changed attach-sources phase from 'verify' to 'package' in order to avoid problems with empty source artifacts
modified README for sandbox repo