tagging upstream release verified by upstream's gpg signature