vetting the package list