{"slug": "openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery", "title": "OpenSSF Releases Zarf 1.0 for Air-Gapped Kubernetes Software Delivery", "summary": "The Open Source Security Foundation released Zarf 1.0, the first stable version of its open source tool for packaging and deploying software into air-gapped and constrained Kubernetes environments, announced during KubeCon + CloudNativeCon North America 2026 week. Zarf 1.0 adds the v1beta1 package schema, which shifts package configuration from variables to values with standard Go templating and nested data support, strengthens package signing and verification workflows, and ships a migration guide and tooling to convert existing packages. Zarf maintainer Austin Abro of Defense Unicorns wrote that \"Getting software into the airgap is still more work than it should be,\" and OpenSSF separately released its State of AI Impact on Software Security and Cybersecurity 2026 report, which found 58% of surveyed teams ship code faster than security reviews can keep up and 60% say AI coding assistants have increased the number of external packages in their codebases.", "body_md": "# OpenSSF Releases Zarf 1.0 for Air-Gapped Kubernetes Software Delivery\n\nSALT LAKE CITY -- The Open Source Security Foundation (OpenSSF) announced the release of Zarf 1.0, the first stable version of its open source tool for packaging and deploying software into air-gapped and constrained Kubernetes environments, during KubeCon + CloudNativeCon North America 2026 week.\n\nZarf, originally built by Defense Unicorns and now an OpenSSF project, uses a declarative packaging approach to deliver Kubernetes and cloud native workloads into offline and semi-connected environments. According to [the OpenSSF announcement](https://www.prnewswire.com/news-releases/openssf-welcomes-new-members-and-expands-ai-security-resources-302932951.html), version 1.0 strengthens package signing and verification workflows, improves configuration management and establishes a foundation for long-term compatibility and community-driven development.\n\n## New Package Schema and Values\n\nThe largest addition in the release is the v1beta1 Zarf package schema, which the maintainers said converts years of user feedback into a more intuitive experience. It adds package maintenance features such as component publishing for imports and simplifies package definition templating. Package creators will also see a shift from variables to values, which give configuration a structured home with standard Go templating and support for nested data. Zarf 1.0 includes a migration guide and tooling to convert existing packages.\n\n“Getting software into the airgap is still more work than it should be,” wrote Zarf maintainer Austin Abro of Defense Unicorns in [a post announcing Zarf 1.0](https://openssf.org/blog/2026/11/09/announcing-zarf-1-0-security-and-stability-for-airgap-software-delivery/), noting that teams need the application, its dependencies, provenance and signatures, plus a way to deploy and update it without unexpected internet requirements.\n\n## AI Security Research and Resources\n\nOpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report, supported by ActiveState and the LF AI & Data Foundation, which found 58% of surveyed teams ship code faster than security reviews can keep up and 60% say AI coding assistants have increased the number of external packages in their codebases. The foundation additionally published a free developer guide on finding and fixing vulnerabilities using AI and said it will launch a Secure AI Associate certification with Linux Foundation Education in December 2026.", "url": "https://wpnews.pro/news/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery", "canonical_source": "https://cloudnativenow.com/kubecon-cloudnativecon-north-america-2026/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery/", "published_at": "2026-11-10 01:20:12+00:00", "updated_at": "2026-11-10 01:52:54.309244+00:00", "lang": "en", "topics": ["ai-safety", "developer-tools", "artificial-intelligence"], "entities": ["Open Source Security Foundation", "Zarf", "Defense Unicorns", "Austin Abro", "KubeCon + CloudNativeCon North America 2026", "ActiveState", "LF AI & Data Foundation", "Linux Foundation Education"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery", "markdown": "https://wpnews.pro/news/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery.md", "text": "https://wpnews.pro/news/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery.txt", "jsonld": "https://wpnews.pro/news/openssf-releases-zarf-1-0-for-air-gapped-kubernetes-software-delivery.jsonld"}}