OpenSSF Releases Zarf 1.0 for Air-Gapped Kubernetes Software Delivery

SALT LAKE CITY -- The Open Source Security Foundation (OpenSSF) announced the release of Zarf 1.0, the first stable version of its open source tool for packaging and deploying software into air-gapped and constrained Kubernetes environments, during KubeCon + CloudNativeCon North America 2026 week.

Zarf, originally built by Defense Unicorns and now an OpenSSF project, uses a declarative packaging approach to deliver Kubernetes and cloud native workloads into offline and semi-connected environments. According to the OpenSSF announcement, version 1.0 strengthens package signing and verification workflows, improves configuration management and establishes a foundation for long-term compatibility and community-driven development.

New Package Schema and Values

The largest addition in the release is the v1beta1 Zarf package schema, which the maintainers said converts years of user feedback into a more intuitive experience. It adds package maintenance features such as component publishing for imports and simplifies package definition templating. Package creators will also see a shift from variables to values, which give configuration a structured home with standard Go templating and support for nested data. Zarf 1.0 includes a migration guide and tooling to convert existing packages.

“Getting software into the airgap is still more work than it should be,” wrote Zarf maintainer Austin Abro of Defense Unicorns in a post announcing Zarf 1.0, noting that teams need the application, its dependencies, provenance and signatures, plus a way to deploy and update it without unexpected internet requirements.

AI Security Research and Resources

OpenSSF also released the State of AI Impact on Software Security and Cybersecurity 2026 report, supported by ActiveState and the LF AI & Data Foundation, which found 58% of surveyed teams ship code faster than security reviews can keep up and 60% say AI coding assistants have increased the number of external packages in their codebases. The foundation additionally published a free developer guide on finding and fixing vulnerabilities using AI and said it will launch a Secure AI Associate certification with Linux Foundation Education in December 2026.