jar publish is especially dangerous