# Prove your packages

Upseam delivers a package only when it can prove that you publish it. Any one
of these is enough for a package:

- **npm provenance.** Publish from GitHub Actions with
  `npm publish --provenance`. This is the strongest proof.
- **A repository link.** `repository` in `package.json` names this
  repository, and has done since the package first linked it.
- **A PyPI trusted publisher.** Publish to PyPI from this repository with a
  trusted publisher, so that PyPI records the attestation.

Upseam also needs `upseam.vendor.yml` on the default branch, naming the
provider and the package. See [Connect in 3 steps](vendor-connect.md#the-config).

> **Note.** Before the first verification, Upseam reviews any PyPI package, an
> npm package with at least 10,000 downloads last week, or a package close to
> a static provider's SDK.

## States

`vendor status` shows the state of your registration.

| State      | Meaning                                                                                                                                                                                                                  |
| ---------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
| `pending`  | Upseam has your repository but delivers nothing yet. The holds say why, for example that no package is proven. At most the last 3 releases are kept; releases from the last 30 days can be delivered after verification. |
| `verified` | At least one package is proven. Only proven packages are delivered.                                                                                                                                                      |
| `blocked`  | Upseam stopped deliveries for the repository or its owner account.                                                                                                                                                       |

A registration that gets no release for 30 days while pending is deleted. Run
the workflow again to register anew.

## When a package is not proven

`vendor status` prints each package with its proof or with what is missing.
Add one of the proofs above, publish a release and run `vendor status` again.

:::cards Related resources

- [Connect in 3 steps](vendor-connect.md)
  The files, the workflow and the first release.
- [Analytics](vendor-analytics.md)
  What a verified vendor sees in the App.

:::