downloading sig before tarball, easy fix (#42)