A modern programming language that makes developers happier.

kotlinlang

Hi, after upgrading our app from KVision 8.2.0 to KVision 9.5.0 / Kilua RPC 0.0.44, our packaged JVM fat jar stopped starting with the error:
`java.lang.SecurityException: Invalid signature file digest for Manifest main attributes`
We tracked this down to signed dependency jars such as Bouncy Castle (`bcprov-jdk18on`, `bcpkix-jdk18on`, `bcutil-jdk18on)` being unpacked into the final `jarWithJs` artifact together with their META-INF/*.SF / *.DSA signature files.
From what we found:
• the old KVision 8.2.0 Gradle plugin’s Ktor packaging path explicitly excluded:
    ◦ META-INF/*.RSA
    ◦ META-INF/*.SF
    ◦ META-INF/*.DSA
• the new Kilua RPC Gradle plugin creates `jarWithJs` as a ShadowJar, but does not exclude signature metadata
So it looks like the packaging migration from `shadowJar` to `jarWithJs` regressed signed-jar handling.

For now we fixed it locally by configuring the generated ShadowJar task to exclude signature-like entries under META-INF/.

Is excluding JAR signature files in jarWithJs the intended fix?

Also before it was always `DuplicatesStrategy.EXCLUDE`  and now it is always `DuplicatesStrategy.INCLUDE` is that also intended?

Cheers!