script to sign packages