1 2 3
# varve which <tool> Prints which binary would actually run here and which layer it comes from — the resolved path plus the layer id and manifest digest. Fails closed if the pin does not resolve or the tool is absent from the layer.