dirty hack: accept unsigned packages for now