OpenSSF Releases Zarf 1.0 for Air-Gapped Kubernetes Software Delivery
SALT LAKE CITY -- The Open Source Security Foundation (OpenSSF) announced the release of Zarf 1.0, the first stable version of its open source tool for packaging and deploying software into air-gapped and constrained Kubernetes environments, during KubeCon + CloudNativeCon North America 2026 week. Zarf, originally built by Defense Unicorns The post OpenSSF Releases Zarf 1.0 for Air-Gapped…
On the last day of KubeCon + CloudNativeCon North America 2026, OpenSSF unveiled Zarf 1.0, its inaugural stable version dedicated to packaging and deploying software into air-gapped and constrained Kubernetes environments. Originally developed by Defense Unicorns and now a part of the OpenSSF, Zarf employs a declarative packaging method to transport Kubernetes and cloud-native workloads to offline and semi-connected settings.
Version 1.0 of Zarf enhances package signing and verification processes, refines configuration management, and sets the groundwork for enduring compatibility and community-led development. The most notable enhancement in this release is the v1beta1 Zarf package schema, a direct outcome of years of user feedback. This update offers a more user-friendly experience, incorporating package maintenance features like component publishing for imports and streamlining package definition templating.
Package creators will observe an evolution from variables to values, which provide configuration with a structured format utilizing standard Go templating and enabling nested data. Zarf 1.0 also includes a migration guide and tools to transition existing packages. Austin Abro, maintainer of Zarf from Defense Unicorns, highlighted in a post announcing Zarf 1.0 that distributing software within an air-gapped environment remains more challenging than necessary due to the necessity of the application, its dependencies, provenance, and signatures, along with a means for deployment and updates without reliance on an active internet connection.
In addition to Zarf 1.0, OpenSSF disseminated the State of AI Impact on Software Security and Cybersecurity 2026 report, backed by ActiveState and the LF AI & Data Foundation. The report disclosed that 58% of surveyed teams expedite software shipping more rapidly than security reviews can keep pace, while 60% indicate that AI coding assistants have elevated the quantity of external packages within their codebases.
Furthermore, OpenSSF published a complimentary developer guide on discovering and rectifying vulnerabilities leveraging AI and expressed its intention to launch a Secure AI Associate certification in collaboration with the Linux Foundation Education in December 2026.
Written by urgent.news from Container Journal's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
