# Installation

> Install refpoint from a release archive or build it from source.

Source: https://refpoint.dev/docs/getting-started/installation

By the end of this page you will have a `refpoint` binary on your path and know
which artifacts a release carries.

refpoint is a single static binary. It is built with `CGO_ENABLED=0` and
cross-compiled for Linux, macOS, and Windows on amd64 and arm64. Nothing is
installed on the targets you scan, and the machine running the scan needs no
runtime beyond the binary itself.

## Install from a release

Each tagged release publishes `tar.gz` archives for Linux and macOS, a `zip`
for Windows, and `.deb` and `.rpm` packages. The packages place the binary at
`/usr/bin/refpoint` and the documentation at `/usr/share/doc/refpoint`.

```shell
tar -xzf refpoint_linux_amd64.tar.gz
install -m 0755 refpoint /usr/local/bin/refpoint
refpoint version
```

## Verify what you downloaded

Every release also carries `checksums.txt`, a CycloneDX SBOM per archive, and a
keyless cosign signature over the checksums file. Because every artifact is
listed in the checksums file, that single signature transitively covers all of
them.

```shell
cosign verify-blob \
  --certificate checksums.txt.pem \
  --signature checksums.txt.sig \
  checksums.txt

sha256sum --check --ignore-missing checksums.txt
```

## Build from source

Building requires Go 1.26.0 or later. The module declares `go 1.26.0` with
toolchain `go1.26.6`.

```shell
make build          # ./bin/refpoint-<os>-<arch>
make install        # into $(go env GOPATH)/bin
make build-all      # linux and darwin on amd64 and arm64, windows on amd64
```

Builds use `-trimpath` and inject the version with
`-X main.version=$(VERSION)`, where `VERSION` defaults to
`git describe --tags --always --dirty` and falls back to `dev`. A binary that
reports `dev` was built outside a tag, which matters when a report's
attestation records the version that produced it.

## Contributor targets

```shell
make test           # internal packages, then tests/ with -count=1
make test-race      # the same split, with the race detector
make cover          # coverage profile plus an HTML report
make vet lint       # go vet, golangci-lint
make check          # vet, lint and test, the CI-equivalent local run
make release-snapshot   # a full goreleaser build without publishing
```

`test` runs in two steps on purpose. The end-to-end suite shells out to the
built binary rather than importing it, so the Go test cache cannot see the
binary change and would serve a stale pass. `./tests/...` is therefore always
re-run with `-count=1`.

## What refpoint needs on a target

Nothing is installed. Checks read state with tooling that is already present,
such as `ss`, `systemctl`, `getent`, `sshd -T`, `auditctl`, or PowerShell
cmdlets on Windows. When that tooling is missing, the check reports an error
rather than guessing an answer.