A release artifact is a packaged software file distributed to users, mirrors, or update systems. Common examples include installers, ZIP or tar archives, disk images, and signed update bundles. It is the deliverable that end users actually download, not the source code behind it.
Release artifacts matter because they sit at the center of software supply-chain trust. Security teams use signatures, checksums, and provenance metadata to prove that an artifact came from the expected publisher and was not altered after release. Attackers target artifacts by tampering with downloads, replacing mirror content, or abusing stolen signing keys. Defenders protect them with strong key management, reproducible builds, controlled publishing pipelines, and integrity verification so users can detect corruption or substitution before installation.