The second 1.0 release candidate. The format contract from rc.1 holds; rc.2 is where the security, reproducibility, and iteration-loop work lands on top of it.

Container dev mode

avocado container dev (up / sync / status / down / prune) is a new inner loop for container work: the host CLI drives an embedded registry and pushes updated container images straight to a running VM, so you edit, rebuild, and see the change on the device without a full provision cycle.

Extension and runtime security

• image.verity: true for extensions and the rootfs — the build runs veritysetup format over the finished image and emits a dm-verity hash tree plus root hash. Extension root hashes land in the runtime manifest; the rootfs root hash goes into the boot FIT as avocado,roothash (signed from AVOCADO_FIT_KEY_DIR when set) and the tree into the machine's per-slot hash partition. Scope for rc.2 is provisioning only — provisioning carries the trees, but avocado deploy and avocado connect upload refuse a runtime with verity extensions until they can publish the trees too. Needs veritysetup in the SDK and CONFIG_DM_VERITY on the target.
• var.encrypt — a runtime can opt into an encrypted /var.
• Signing fixes — signing keys resolve by registry name across provision, sign, and sdk run, and a signature's length is now taken from the algorithm rather than assumed to be 64 bytes.

Composition and hardware

• depends_on declares inter-extension dependencies, so a shared dependency is built and shipped once instead of bundled into every extension that needs it — the extensions install in the right order and stop duplicating each other's dependencies.
• Device-tree overlays — declared overlays are provisioned and built, and an overlay's contents are hashed into the build stamp so a change actually rebuilds.
• --target-board interpolates a board into the config, letting one project target several boards.

Reproducible, OTA-correct images

• Deterministic builds — source_date_epoch feeds the rootfs and initramfs image builds, cpio archives are reproducible, and package-manager state is purged from rootfs and initramfs images.
• Build id correctness — AVOCADO_OS_BUILD_ID is derived from the assembled work tree and now covers permissions, shipped var/cache and var/log content, and initramfs file ownership, so those changes produce a new build id and OTA correctly. Stale rootfs/initramfs install stamps are rejected instead of silently reused.

Also in rc.2

• avocado vm update migrates state instead of destroying it — a version bump no longer resets the VM's var disk. The guest adopts the release's runtime out of var before extensions merge, so a stale sysext can no longer silently mask the update, and Docker volumes, image layers, and installed SDKs survive it. This is the primary macOS/Windows dev path.
• avocado sbom emits an SPDX 3.0 SBOM of the installed packages.
• avocado --version reports the build commit.
• Abandoned build volumes are reaped and stale-volume errors are clearer.
• deploy surfaces container-script stderr instead of a generic failure.
• ext fetch --locked fails on an unpinned extension instead of writing a half-formed lock.

Install and upgrade via the Homebrew tap.