Content-hashed build

A content-hashed build is an immutable build artifact identified by a hash of its own contents, so that a given identifier always refers to exactly the same software and deploying or rolling back is a pointer change.

Immutability is the useful property. A build is never modified after it is created; a change produces a new build with a new identifier. That removes the question of whether what is running now is the same as what was tested, because the identifier answers it.

Rollback becomes trivial as a direct consequence. Reverting means pointing at a previous hash, which takes effect immediately and cannot partially succeed. A rebuild-based rollback has to reproduce an old state, and reproduction is exactly what tends to fail under pressure.

The same property makes verification results durable. A build that passed the chain is identified by its contents, so the pass applies to that exact artifact rather than to a moment in time.

See also verification chain and sandbox isolation.