The third, fourth and fifth 1.0 release candidates, released on 1, 15 and 17 September. rc.3 and rc.4 carried the features; rc.5 is a fix release and is the build to install. Download it from peridio.com/downloads or the GitHub release.

rc.5: the fixes

No new features. Most of these are regressions from rc.4, but not all: the i.MX build failure is a regression in rc.3, and the stone_include_paths and post_build bugs are older still. Upgrade from any earlier release candidate, not only from rc.4.

• i.MX builds work again. avocado build deleted the BSP's own imx-boot images while clearing a previous re-keyed bootloader, so every imx8mp-evk and imx93-evk build failed in stone validate with two files not found, and a reinstall did not recover it. A re-keyed bootloader now lives in its own rekeyed/ directory that the build owns. Regression in rc.3.
• avocado install --dnf-arg no longer leaves a project unbuildable. An extension installed with --dnf-arg (or under sdk.disable_weak_dependencies) lost its install stamp, so every ext build failed with "dependencies not satisfied" and the advertised fix deleted the stamp again. Regression in rc.4.
• avocado ext build no longer fails with Failed to walk and an empty path on the default avocado.yaml when an extension uses a glob in package_files. Regression in rc.4.
• A package-sourced extension that declares a compile script builds again, which is how every ext-* repository ships. Regression in rc.4.
• kernel.cmdline and kernel.cmdline_extra reach the build hook again. rc.4 shipped the field inert on targets that bake the command line into a UKI at build time (RB3 Gen 2, Rubik Pi 3). The value is now resolved per target, so a target-<name>: override is honored, setting both keys is an error rather than two exports the hook had to reconcile, and editing the command line alone rebuilds the runtime. See Kernel configuration.
• ext build rebuilds an extension whose content comes from a post_build hook instead of reporting it up to date and shipping the previous build. An extension that declares package_files for a local compile source is still skipped when those files are unchanged.
• avocado install runs the SDK phase in parallel without --force. One rule for the install DAG, the build DAG and the SDK phase: AVOCADO_PARALLEL_TASKS, else min(cpus, 4), and 1 under --runs-on. -f on sdk install and runtime install is hidden; it still parses.
• runtimes.<name>.stone_include_paths accepts more than one path. A second path used to vanish silently.
• Security. cryptoki 0.12.1 for RUSTSEC-2026-0286, and the extension source symlink guard is armed on the default config path.

rc.4: package feeds, kernel command line, HITL, stamps

Package feeds

• Named feeds: repos: and distro.feeds. A project can pull from any mix of the public feed, a mirror, a third-party RPM repository and a directory of RPMs on disk. repos: defines feeds; distro.feeds orders and enables them, and position is the dnf priority. stages: scopes a feed to sdk, rootfs, runtime, ext or initramfs; credentials come from {{ env.X }} references and are refused inside a URL. The resolved feed set is written to .avocado/feeds/<target>.json and folded into the build stamps.
• Private organization feeds: org:. repos: { acme: { org: acme } } exchanges your Connect credential for a short-lived feed token once per invocation; the token is never a build input. Not logged in points at avocado login.
• avocado login, a top-level shortcut for avocado connect auth login. Logging in raises the feed rate limit and unlocks private feeds.
• The lock records the feed set per target, and each package's origin.

Configuration

• kernel.cmdline and kernel.cmdline_extra. cmdline replaces the board's kernel command line outright; cmdline_extra appends to it. Both resolve per runtime with a top-level fallback and reach the build and provision hooks as AVOCADO_KERNEL_CMDLINE / AVOCADO_KERNEL_CMDLINE_EXTRA, so isolcpus or earlycon no longer need a Yocto rebuild. Complete in rc.5 (see above); on rc.4 the build hook did not see it.

Hardware-in-the-loop

• avocado hitl is a managed NFS server: start, status, stop, logs, sync. start runs a detached, named container and fails loudly when an export did not load; status lists every server on the machine; sync re-runs the extension lifecycle on a device after a rebuild. The old foreground behaviour remains as hitl server. See Hardware-in-the-loop.

Build, install and provision

• Breaking: avocado build no longer produces the var image; avocado provision does. The split is by consumer: everything an OTA requires is at the tail of runtime build, everything only provisioning consumes is at the start of provision. A pipeline that runs avocado build and then flashes will find no var image; run avocado provision.
• Installs never prompt, and --force no longer means "don't prompt". avocado install, ext install, runtime install and sdk install pass -y unconditionally; avocado install --force now means reinstall every extension from scratch. --output json no longer implies --force.
• Steps skip when nothing they read has changed. avocado install skips extensions that are already up to date, runtime build reuses the rootfs and initramfs images, ext build and ext image skip on unchanged inputs, and stamps hash the files a build reads rather than the paths that name them. A second install with nothing changed is a no-op instead of ~26 s of redundant transactions.
• One session container per invocation. Build steps exec into a reused per-shape container instead of starting a fresh one each time, and Ctrl-C removes the containers the CLI started.
• avocado sbom emits a software_Sbom per runtime and per extension, not only one for the whole device, so Connect can ingest something narrower than "everything on the device".
• Fixes. avocado build builds the depends_on closure, not just the authored list; a kernel version change invalidates every extension's install stamp; --no-stamps removes the step's own stamp; stamp errors name the target, docker volume and daemon they searched.
• Security. rustls 0.23.45 for RUSTSEC-2026-0285.

rc.3: encrypted /var recovery, FIT signing, runtime scope

• runtimes.<name>.var.recovery and avocado var-key: an operator-held recovery key for the encrypted /var. var.recovery names an HMAC-SHA256 master secret in the key registry that is stored host-only, outside the directory the SDK bind-mounts into build containers. avocado var-key enroll <runtime> --device user@host derives a unit's passphrase from its SoC UID and adds it as a LUKS2 keyslot; avocado var-key derive reproduces it on a bench to recover a unit whose hardware keyslot is gone.
• runtimes.<name>.var.hardware: auto (default), caam, tpm2 or none. An explicit engine must hold a keyslot or the initrd refuses to boot /var on the derived key; none requires var.recovery.
• runtimes.<name>.signing.fit_key: boot-FIT signing from the key registry. Names an RSA key the runtime build materializes for mkimage, so a signed boot image is reproducible from avocado.yaml alone; signing.fit_unsigned: true is the explicit opt-out. Replaces the interim AVOCADO_FIT_KEY_DIR / AVOCADO_FIT_UNSIGNED environment variables, which are no longer read. With fit_key set the build also re-packs the feed's bootloader so U-Boot enforces that key from the first flash.
• runtimes.<name>.targets: a runtime's target scope, declared as a list. default_target is never consulted for scope. var.encrypt is scoped by this declaration, so a multi-target project can encrypt on every target it names, and an opt-in outside the declared scope is a loud refusal rather than a plaintext /var.
• avocado install follows the feed after avocado update. With no pins recorded the install runs a dnf distro-sync, for the SDK and runtime sysroots as well as rootfs and initramfs, so a rebuilt BSP (avocado-sdk-target, avocado-img-bootfiles) actually reaches the project. With pins present the lock stays authoritative.
• Fixes. avocado install exits non-zero when a sysroot install could not finish instead of writing a current stamp; the platform build hook runs again before stone bundle (Tegra needs it for boot.img); the initramfs build id is actually written into the shipped image; avocado deploy --verbose no longer fails to parse the hash collection; deploy accepts a runtime with rootfs verity; sdk install works after runtime clean; provision --list resolves its target like every other command.

The full record of each release is in the CHANGELOG.