fix devops comment and add possible sig or hash check on .jar