Upseam delivers a package only when it can prove that you publish it. Any one of these is enough for a package:
- npm provenance. Publish from GitHub Actions with
npm publish --provenance. This is the strongest proof. - A repository link.
repositoryinpackage.jsonnames this repository, and has done since the package first linked it. - A PyPI trusted publisher. Publish to PyPI from this repository with a trusted publisher, so that PyPI records the attestation.
Upseam also needs upseam.vendor.yml on the default branch, naming the
provider and the package. See Connect in 3 steps.
Note
Before the first verification, Upseam reviews any PyPI package, an npm package with at least 10,000 downloads last week, or a package close to a static provider's SDK.
#States
vendor status shows the state of your registration.
| State | Meaning |
|---|---|
pending |
Upseam has your repository but delivers nothing yet. The holds say why, for example that no package is proven. At most the last 3 releases are kept; releases from the last 30 days can be delivered after verification. |
verified |
At least one package is proven. Only proven packages are delivered. |
blocked |
Upseam stopped deliveries for the repository or its owner account. |
A registration that gets no release for 30 days while pending is deleted. Run the workflow again to register anew.
#When a package is not proven
vendor status prints each package with its proof or with what is missing.
Add one of the proofs above, publish a release and run vendor status again.
Related resources