Cool, but am I right that it requires that you trust the jar dependency you have initially on your local filesystem?