Zarf 1.0 Reaches Stability With Enhanced Security for Disconnected Deployments
Defense Unicorns has released Zarf 1.0, a tool designed to simplify the complex process of deploying software into air-gapped environments. The release emphasizes security, stability and long-term maintainability.
The Problem Zarf Addresses
Deploying applications into isolated networks remains unnecessarily complicated. Teams must manage the application itself, its dependencies, cryptographic signatures and provenance information, all while ensuring the deployment process doesn't unexpectedly demand internet connectivity. Defense Unicorns created Zarf to tackle this challenge, and the project has now reached its 1.0 milestone with a focus on security, stability, and sustainable development practices.
Key Improvements in Version 1.0
Organizations adopting Zarf for their delivery pipelines require confidence in what they're deploying, assurance about its origins, and predictability during upgrades. The 1.0 release addresses these concerns through improved package signing and verification mechanisms, more consistent behavior across deployments, and a package format designed for backward compatibility. The project's roadmap reflects these priorities and will continue evolving as the community expands.
The v1beta1 Schema and Migration Path
The most significant addition to 1.0 is the v1beta1 Zarf package schema, which incorporates years of user feedback into a more accessible design. The schema introduces tools for package maintenance, including component publishing for imports, and streamlines the templating process for package definitions. By retiring outdated and cumbersome features, the project establishes a foundation for sustained schema compatibility.
A major shift for package creators involves replacing variables with values. This change moves configuration from scattered template markers like ###ZARF_VAR_*### into a structured format using standard Go templating with support for hierarchical data structures. This approach makes complex configurations more readable and maintainable. The 1.0 release includes migration documentation and automated tools to help teams transition existing packages.
Commitment to Project Longevity
Ensuring Zarf's future requires attention to the people and processes that sustain it. The team has strengthened its approach to dependency management, documentation, governance structures, and community participation. Given the frequency of software security incidents, the project emphasizes its partnership with the OpenSSF and commitment to their mission of securing the open-source ecosystem.
The Zarf team credits all contributors—those who wrote code, reported issues, reviewed designs, and offered feedback—for reaching this milestone.
Getting Involved
New and existing contributors are encouraged to participate in Zarf's development. Opportunities include providing feedback, reviewing proposals, engaging in OpenSSF or Kubernetes Slack channels, or submitting code improvements to advance air-gap software delivery.
ZarfFest at KubeCon
Defense Unicorns and OpenSSF will host ZarfFest on November 11, 2026, from 6:30–9:30 p.m. at the Van Ryder Rooftop @ Le Méridien Salt Lake City Downtown, during KubeCon + CloudNativeCon + Open Source SecurityCon in Salt Lake City. The event brings together developers, maintainers, and open-source contributors for networking and discussion. Registration is required, and attendees must be 21 or older. Space is limited.