Output of java -version

JDK 17

Mandrel or GraalVM version (if different from Java)

No response

Quarkus version or git rev

3.9.2

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.9.6

Additional information

No response

[quarkus-bot]

/cc @Karm (mandrel), @galderz (mandrel), @zakkak (mandrel,native-image)