Builds, packaging, and component boundaries

A repository is not a running program

A source tree can contain multiple executables, libraries, test fixtures, tools, and unused experiments. Before describing “the malware,” determine which component and build you mean. The same directory may contain code that runs at build time, code that runs on a host, and code that is never included in the artifact under study.

This lesson extends the earlier artifact model into a component map. It does not provide a delivery chain or deployment procedure. The task is to document how the evidence connects a particular revision to a particular role.

A component manifest for study

{
  "study": "illustrative component map",
  "revision": "record the reviewed commit",
  "components": [
    {"name": "demo-main", "role": "prints a local example"},
    {"name": "fixture-generator", "role": "creates test input"}
  ],
  "artifact_matches_source": "not established"
}

The explicit uncertainty in the final field matters. A manifest written by the analyst is a set of claims, not proof that a binary was produced from those files. Build flags, dependencies, generated content, and later modifications can affect that relationship.

Delivery, loading, and behavior

A delivery artifact gets a component to a destination; a loading mechanism makes a component available for execution; a behavioral component performs some operation. These are roles in an explanation, and a single file can participate in more than one. Do not infer a whole chain from a filename such as loader or stage.

Embedded data also needs a consumer. A packaged resource can be documentation, configuration, a fixture, or another component. Explain what retrieves it and what happens afterward before deciding which role it plays. The packing lesson's distinction between representation and execution applies here.

Repeatable source studies

Record the revision, relevant paths, build target, and the evidence linking them to the discussed artifact. Keep third-party dependencies and generated files visible in the map. If you reproduce a short excerpt, pin its source and explain omissions so another reader can check the same material.

Do not silently repair an excerpt while describing it as original. A corrected teaching example and a faithful source excerpt serve different purposes. Label them accordingly, especially when a bug or an unusual return convention is central to the lesson.

Exercise

A repository's test utility contains a string found in a report about a sample. Does that establish that the deployed component contains the utility? What additional relationship would you need to show?

Check your understanding

No. You need evidence that the relevant build includes that code or data, or independent confirmation in the artifact. Shared text alone does not establish a component's execution role or its inclusion in the sample.