don't require package signing for non-release builds