phase2: disable slave side package signing