tag, download, then sign the package.