What is an Artifact?

[erkist]

As @salaboy has pointed out, we have a conceptual conflict in the spec around the definition of an Artifact (especially in relation to source code and component versions).

In PR #8, an Artifact is mentioned as:

the output of the pipeline such as the artifacts that were packaged and released for others to use

In PR #23 there is an ongoing discussion as to what concepts could be replaced by Artifacts (e.g. Component Versions and Compositions).

It got a bit messy to have this conversation in the PR, so I'll bring it here: What is an Artifact?

[erkist]

In ESCI, these are very different concepts. An Artifact in ESCI is basically "something you would store in Artifactory". More-or-less a file with perhaps a bit of metadata. Or a Docker image. Or a Maven package.

Eiffel defines Artifact as "a software artifact" which may have multiple files, dependencies etc. i.e. quite a rich amount of metadata.

In ESCI, since Artifacts are mainly just files, we have the concept of a Component.
A component can be just a wrapper for a single Artifact (in which case this is where we would add the rich metadata), but it could also represent something that is not a file, e.g. an entity in a database or a hardware component.

From these components, versions can be created, for example the following:

• Hardware: The component is the hardware model, and versions are the revisions of said model (e.g. "Unifi AP-AC-Pro Revision 20")
• Configuration: The component is the configuration entity, and versions are, well, versions of the configuration. Could be an artifact, but could also just be an entity in a database or service somewhere (e.g. https://my-config-service.local/agen1-build-config/414 which is represented as a JSON object in transit)
• Documentation: (Same as for configuration above)

So, a component could in some cases be represented as a single artifact, but could also not have an artifact at all (and sometime perhaps several artifacts, especially when artifact replication is in place).

[erkist]

That Artifact page is a bit all over the place, but it does seem mainly concerned with by-products as you say.

There is related article, for UML https://en.wikipedia.org/wiki/Artifact_(UML) that states:

Examples of artifacts include model files, source files, scripts, and binary executable files, a table in a database system, a development deliverable, a word-processing document, or a mail message.[1]

My takeaway is that, from my list above, configuration and documentation can absolutely be seen as artifacts, which is fine.

If we decide to use Artifact to refer to these, my remaining missing category would be hardware. Do we want to refer to "hardware parts of a product with software running on it" as "artifacts"? (E.g. a digital unit or a radio unit in Ericsson terms)

[m-linner-ericsson]

Hmm, well if you have a hardware "piece" you will need to integrate this before it can be used so maybe we could go with something like:

• Artifact - software artifact that can be stored in artifactory
• Component - a piece of a bigger system that needs integration to work. This can be both hardware and software e.g.
  • Software - a library that needs to compiled into a product to work
  • Hardware - a hardware component that need to be physically integrated to work

Does this sound reasonable?

[erkist]

Could you help me understand where we'd draw the line between an Artifact and a Component of type Software?

In ESCI, a Component of type Software would typically have one or more Artifact entities connected to it (to identify the corresponding files), but I get the feeling this is not what you are proposing.

[m-linner-ericsson]

Is ESCI calling it a Component whereas Eiffel calls it a Composition?

I get the idea of wanting something else to capture many artifacts and metadata. Could we use some ideas and wording from SPDX e.g. a Package? While not 100% correct I am looking for terms that are already defined so we don't have to do it ourselves.

[erkist]

The corresponding term in ESCI for an Eiffel Composition would be an ESCI Baseline, I think.

An ESCI Component is mainly metadata around an Artifact or a piece of hardware or something similar.

[afrittoli]

Working Group Discussion

Generic artefact:

• It's a generic input or output of a workflow

• What are the required / optional generic properties of an artefact? -> This requires further discussion

  • How do we refer to them?
  • Ideas: ID, Name, URL, Signature, Attestation?

---

Specialised artefact:

• It could be a container image, log file, test result, composition of files
• We generally agree on the idea of specialised artefact

---

Composition: -> This requires further discussion

• Do we want to have support for "on-the-fly" compositions?
  • Compositions natively supported by the protocol
  • Compositions are just a file or another type of artefact / transparent to the protocol <- this is our starting assumption

---

What is an artefact - is source code an artefact?
When it comes to artefact event, it's up to the event producer to decide if a file is relevant to be part the artefact.