SALT LAKE CITY -- The Open Source Security Foundation (OpenSSF) announced the release of Zarf 1.0, the first stable version of its open source tool for packaging and deploying software into air-gapped and constrained Kubernetes environments, during KubeCon + CloudNativeCon North America 2026 week.
Zarf, originally built by Defense Unicorns and now an OpenSSF project, uses a declarative packaging approach to deliver Kubernetes and cloud native workloads into offline and semi-connected environments. According to the OpenSSF announcement, version 1.0 strengthens package signing and verification workflows, improves configuration management and establishes a foundation for long-term compatibility and community-driven development.
New Package Schema and Values #
The largest addition in the release is the v1beta1 Zarf package schema, which the maintainers said converts years of user feedback into a more intuitive experience. It adds package maintenance features such as component publishing for imports and simplifies package definition templating. Package creators will also see a shift from variables to values, which give configuration a structured home with standard Go templating and support for nested data. Zarf 1.0 includes a migration guide and tooling to convert existing packages.
“Getting software into the airgap is still more work than it should be,” wrote Zarf maintainer Austin Abro of Defense Unicorns in a post announcing Zarf 1.0, noting that teams need the application, its dependencies, provenance and signatures, plus a way to deploy and update it without unexpected internet requirements.
AI Security Research and Resources #
OpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report, supported by ActiveState and the LF AI & Data Foundation, which found 58% of surveyed teams ship code faster than security reviews can keep up and 60% say AI coding assistants have increased the number of external packages in their codebases. The foundation additionally published a free developer guide on finding and fixing vulnerabilities using AI and said it will launch a Secure AI Associate certification with Linux Foundation Education in December 2026.