If the transitive closure of your jar libraries lead to a deterministic resolution of classpath jar products, then the fingerprint strategy would already invalidate correctly