Github user jlahoda commented on the issue:
https://github.com/apache/incubator-netbeans/pull/47
I agree the hash is useful (among other things) to verify that the jar from
the central is the same.
But it is unfortunately not the same in this case. Seems the jar on
hg/binaries is the same as a download from the JSch web page, and the jar on
maven central is different. My wild guess is that these have been produced by
different build processes and different JDKs.---
