package.sh lives at the same level as your pom. Honestly you could put it all inline with the exec plugin.
The reason I don't is it's easier to edit the shell script. It doesn't HAVE to live at the same level as the pom but that's in the search path for the exec plugin.
I also wanted to have the conditional logic for SNAPSHOT builds (appending the timestamp). There are obviously many ways the shell script could blow up at this point.
The rest of this pom actually does some stuff to package up a copy of our component with a customized distribution of Jetty8 similar to what the hightide distribution does. We basically vendor the container with the application.
The only thing missing that I can see right now is attaching the generated deb artifact and pushing it to artifactory. Well...that and making sure it doesn't blow up on me for stupid reasons.