all sis packages contain binaries and package UIDs patched for self-signing.

This is caused by automatic patching of binaries when building self signed packages. This autopatching is done even when the pkg file is simply preprocessed, which is necessary during installation package creation. At the very least when doing only the preprocessing the pkg file should not be patched, but there are issues with this automatic patching in general:

1) If you do "make sis" but forget to specify the certificate at first, it'll patch your binaries and you'll either have to rebuild or manually repatch each binary to correct capabilities using elftran to get them right again (unless they all have same caps, in which case you can run patch_capabilities "All -Tcb" or whatever you need for bulk change and then rerun qmake). This will of course rebuild bld.inf which will cause rebuilding of everything next time you build, which is also annoying. I'm pretty sure this is going to happen a lot, which means a lot of unhappy devs.

2) If you are making a sis of a project that is self signable without patching, it unnecessarily changes the pkg UID and removes Qt dependency from the package.