From 893a2fa1761e1d5c6b2611e23ca34b1d0998ab52 Mon Sep 17 00:00:00 2001
From: Shinsuke Sugaya <shinsuke@apache.org>
Date: Sun, 6 Sep 2026 14:51:44 +0900
Subject: [PATCH] build(release): attach sources, javadoc and signatures to the
 release build

The 2.4.11 deployment was rejected by the Central Portal:

    Sources must be provided but not found in entries
    Javadocs must be provided but not found in entries
    Missing signature for file: yuicompressor-2.4.11.pom
    Missing signature for file: yuicompressor-2.4.11.jar

Only the jar and the POM were uploaded, for two independent reasons.

Signing moved into the `release` profile in #17, but nothing activates that
profile: release:perform runs its forked deploy build without it, because the
POM never configured <releaseProfiles>.

The POM has also never declared maven-source-plugin, and maven-javadoc-plugin
carries no `jar` execution. Those artifacts used to come from the super POM's
implicit release-profile, which is activated by performRelease=true;
maven-release-plugin 3.x defaults useReleaseProfile to false, so that property
is no longer passed and the profile no longer applies.

maven-release-plugin is now pinned at 3.3.1 with
<releaseProfiles>release</releaseProfiles>, and the release profile declares
maven-source-plugin and the attach-javadocs execution alongside the GPG
signing, so `mvn deploy -P release` and `mvn release:perform` both produce the
signed jar, sources, javadoc and POM.

Verified:
- `mvn clean verify -Prelease -DskipTests -Dgpg.skip=true` builds the jar, the
  sources jar and the javadoc jar
- `help:effective-pom -Prelease` places source, javadoc and gpg in the active
  build; without the profile all three stay inside the inactive profile, so
  `mvn install` still succeeds unsigned, which is the behaviour #17 restored
- GPG signing itself was not exercised here: it was skipped to avoid a
  passphrase prompt, so run `mvn clean verify -Prelease` once before releasing
---
 CHANGELOG.md | 10 ++++++++++
 pom.xml      | 46 ++++++++++++++++++++++++++++++++++++++++++----
 2 files changed, 52 insertions(+), 4 deletions(-)

diff --git a/CHANGELOG.md b/CHANGELOG.md
index 8cc0413..a46659f 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -400,6 +400,16 @@ bought, and it is the safe direction to fail in.
   the whole test suite had already passed on any machine without a GPG key and a working pinentry.
   `docs/BUILDING.md` has always described signing as `mvn clean package -P release`; the POM now
   matches it, and `mvn install` succeeds unsigned
+- **The release build now attaches everything Maven Central requires.** Moving signing into the
+  `release` profile left nothing that activates it: `release:perform` runs its forked deploy build
+  without that profile, and maven-release-plugin 3.x no longer sets `performRelease`, which is what
+  used to pull in the super POM's implicit sources/javadoc profile. The 2.4.11 deployment therefore
+  uploaded only the jar and the POM and was rejected by the Central Portal with "Sources must be
+  provided", "Javadocs must be provided" and a missing signature for each file. `maven-release-plugin`
+  is now pinned and configured with `<releaseProfiles>release</releaseProfiles>`, and the profile
+  declares `maven-source-plugin` and the `attach-javadocs` execution next to the GPG signing, so
+  `mvn deploy -P release` and `mvn release:perform` both produce the signed jar, sources, javadoc
+  and POM
 
 ## [2.4.8]
 
diff --git a/pom.xml b/pom.xml
index 6a86bde..cb30d2b 100644
--- a/pom.xml
+++ b/pom.xml
@@ -174,6 +174,18 @@
         </configuration>
       </plugin>
 
+      <!-- Release plugin: <releaseProfiles> makes release:perform run its
+           forked deploy build with -Prelease, which is what attaches the
+           sources jar, the javadoc jar and the GPG signatures that Maven
+           Central requires. -->
+      <plugin>
+        <artifactId>maven-release-plugin</artifactId>
+        <version>3.3.1</version>
+        <configuration>
+          <releaseProfiles>release</releaseProfiles>
+        </configuration>
+      </plugin>
+
       <!-- Central Publishing Plugin -->
       <plugin>
         <groupId>org.sonatype.central</groupId>
@@ -188,14 +200,40 @@
   </build>
 
   <profiles>
-    <!-- Signing needs a GPG key and a working pinentry, neither of which a
-         build machine or a developer running `mvn install` necessarily has.
-         Bound outside a profile it failed the build after the tests had
-         already passed, so it is activated only for a release. -->
+    <!-- Everything Maven Central requires on top of the plain jar: the sources
+         jar, the javadoc jar and the GPG signatures. Signing needs a GPG key
+         and a working pinentry, neither of which a build machine or a developer
+         running `mvn install` necessarily has, so none of it is bound outside
+         this profile. -->
     <profile>
       <id>release</id>
       <build>
         <plugins>
+          <plugin>
+            <artifactId>maven-source-plugin</artifactId>
+            <version>3.4.0</version>
+            <executions>
+              <execution>
+                <id>attach-sources</id>
+                <goals>
+                  <goal>jar-no-fork</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+          <!-- Configuration comes from the declaration in <build>; this only
+               attaches the javadoc jar to the release. -->
+          <plugin>
+            <artifactId>maven-javadoc-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>attach-javadocs</id>
+                <goals>
+                  <goal>jar</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>