Skip to main content
GET
All fields except version are best-effort: they’re populated from environment variables the release pipeline injects at compile time (GITHUB_SHA, GITHUB_REF_NAME, STATESET_RELEASE_TAG, STATESET_BUILD_TIMESTAMP, STATESET_SIGNED). Local cargo build runs leave the optional fields unset and signed = false, which the admin UI surfaces as ‘this binary did not come from a verified release pipeline’.

Response

VersionResponse
string,null
RFC 3339 build timestamp, if injected via STATESET_BUILD_TIMESTAMP at compile time.
string,null
Git commit SHA (full or short) of the build, if injected via GITHUB_SHA at compile time. None for unverified local builds.
string,null
Git branch or tag name, if injected via GITHUB_REF_NAME.
string,null
Release tag (e.g. v1.0.3) if this binary came from a tagged release. Distinct from git_ref because release builds set this explicitly via STATESET_RELEASE_TAG.
boolean
required
Whether this binary’s release artifacts were signed via sigstore. true when the release pipeline injected STATESET_SIGNED=true; false (the default) for local builds, dev builds, and any release where signing was skipped or failed.
string
required
Package version from Cargo.toml (always present).

Status codes

Last modified on August 31, 2026