The Open Source Security Foundation (OpenSSF) has released Zarf 1.0, the first stable version of its open source tool for packaging and deploying software in air-gapped and constrained Kubernetes environments. The announcement was made during KubeCon + CloudNativeCon North America 2026 week, which began in Salt Lake City on November 9.
Originally built by Defense Unicorns, Zarf is now an OpenSSF project. It uses declarative packages to move Kubernetes and other cloud-native workloads into offline or intermittently connected environments. These settings can make software delivery more involved because teams may need to transfer applications and dependencies without relying on an internet connection at deployment time.
OpenSSF says the 1.0 release strengthens package signing and verification workflows, improves configuration management, and establishes a foundation for long-term compatibility and community-driven development. Those changes address several parts of the delivery process: defining what a package contains, managing its configuration, and checking package integrity.
A revised package schema
The release’s largest addition is the v1beta1 Zarf package schema. Maintainers describe it as a more intuitive approach shaped by years of user feedback. It adds package-maintenance capabilities, including component publishing for imports, and simplifies templating in package definitions.
Zarf 1.0 also changes how package creators define configuration. The release moves from variables to values, which provide a structured place for configuration data. Values support standard Go templating and nested data, giving package authors a defined way to organize settings used in their packages.
Existing packages will require attention during the transition to the new schema and configuration model. To support that work, the release includes a migration guide and tooling to convert packages. The available migration resources are relevant to teams that have already built Zarf packages and need to update them rather than start over.
Delivery challenges in disconnected environments
Zarf maintainer Austin Abro of Defense Unicorns described the operational challenge in his announcement of the release: getting software into an air gap remains more work than it should be. As Abro noted, teams need to bring in the application and its dependencies, as well as provenance and signatures, and then deploy and update the software without unexpected internet requirements.
That description helps frame the role of Zarf in release automation. In a disconnected environment, a deployment package must account for more than the application itself. Packaging and verification workflows are part of preparing software for delivery, while configuration and update procedures matter once the software reaches its destination. Zarf 1.0’s schema, signing and verification improvements, and migration support are aimed at these software-delivery tasks.
The release is a stable milestone for the project, but OpenSSF’s announcement does not specify a support lifecycle or compatibility guarantees beyond saying that the release establishes a foundation for long-term compatibility and community-driven development. Organizations evaluating the update will need to consult the project’s migration materials to understand how their existing packages should change.
Other OpenSSF security resources
OpenSSF also announced security work beyond Zarf. It published the State of AI Impact on Software Security and Cybersecurity 2026 report, supported by ActiveState and the LF AI & Data Foundation. The report found that 58% of surveyed teams ship code faster than security reviews can keep up, while 60% said AI coding assistants have increased the number of external packages in their codebases.
The foundation also published a free developer guide on finding and fixing vulnerabilities using AI. In addition, it said it plans to launch a Secure AI Associate certification with Linux Foundation Education in December 2026. These initiatives address software security and AI-assisted development; they are separate from the Zarf release, which focuses on packaging and delivering software to constrained Kubernetes environments.
Together, the announcements place Zarf 1.0 within a broader OpenSSF effort to support software security practices. For platform and release teams working without dependable network access, the immediate change is the stable Zarf release and its updated package model, accompanied by tools intended to help migrate existing packages.
