signed package publishing