Skip to content

Installation

Install refpoint from a release archive or build it from source.

On this page

By the end of this page you will have a refpoint binary on your path and know which artifacts a release carries.

refpoint is a single static binary. It is built with CGO_ENABLED=0 and cross-compiled for Linux, macOS, and Windows on amd64 and arm64. Nothing is installed on the targets you scan, and the machine running the scan needs no runtime beyond the binary itself.

Install from a release

Each tagged release publishes tar.gz archives for Linux and macOS, a zip for Windows, and .deb and .rpm packages. The packages place the binary at /usr/bin/refpoint and the documentation at /usr/share/doc/refpoint.

tar -xzf refpoint_linux_amd64.tar.gz
install -m 0755 refpoint /usr/local/bin/refpoint
refpoint version

Verify what you downloaded

Every release also carries checksums.txt, a CycloneDX SBOM per archive, and a keyless cosign signature over the checksums file. Because every artifact is listed in the checksums file, that single signature transitively covers all of them.

cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  checksums.txt

sha256sum --check --ignore-missing checksums.txt

Build from source

Building requires Go 1.26.0 or later. The module declares go 1.26.0 with toolchain go1.26.6.

make build          # ./bin/refpoint-<os>-<arch>
make install        # into $(go env GOPATH)/bin
make build-all      # linux and darwin on amd64 and arm64, windows on amd64

Builds use -trimpath and inject the version with -X main.version=$(VERSION), where VERSION defaults to git describe --tags --always --dirty and falls back to dev. A binary that reports dev was built outside a tag, which matters when a report’s attestation records the version that produced it.

Contributor targets

make test           # internal packages, then tests/ with -count=1
make test-race      # the same split, with the race detector
make cover          # coverage profile plus an HTML report
make vet lint       # go vet, golangci-lint
make check          # vet, lint and test, the CI-equivalent local run
make release-snapshot   # a full goreleaser build without publishing

test runs in two steps on purpose. The end-to-end suite shells out to the built binary rather than importing it, so the Go test cache cannot see the binary change and would serve a stale pass. ./tests/... is therefore always re-run with -count=1.

What refpoint needs on a target

Nothing is installed. Checks read state with tooling that is already present, such as ss, systemctl, getent, sshd -T, auditctl, or PowerShell cmdlets on Windows. When that tooling is missing, the check reports an error rather than guessing an answer.