for signing the pkg, we'll want to call

productsign

directly because CPack does not include the

--timestamp

option https://github.com/Kitware/CMake/blob/master/Source/CPack/cmCPackProductBuildGenerator.cxx#L229 but... we also override the

productbuild

script so in the future we can add it to our script/