build(release): attach sources, javadoc and signatures to the release build

CHANGELOG.md

@@ -400,6 +400,16 @@ bought, and it is the safe direction to fail in.
   the whole test suite had already passed on any machine without a GPG key and a working pinentry.
   `docs/BUILDING.md` has always described signing as `mvn clean package -P release`; the POM now
   matches it, and `mvn install` succeeds unsigned
+- **The release build now attaches everything Maven Central requires.** Moving signing into the
+  `release` profile left nothing that activates it: `release:perform` runs its forked deploy build
+  without that profile, and maven-release-plugin 3.x no longer sets `performRelease`, which is what
+  used to pull in the super POM's implicit sources/javadoc profile. The 2.4.11 deployment therefore
+  uploaded only the jar and the POM and was rejected by the Central Portal with "Sources must be
+  provided", "Javadocs must be provided" and a missing signature for each file. `maven-release-plugin`
+  is now pinned and configured with `<releaseProfiles>release</releaseProfiles>`, and the profile
+  declares `maven-source-plugin` and the `attach-javadocs` execution next to the GPG signing, so
+  `mvn deploy -P release` and `mvn release:perform` both produce the signed jar, sources, javadoc
+  and POM
 
 ## [2.4.8]
 

pom.xml

@@ -174,6 +174,18 @@
         </configuration>
       </plugin>
 
+      <!-- Release plugin: <releaseProfiles> makes release:perform run its
+           forked deploy build with -Prelease, which is what attaches the
+           sources jar, the javadoc jar and the GPG signatures that Maven
+           Central requires. -->
+      <plugin>
+        <artifactId>maven-release-plugin</artifactId>
+        <version>3.3.1</version>
+        <configuration>
+          <releaseProfiles>release</releaseProfiles>
+        </configuration>
+      </plugin>
+
       <!-- Central Publishing Plugin -->
       <plugin>
         <groupId>org.sonatype.central</groupId>
@@ -188,14 +200,40 @@
   </build>
 
   <profiles>
-    <!-- Signing needs a GPG key and a working pinentry, neither of which a
-         build machine or a developer running `mvn install` necessarily has.
-         Bound outside a profile it failed the build after the tests had
-         already passed, so it is activated only for a release. -->
+    <!-- Everything Maven Central requires on top of the plain jar: the sources
+         jar, the javadoc jar and the GPG signatures. Signing needs a GPG key
+         and a working pinentry, neither of which a build machine or a developer
+         running `mvn install` necessarily has, so none of it is bound outside
+         this profile. -->
     <profile>
       <id>release</id>
       <build>
         <plugins>
+          <plugin>
+            <artifactId>maven-source-plugin</artifactId>
+            <version>3.4.0</version>
+            <executions>
+              <execution>
+                <id>attach-sources</id>
+                <goals>
+                  <goal>jar-no-fork</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
+          <!-- Configuration comes from the declaration in <build>; this only
+               attaches the javadoc jar to the release. -->
+          <plugin>
+            <artifactId>maven-javadoc-plugin</artifactId>
+            <executions>
+              <execution>
+                <id>attach-javadocs</id>
+                <goals>
+                  <goal>jar</goal>
+                </goals>
+              </execution>
+            </executions>
+          </plugin>
           <plugin>
             <groupId>org.apache.maven.plugins</groupId>
             <artifactId>maven-gpg-plugin</artifactId>