VContainer UPM package doesn't have a signature

[tarmojussila]

Issue description

The VContainer UPM package doesn't have a signature and is marked with a warning symbol in Unity package manager.

Unity Package Manager

To protect your project, the recommended best practice is to use only signed packages.

• Description: "Unity can't verify this package because it doesn't have a signature. Use signed packages to reduce risk to your project."
• Details: "Signature: Missing"

Unity version

Starting with Unity 6.3, the Package Manager checks for digital package signatures on all tarball packages used in the Unity ecosystem.

Recommended solution

As a package consumer, ask the package owner to publish a version of the package with a signature, then install the signed version.
As a package publisher, sign your package, then distribute the signed version.

Additional details

Link to Unity's Package signatures documentation: https://docs.unity3d.com/6000.3/Documentation/Manual/upm-signature.html

[RunoLight]

I reproduced this on Unity 6.3 with the current Git URL installation as well.
It looks like VContainer currently doesn't produce a signed UPM package artifact. (I also didn't found any scripts or workflows for openupm, @hadashiA are you packing it manually?)

@hadashiA, I'd like to prepare a PR that adds UPM tarball packaging to the release workflow, signs the artifact during release using Unity's package-signing mechanism, verifies the signature, and publishes the signed package.
The signing credentials would need to be configured by the repository maintainer as GitHub Actions secrets. Final package can be hosted in github releases for example, just as DLLs does, so installation line in Unity packages.json will look like:
"jp.hadashikick.vcontainer": "https://github.com/.../releases/download/v1.20.0/jp.hadashikick.vcontainer-1.20.0.tgz"

[RunoLight]

I also think this warning is worth addressing because it can negatively affect users even when they understand that it is not an immediate functional problem.

Some users, myself included, tend to want to keep the Unity console/package manager completely clean and may spend time trying to get rid of a persistent security warning even if they understand why it appears.

For enterprise projects, this kind of warning can be more problematic: a message saying that Unity cannot verify a package's signature can raise legitimate security concerns around the integrity of the package and potential MITM/supply-chain risks.

For less experienced Unity users, having a persistent warning like this in the editor can also create the impression that something is wrong with the package, and they may simply choose another package that doesn't show the warning.

So I think providing a properly signed package would not only address the security concern, but also improve the overall confidence in VContainer.