مكتبة، إطار عمل، حزمة، ملف ثنائي، صورة حاوية، شيفرة مصدرية، برمجيات ثابتة — يأتي المصدر المفتوح بأشكال متعددة. يختلف كل نوع في طبيعته واستخدامه والتحقق منه. يشرح هذا الدليل جميع الأنواع — وكيف تحميك مجاميع SHA الاختبارية من الملفات المتلاعب بها.
In software, an «مخرج برمجي» is any file or package that a project creates and distributes. When a developer writes code and shares it, the things they publish — the compiled program, the library file, the Docker image, the source code archive — are all artifacts.
Different artifacts serve different purposes, are installed differently, and need to be verified differently. Understanding the types is essential because: you wouldn't install a library the same way you install an operating system, and you wouldn't verify a container image the same way you verify source code.
Kitchen Analogy: Think of a restaurant kitchen. The recipe (الشيفرة المصدرية) تخبرك بكيفية الطهي. أما ingredients (المكتبات/الاعتماديات) هي المواد الخام. أما prepared meal (ملف ثنائي/حزمة) هو الناتج الجاهز للأكل. أما meal kit (صورة حاوية) هي كل المكونات مقاسة مسبقًا في علبة — فقط سخّن وقدّم. أما cookbook (الوثائق) تشرح جميع الوصفات. عناصر برمجية مختلفة لاستخدامات مختلفة.
Source code is the original text written by developers in a programming language (Python, C, Java, JavaScript, etc.). It's what you see on GitHub. It's human-readable — you can open it in a text editor and understand what it does. ALL other artifacts are created FROM source code.
How you get it: Clone a Git repository, download a .tar.gz or .zip archive from GitHub/GitLab, or extract it from a source package.
تشبيه: The recipe written on paper. You can read it, modify it, and cook from it — but you need a kitchen (compiler/interpreter) to turn it into a meal.
Source code is the MOST transparent artifact — you can read every line and verify there's nothing malicious. This is why open source is more trustworthy: anyone can audit the source code. Always prefer reviewing source when security is critical.
المكتبة مجموعة من pre-written functions that developers use inside their own programs. You don't run a library directly — you import it into your code and call its functions. Libraries save developers from reinventing the wheel.
For example, instead of writing your own code to parse JSON, you use a JSON library. Instead of writing your own encryption, you use OpenSSL (a library). Libraries are the LEGO bricks of software.
تشبيه: LEGO bricks. You don't play with a single brick — you combine many bricks to build something. Each library is a specialized brick (one for colors, one for shapes, one for sounds).
Linux: .so (كائن مشترك)، .a (أرشيف ثابت) — مثل libssl.so
Windows: .dll (مكتبة ربط ديناميكي) — مثل openssl.dll
macOS: .dylib (مكتبة ديناميكية)
Python: ملفات .py أو .whl المترجمة (wheel)
Java: .jar (أرشيف Java)
إطار العمل يشبه المكتبة، لكن بينهما فرقًا أساسيًا: a library is called BY your code; a framework CALLS your code. يوفّر إطار العمل البنية (التوجيه وقاعدة البيانات والمصادقة)، وأنت تضيف الأجزاء الخاصة بك (منطق العمل والصفحات والبيانات).
تشبيه: A house frame (جدران وسقف وتمديدات صحية جاهزة). لا تبني الأساسات — بل تضيف الأثاث والطلاء والزينة. يحدّد إطار العمل مواضع الأبواب، وأنت تختار ألوانها.
المكتبة: «أنت تتصل بنا.» شيفرتك هي التي تقرر متى تستخدم المكتبة. Framework: «لا تتصل بنا، سنتصل نحن بك.» إطار العمل هو الذي يدير الأمور ويستدعي شيفرتك في اللحظات المناسبة. ويُسمى هذا «عكس التحكم» — the framework is in charge, not you.
الحزمة هي bundled, installable unit — it contains the code (source or compiled), metadata (name, version, author, license), and a list of dependencies (other packages it needs). Package managers install, update, and remove packages automatically.
تشبيه: A mail-order package — labeled with sender, contents list, and delivery instructions. The package manager is the postal service that delivers and installs it for you.
.deb — Debian/Ubuntu/Mint (installed by apt/dpkg)
.rpm — Fedora/RHEL/SUSE (installed by dnf/yum/zypper)
.whl — Python wheel (installed by pip)
.gem — Ruby (installed by gem)
.jar / .war — Java (installed by Maven/Gradle)
.snap — Universal Linux (installed by snap)
.flatpak — Universal Linux (installed by flatpak)
.AppImage — Portable Linux app (just download and run!)
PyPI (pypi.org) — Python · npm (npmjs.com) — JavaScript · crates.io — Rust · Maven Central — Java · RubyGems — Ruby · NuGet — .NET · مستودعات APT — Debian/Ubuntu · Flathub — Flatpak · Snap Store — Snap. Each language has its own registry.
الملف الثنائي هو compiled machine code — the CPU runs it directly. When source code (C, C++, Rust, Go) is compiled, the result is a binary. You can't read it (it's 1s and 0s) — but it's FAST because the CPU doesn't need to translate anything.
Important distinction: Binaries are platform-specific! A Linux binary won't run on Windows, and an ARM binary won't run on x86. That's why projects publish binaries for EACH platform: linux-amd64, linux-arm64, windows-x64, macos-arm64, etc.
تشبيه: The cooked meal — ready to eat immediately. You can't see the recipe by looking at it (decompilation is hard and imperfect), and it only fits certain plates (platforms).
Binaries are OPAQUE — you can't easily verify what's inside. A binary COULD contain malware you can't see. This is why SHA checksums and GPG signatures are critical for binaries. ALWAYS verify the hash of downloaded binaries before running them. More on this below.
صورة الحاوية هي complete, self-contained package that includes: the application binary, all its libraries, configuration files, and even a minimal OS layer. It runs identically on ANY machine with Docker/Podman installed — no "works on my machine" problem.
تشبيه: A meal kit box — contains the meal, plates, utensils, and even a mini-oven. You don't need anything except a table (Docker engine). Everything is pre-packaged to work perfectly together.
Container images have digests (بصمات SHA256 لكل طبقة). استخدم docker pull nginx@sha256:abc123... to pull by exact digest — guaranteeing you get the EXACT image, not a tampered version. Also check for Cosign signatures (التوقيع الحديث لصور الحاويات).
Firmware is software that lives inside hardware devices — your router, your Arduino, your printer, your TV, your car's computer, your BIOS/UEFI. It's usually a binary image that gets "flashed" (written) to the device's memory chip. Open-source firmware gives you control over your hardware.
Flashing wrong firmware can «لبنة» your device (make it completely non-functional). ALWAYS verify the SHA checksum of firmware files before flashing. ALWAYS follow the exact instructions for your specific hardware model.
صورة ISO هي complete disk image — usually a full operating system installer. You download it, write it to a USB drive (using Etcher), and boot from it to install an OS. Named after the ISO 9660 file system standard for CD-ROMs.
صور ISO لأنظمة التشغيل الهدف رقم #1 لهجمات سلسلة التوريد — إن عدّل المهاجم ISO يمكنه زرع باب خلفي في النظام كاملًا. تنشر كل توزيعة Linux مجاميع SHA256 بجانب صور ISO. تحقّق دائمًا قبل التثبيت.
Documentation is often overlooked but is a crucial artifact: READMEs, API references, tutorials, man pages, translation files, design files (icons, logos), and configuration examples. Good documentation is what separates usable software from abandoned experiments.
فئة جديدة من المخرجات البرمجية: أوزان نماذج الذكاء الاصطناعي (المعاملات المدرَّبة لشبكة عصبية، وغالبًا ما يبلغ حجمها GB–TB) و datasets (البيانات المستخدمة لتدريبها). تُوزَّع عبر Hugging Face وOllama وسجلات النماذج.
The most important security skill you'll learn today.
SHA is a mathematical function that takes ANY file — no matter how big — and produces a fixed-length "fingerprint" (يُسمّى hash أو checksum). تتميّز هذه البصمة بخصائص مذهلة:
• Unique: Even changing ONE bit in the file produces a COMPLETELY different hash
• Fixed size: Whether the file is 1 KB or 100 GB, the hash is always the same length
• اتجاه واحد: You can't reverse-engineer the file from the hash
• Deterministic: The same file ALWAYS produces the same hash
SHA256:
SHA256:
SHA256:
See? Changing ONE character produces a completely different hash. If someone modifies a single byte in a 4 GB ISO file, the entire SHA256 hash changes. This is how you detect tampering.
Use SHA-256 for everything. It's the industry standard, supported everywhere, and has no known weaknesses. Only use SHA-512 or SHA-3 if you have specific high-security requirements. لا تستخدم MD5 أوSHA-1 أبدًا for security purposes.
When you download a Linux ISO, firmware, or any important file — here's how to verify it hasn't been tampered with:
SHA tells you the file hasn't changed. But what if an attacker hacked the website and replaced BOTH the file AND the checksum? Then the SHA would match a tampered file!
GPG signatures solve this: the developer digitally signs the checksum file with their private key. You verify the signature with their public key. Even if the website is hacked, the attacker can't forge the developer's signature without their private key.
Developer writes code → compiles binary → calculates SHA256 hash → signs the hash with GPG key → publishes file + hash + signature. You download all three → verify GPG signature (proves authenticity) → verify SHA256 (proves integrity). If both pass, you can trust the file.
Git commit hashes (SHA-1 → moving to SHA-256), signed tags (git tag -v)، وشارات التحقق من GitHub
Repos are GPG-signed. apt/dnf verify signatures automatically. apt-key manages trusted keys
PyPI has hash pinning (pip install pkg==1.0 --hash sha256:abc...). يستخدم npm خوارزمية SHA-512 في ملفات القفل
SHA256 checksum files + GPG signatures. Always verify BOTH before running
Image digests (sha256:abc...)، وتوقيعات Cosign، وDocker Content Trust (Notary)
SHA256 checksum files + GPG signatures. CRITICAL to verify — the #1 supply chain target
SHA256 checksums from manufacturer. Some use Secure Boot (signed firmware only)
SHA256 on Hugging Face model cards. GGUF files have embedded checksums. Ollama verifies automatically
Tabayyanoo — Verify! The Quran commands us to verify information before acting on it. SHA checksums are the digital form of this command. When you download a file from the internet, you don't blindly trust it — you VERIFY its integrity. This is Tabayyanoo in the digital age.
أصبحت تفهم كل أنواع عناصر المصدر المفتوح — من الشيفرة الخام للملفات الثنائية، ومن صور Docker لنماذج الذكاء الاصطناعي. وتعرف التحقق منها بمجاميع SHA وتواقيع GPG. لا تثق بملف منزّل دون تدقيق مجددًا. فتبيّنوا — تحقّق!
«وَأَلَنَّا لَهُ الْحَدِيدَ»
Every artifact is a piece of softened iron — powerful and useful. But just as a blacksmith tests the quality of iron before forging, you must verify every artifact before trusting it. ✨