only sign jars during deploy