Ever heard of a DevSecOps software bundle for air-gapped environments? Here’s a project showcasing what that might be.

Zarf is a tool that implements secure and continuous software delivery on systems not connected to the Internet. To make this possible, various well-known software projects are combined to automate software deployment to Kubernetes. It covers:

- Building, publishing, pulling, and deploying so-called Zarf packages;
- Creating and verifying package signatures (with cosign);
- Generating SBOMs (with Syft);
- Automating performing specific actions against packages during their lifecycle;
- Using various built-in tools, such as Helm, yq, Docker registry, Gitea, and K9s.

P.S. Zarf is an OpenSSF Sandbox project.

Language: Go | License: Apache 2.0 | 1413 ⭐️

▶️ GitHub repo

#tools #security