move verify_packages wholly into /client