jar_dependency

excludes don't make it into the hash