Teek, raamistik, pakett, binaarfail, konteineritõmmis, lähtekood, püsivara — avatud lähtekood esineb mitmel kujul. Iga liik on erinev ning seda kasutatakse ja kontrollitakse erinevalt. See juhend selgitab neid KÕIKI, sealhulgas seda, kuidas SHA kontrollsummad kaitsevad muudetud failide eest.
In software, an „tarkvaraartefakt“ is any file or package that a project creates and distributes. When a developer writes code and shares it, the things they publish — the compiled program, the library file, the Docker image, the source code archive — are all artifacts.
Different artifacts serve different purposes, are installed differently, and need to be verified differently. Understanding the types is essential because: you wouldn't install a library the same way you install an operating system, and you wouldn't verify a container image the same way you verify source code.
Kitchen Analogy: Think of a restaurant kitchen. The recipe (lähtekood) ütleb, KUIDAS süüa teha. Aga ingredients (teegid/sõltuvused) on toorained. See prepared meal (binaarfail/pakett) on valmis söömiseks. See meal kit (konteineritõmmis) sisaldab kõike eelnevalt mõõdetult ühes karbis — lihtsalt soojenda ja serveeri. See cookbook (dokumentatsioon) selgitab kõiki retsepte. Erinevad artefaktid, erinevad kasutused.
Source code is the original text written by developers in a programming language (Python, C, Java, JavaScript, etc.). It's what you see on GitHub. It's human-readable — you can open it in a text editor and understand what it does. ALL other artifacts are created FROM source code.
How you get it: Clone a Git repository, download a .tar.gz or .zip archive from GitHub/GitLab, or extract it from a source package.
Võrdlus: The recipe written on paper. You can read it, modify it, and cook from it — but you need a kitchen (compiler/interpreter) to turn it into a meal.
Source code is the MOST transparent artifact — you can read every line and verify there's nothing malicious. This is why open source is more trustworthy: anyone can audit the source code. Always prefer reviewing source when security is critical.
Teek on kogum pre-written functions that developers use inside their own programs. You don't run a library directly — you import it into your code and call its functions. Libraries save developers from reinventing the wheel.
For example, instead of writing your own code to parse JSON, you use a JSON library. Instead of writing your own encryption, you use OpenSSL (a library). Libraries are the LEGO bricks of software.
Võrdlus: LEGO bricks. You don't play with a single brick — you combine many bricks to build something. Each library is a specialized brick (one for colors, one for shapes, one for sounds).
Linux: .so (jagatav objekt), .a (staatiline arhiiv) — nt libssl.so
Windows: .dll (dünaamiliselt lingitav teek) — nt openssl.dll
macOS: .dylib (dünaamiline teek)
Python: .py-failid või kompileeritud .whl (wheel)
Java: .jar (Java arhiiv)
Raamistik sarnaneb teegiga, kuid ühe olulise erinevusega: a library is called BY your code; a framework CALLS your code. Raamistik annab struktuuri (marsruutimine, andmebaas, autentimine) ja sina täidad konkreetsed osad (äriloogika, lehed, andmed).
Võrdlus: A house frame (seinad, katus ja torustik on juba valmis). Sa ei ehita vundamenti — lisad mööbli, värvi ja kaunistused. Raamistik määrab, KUHU uksed tulevad; sina otsustad nende värvi.
Teek: „Sina helistad meile.“ Sinu kood otsustab, millal teeki kasutada. Framework: „Ära helista meile, meie helistame sulle.“ Raamistik juhib toimuvat ja kutsub SINU koodi õigel hetkel välja. Seda nimetatakse „Juhtimise ümberpööramine“ — the framework is in charge, not you.
Pakett on bundled, installable unit — it contains the code (source or compiled), metadata (name, version, author, license), and a list of dependencies (other packages it needs). Package managers install, update, and remove packages automatically.
Võrdlus: A mail-order package — labeled with sender, contents list, and delivery instructions. The package manager is the postal service that delivers and installs it for you.
.deb — Debian/Ubuntu/Mint (installed by apt/dpkg)
.rpm — Fedora/RHEL/SUSE (installed by dnf/yum/zypper)
.whl — Python wheel (installed by pip)
.gem — Ruby (installed by gem)
.jar / .war — Java (installed by Maven/Gradle)
.snap — Universal Linux (installed by snap)
.flatpak — Universal Linux (installed by flatpak)
.AppImage — Portable Linux app (just download and run!)
PyPI (pypi.org) — Python · npm (npmjs.com) — JavaScript · crates.io — Rust · Maven Central — Java · RubyGems — Ruby · NuGet — .NET · APT hoidlad — Debian/Ubuntu · Flathub — Flatpak · Snap Store — Snap. Each language has its own registry.
Binaarfail on compiled machine code — the CPU runs it directly. When source code (C, C++, Rust, Go) is compiled, the result is a binary. You can't read it (it's 1s and 0s) — but it's FAST because the CPU doesn't need to translate anything.
Important distinction: Binaries are platform-specific! A Linux binary won't run on Windows, and an ARM binary won't run on x86. That's why projects publish binaries for EACH platform: linux-amd64, linux-arm64, windows-x64, macos-arm64, etc.
Võrdlus: The cooked meal — ready to eat immediately. You can't see the recipe by looking at it (decompilation is hard and imperfect), and it only fits certain plates (platforms).
Binaries are OPAQUE — you can't easily verify what's inside. A binary COULD contain malware you can't see. This is why SHA checksums and GPG signatures are critical for binaries. ALWAYS verify the hash of downloaded binaries before running them. More on this below.
Konteineripilt on complete, self-contained package that includes: the application binary, all its libraries, configuration files, and even a minimal OS layer. It runs identically on ANY machine with Docker/Podman installed — no "works on my machine" problem.
Võrdlus: A meal kit box — contains the meal, plates, utensils, and even a mini-oven. You don't need anything except a table (Docker engine). Everything is pre-packaged to work perfectly together.
Container images have digests (iga kihi SHA256-räsid). Kasuta docker pull nginx@sha256:abc123... to pull by exact digest — guaranteeing you get the EXACT image, not a tampered version. Also check for Cosign signatures (nüüdisaegne tõmmiste allkirjastamine).
Firmware is software that lives inside hardware devices — your router, your Arduino, your printer, your TV, your car's computer, your BIOS/UEFI. It's usually a binary image that gets "flashed" (written) to the device's memory chip. Open-source firmware gives you control over your hardware.
Flashing wrong firmware can „ehitusplokk“ your device (make it completely non-functional). ALWAYS verify the SHA checksum of firmware files before flashing. ALWAYS follow the exact instructions for your specific hardware model.
ISO-tõmmis on complete disk image — usually a full operating system installer. You download it, write it to a USB drive (using Etcher), and boot from it to install an OS. Named after the ISO 9660 file system standard for CD-ROMs.
Operatsioonisüsteemide ISO-d on tarneahelarünnete #1 sihtmärk — ISO muutmisel saab ründaja lisada tagaukse kogu operatsioonisüsteemi. IGA Linuxi distributsioon avaldab ISO kõrval SHA256 kontrollsummad. Kontrolli ALATI enne paigaldamist.
Documentation is often overlooked but is a crucial artifact: READMEs, API references, tutorials, man pages, translation files, design files (icons, logos), and configuration examples. Good documentation is what separates usable software from abandoned experiments.
Uus tarkvaraartefakti kategooria: Tehisintellektimudelite kaalud (närvivõrgu treenitud parameetrid, mille maht on sageli GB–TB) ning datasets (andmed, mida kasutati nende treenimiseks). Neid jagatakse Hugging Face’i, Ollama ja mudeliregistrite kaudu.
The most important security skill you'll learn today.
SHA is a mathematical function that takes ANY file — no matter how big — and produces a fixed-length "fingerprint" (nimega hash või checksum). Sellel sõrmejäljel on hämmastavad omadused:
• Unique: Even changing ONE bit in the file produces a COMPLETELY different hash
• Fixed size: Whether the file is 1 KB or 100 GB, the hash is always the same length
• Ühesuunaline: You can't reverse-engineer the file from the hash
• Deterministic: The same file ALWAYS produces the same hash
SHA256:
SHA256:
SHA256:
See? Changing ONE character produces a completely different hash. If someone modifies a single byte in a 4 GB ISO file, the entire SHA256 hash changes. This is how you detect tampering.
Use SHA-256 for everything. It's the industry standard, supported everywhere, and has no known weaknesses. Only use SHA-512 or SHA-3 if you have specific high-security requirements. Ära kasuta KUNAGI MD5 ega SHA-1 for security purposes.
When you download a Linux ISO, firmware, or any important file — here's how to verify it hasn't been tampered with:
SHA tells you the file hasn't changed. But what if an attacker hacked the website and replaced BOTH the file AND the checksum? Then the SHA would match a tampered file!
GPG signatures solve this: the developer digitally signs the checksum file with their private key. You verify the signature with their public key. Even if the website is hacked, the attacker can't forge the developer's signature without their private key.
Developer writes code → compiles binary → calculates SHA256 hash → signs the hash with GPG key → publishes file + hash + signature. You download all three → verify GPG signature (proves authenticity) → verify SHA256 (proves integrity). If both pass, you can trust the file.
Git commit hashes (SHA-1 → moving to SHA-256), signed tags (git tag -v), GitHubi kinnitatud märgised
Repos are GPG-signed. apt/dnf verify signatures automatically. apt-key manages trusted keys
PyPI has hash pinning (pip install pkg==1.0 --hash sha256:abc...). npm kasutab lukustusfailides SHA-512
SHA256 checksum files + GPG signatures. Always verify BOTH before running
Image digests (sha256:abc...), Cosigni allkirjad, Docker Content Trust (Notary)
SHA256 checksum files + GPG signatures. CRITICAL to verify — the #1 supply chain target
SHA256 checksums from manufacturer. Some use Secure Boot (signed firmware only)
SHA256 on Hugging Face model cards. GGUF files have embedded checksums. Ollama verifies automatically
Tabayyanoo — Verify! The Quran commands us to verify information before acting on it. SHA checksums are the digital form of this command. When you download a file from the internet, you don't blindly trust it — you VERIFY its integrity. This is Tabayyanoo in the digital age.
Nüüd mõistad kõiki avatud lähtekoodi artefakte — toorest lähtekoodist kompileeritud binaarfailideni, Dockeri tõmmistest tehisarumudeliteni. Oskad neid KONTROLLIDA SHA kontrollsummade ja GPG allkirjadega. Ära usalda enam allalaaditud faili pimesi. Tabayyanoo — kontrolli!
«وَأَلَنَّا لَهُ الْحَدِيدَ»
Every artifact is a piece of softened iron — powerful and useful. But just as a blacksmith tests the quality of iron before forging, you must verify every artifact before trusting it. ✨