Version prints binary version and, with --verbose, schema and lockfile status.
With --verify, prints integrity hashes for the binary, embedded policy library,
and Go module dependencies. Auditors compare these against known-good values.
With --sbom, outputs a CycloneDX JSON Software Bill of Materials.
With --check-update, performs an explicit network call to GitHub to report
whether a newer release is available. This is the only flag on this command
that touches the network; the default flow is air-gapped.
Exit Codes:
0 - Success
4 - Internal error
Examples:
stave version
stave version --details
stave version --verify
stave version --sbom > stave-sbom.json
stave version --check-update # opt-in network check
STAVE_NO_NETWORK=1 stave version --check-update # short-circuits cleanly
Offline-only: reads local files; makes zero network connections; no cloud credentials.
Usage:
stave version [flags]
Examples:
stave version --verify
Flags:
--check-update Check GitHub for a newer release (opt-in network call)
--details Include schema and lockfile status
-h, --help help for version
--sbom Output CycloneDX JSON Software Bill of Materials
--verify Print binary and policy library integrity hashes
Global Flags:
--allow-symlink-output Allow writing output through symlinks (default: refuse)
--force Allow overwriting existing output files
--log-file string Write logs to file (default: stderr)
--log-format string Log format: text|json (default "text")
--log-level string Log level: debug|info|warn|error (overrides -v)
--log-timestamps Include timestamps in logs (breaks determinism)
--log-timings Include timing information (breaks determinism)
--no-color Disable ANSI colors in output
--path-mode string Path rendering in errors/logs: base (basename only) or full (absolute paths) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--quiet Suppress output (exit code only) Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--require-offline Assert offline operation: fail if proxy env vars (HTTP_PROXY, HTTPS_PROXY, ALL_PROXY) are set
--sanitize Sanitize infrastructure identifiers (bucket names, ARNs, policies) from output Resolved default may come from STAVE_* env vars, stave.yaml, user config, or built-in.
--strict Enable strict integrity checks for embedded registries and references
-v, --verbose count Increase verbosity (-v=INFO, -vv=DEBUG)
-y, --yes Auto-confirm all interactive prompts (distinct from --force which controls file overwriting)