Artifacts and Binary Artifacts

This post is a conceptual guide to artifacts and binary artifacts—covering exam topics, core components, and key terminology.

In a Nutshell

• An artifact is any project deliverable (documentation, model, test report, code).
• A binary artifact is the machine-readable output of a build (executable, library, package, container image).

Technical Overview

Binary artifacts are created through compilation, linking, packaging, or image building:

• JAR, DLL, EXE
• NPM package, Python Wheel
• Docker/OCI image

They’re versioned and stored in an artifact repository with metadata (version, commit, build number), checksums, and ideally signatures.

Key principles:

• Immutability: never overwrite releases.
• Build once, promote: the same artifact moves from dev → staging → production.
• Supply-chain security: SBOM, scans, attestations.

Exam-Relevant Topics

• Distinguish artifact from binary artifact
• Release vs snapshot
• Semantic versioning
• Checksums, signatures, and SBOM as evidence
• Reproducible builds (lockfiles, pinned toolchains)
• Pre-deployment policies (scanning, signature verification)
• Retention and archival (compliance)

Core Components

1. Source artifacts (code, IaC, documentation)
2. Build system/packager/image builder
3. Binary artifact formats
4. Metadata (version, commit)
5. Quality reports (tests, coverage, linting)
6. Security (SBOM, scan, signature)
7. Artifact repository/registry
8. Promotion pipeline
9. Consumption (package manager, lockfiles)
10. Governance (retention, access control)

Practical Example (Container Release)

1) CI builds JAR + container image v1.4.0
2) Generate SBOM + SHA256 + signature
3) Push to registry/artifact repository
4) Deploy to staging, run tests
5) Approval → promote same artifact to production
6) Release notes + retention policy (e.g., 12 months)

Advantages and Disadvantages

Advantages

• Traceability and reproducibility
• Security through signatures and SBOM
• Clean releases and rollbacks

Disadvantages

• Storage and governance overhead
• Tool complexity with many formats

Common Exam Questions (with Brief Answers)

1. What’s the difference between artifact and binary artifact? An artifact is any deliverable; a binary artifact is a build product.
2. Why enforce immutable releases? To ensure reproducibility and security.
3. What’s the purpose of an SBOM? To provide transparency on components, licenses, and vulnerabilities.

Key References

1. https://reproducible-builds.org
2. https://semver.org