fix disable package signing