fix gpg signing order, must be after sources for source jar to be signed