use expect to sign packages as its the only method that works