Scanner Binary

The scanner binary download endpoint (GET /scanner/binary/:platform/:arch) intentionally returns 501 Not Implemented. mipo does not serve pre-built binaries — operators build the scanner from auditable source code to protect against supply chain attacks. The response body includes the exact build command for the requested platform and architecture.

How To

Build the scanner binary

  1. Clone or download the mipo source repository.
  2. Navigate to the scanner/ directory.
  3. Run: CGO_ENABLED=0 GOOS=linux GOARCH=amd64 go build -o mipo-scanner . (adjust GOOS and GOARCH for your platform)
  4. Verify the binary hash against the value shown in the mipo dashboard (Config > Scanners > Binary Hash).
  5. Copy the binary to /usr/local/bin/mipo-scanner on the target host.

Deploy the scanner after building

  1. Generate a provisioning token in Config > Scanners > Add Scanner.
  2. Copy the one-time curl command from the modal.
  3. On the target host, place the verified binary at /usr/local/bin/mipo-scanner.
  4. Run the curl command to register the scanner and create the systemd service.
  5. Start the service: sudo systemctl enable --now mipo-scanner

Gotchas

  1. GET /scanner/binary/:platform/:arch always returns 501 by design — this is not a missing feature or misconfiguration.
  2. Valid platforms are linux, darwin, and windows. Valid architectures are amd64 and arm64. Invalid combinations return 400.
  3. The binary must be built with CGO_ENABLED=0 to produce a statically linked binary with no runtime libc dependency.
  4. Always verify the binary hash before deployment. The dashboard shows the expected hash for the current release.
  5. The scanner binary uses Go standard library only — no third-party runtime dependencies. This keeps the attack surface minimal and enables reproducible builds.

API Calls (1)

Method Path Description
GET /scanner/binary/:platform/:arch Returns 501 Not Implemented with the build command for the requested platform/arch. Platforms: linux, darwin, windows. Architectures: amd64, arm64.

Related Pages

  • Ingest Health — The binary download endpoint is served by the ingest service
  • Scanners — Scanner provisioning and binary hash verification
  • Scanner Heartbeat — After building and deploying, the scanner sends heartbeats through the ingest protocol