Artifacts and Binary Artifacts

This post defines artifacts and binary artifacts, covering exam-relevant concepts, core components, and tags.

In a Nutshell

• An artifact is any project output (documentation, model, test report, code).
• A binary artifact is the machine-readable product of a build (executable, library, package, container image).

Core Definition

Binary artifacts are created through compilation, linking, packaging, or image builds—for example:

• JAR, DLL, EXE
• NPM package, Python Wheel
• Docker/OCI image

They’re versioned and stored in an artifact repository with metadata (version, commit, build number), checksums, and ideally cryptographic signatures.

Key principles:

• Immutability: never overwrite releases.
• Build once, promote: the same artifact moves through Dev → Staging → Prod.
• Supply-chain security: SBOM, scans, attestations.

Exam-Relevant Topics

• Distinguish artifact from binary artifact clearly
• Release vs snapshot
• Semantic versioning
• Checksums, signatures, SBOM as evidence
• Reproducible builds (lockfiles, fixed toolchain)
• Pre-deployment policies (scans, signature verification)
• Retention and archiving (compliance)

Core Components

1. Source artifacts (code, IaC, documentation)
2. Build system / packager / image builder
3. Binary artifact formats
4. Metadata (version, commit)
5. Quality reports (tests, coverage, linter results)
6. Security (SBOM, scan, signature)
7. Artifact repository / registry
8. Promotion path
9. Consumption (package manager, lockfiles)
10. Governance (retention, ACL)

Practical Example (Container Release)

1) CI builds JAR + container image v1.4.0
2) Generate SBOM + SHA256 + signature
3) Push to registry / artifact repository
4) Deploy to staging, run tests
5) Approval → promote to production (same artifact)
6) Release notes + retention policy (e.g. 12 months)

Advantages and Drawbacks

Advantages

• Traceability and reproducibility
• Security through signatures and SBOM
• Clean releases and straightforward rollbacks

Drawbacks

• Storage and governance overhead
• Tool complexity with multiple formats

Common Exam Questions (with Brief Answers)

1. Artifact vs binary artifact? Artifact = any project output; binary artifact = build product.
2. Why immutable releases? Reproducibility and security.
3. What’s the purpose of SBOM? Transparency into components, licenses, and vulnerabilities.

Key Resources

1. https://reproducible-builds.org
2. https://semver.org