Differentiate between 3rd party JARs and customer owned JARs

[mnriem]

We default every unknown JARs as from a third party when it could be customer's own.

[brunoborges]

I think this would require a user-provided catalogue of libraries (GAV coordinates, JAR names, etc). Can you elaborate a bit more on the downside of flagging customers' libraries as "unknown JAR"?

[mnriem]

The customer is looking for a way to differentiate between an unknown JAR and something they delivered themselves.

[dsgrieve]

Seems like they should be able to get this out of MANIFEST.MF and or META-INF/*.SF, if they are following good practices.