Flash the .img.xz exactly as downloaded. Raspberry Pi Imager and balenaEtcher both read it compressed — do not extract it first.
Verify the download before writing. A truncated file and a good one are indistinguishable to the imager, and only tell you apart when the board refuses to boot.
macOS · Linux
shasum -a 256 -c SHA256SUMS
Windows
certutil -hashfile avifi-orangepi-one-0.0.5.img.xz SHA256
The filesystem is shrunk to fit the download and grows to fill the card on first boot. Expect one early reboot while it resizes.
This image is built from a commit, audited twice before release, and flashed to a card and verified on an Orange Pi One. The audits alone could not tell you that — they read a filesystem that is switched off — so running it on the board is a separate step, and it was done. Exactly what went into this image is recorded in its build manifest.
Superseded images are kept only so a card can be traced back to what produced it, and are reachable by exact URL alone. Do not flash one because it looks older or smaller — some carry defects that cannot be repaired from the dashboard afterwards. Ask first.