title: How to ensure signing of test-jars in package phase?
body: <p>I have a multi-module project where the parent POM specifies (in a profile) the configuration and use of the maven-jarsigner-plugin to sign the jars that the project produces.</p>
  
  <pre><code>&lt;profile&gt;
      &lt;id&gt;sign&lt;/id&gt;
      &lt;build&gt;
          &lt;plugins&gt;
              &lt;plugin&gt;
                  &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
                  &lt;artifactId&gt;maven-jarsigner-plugin&lt;/artifactId&gt;
                  &lt;version&gt;1.2&lt;/version&gt;
                  &lt;executions&gt;
                    &lt;execution&gt;
                      &lt;id&gt;sign-jars&lt;/id&gt;
                      &lt;goals&gt;
                        &lt;goal&gt;sign&lt;/goal&gt;
                      &lt;/goals&gt;
                    &lt;/execution&gt;
                  &lt;/executions&gt;
                  &lt;configuration&gt;
                      &lt;keystore&gt;/tmp/certificates.ks&lt;/keystore&gt;
                      &lt;alias&gt;jarsign&lt;/alias&gt;
                      &lt;storepass&gt;password&lt;/storepass&gt;
                      &lt;keypass&gt;password&lt;/keypass&gt;
                  &lt;/configuration&gt;
              &lt;/plugin&gt;
          &lt;/plugins&gt;
      &lt;/build&gt;
  &lt;/profile&gt;
  </code></pre>
  
  <p>Some of the sub-modules in the project additionally use the maven-jar-plugin to produce a test jar:</p>
  
  <pre><code>&lt;plugin&gt;
      &lt;groupId&gt;org.apache.maven.plugins&lt;/groupId&gt;
      &lt;artifactId&gt;maven-jar-plugin&lt;/artifactId&gt;
      &lt;executions&gt;
          &lt;execution&gt;
              &lt;id&gt;test-jar&lt;/id&gt;
              &lt;phase&gt;package&lt;/phase&gt;
              &lt;configuration&gt;
              &lt;/configuration&gt;
              &lt;goals&gt;
                  &lt;goal&gt;test-jar&lt;/goal&gt;
              &lt;/goals&gt;
          &lt;/execution&gt;
      &lt;/executions&gt;
  &lt;/plugin&gt;
  </code></pre>
  
  <p>I'm observing that when the signing profile is enabled (e.g., <code>mvn -Psign install</code>) Maven executes goals in the following order:</p>
  
  <ul>
  <li>jar:jar</li>
  <li>jarsigner:sign</li>
  <li>jar:test-jar</li>
  <li>install:install</li>
  </ul>
  
  <p>This results in an unsigned test-jar (both in <code>target/</code> and in the local repository) which then causes java security problems when a subsequent project attempts to use that test-jar.</p>
  
  <p>Is there a way to ensure that jar:jar and jar:test-jar execute prior to the jarsigner:sign?</p>