zarf-dev/zarf v1.0.0

on GitHub

1.0.0 (2026-11-10)

⚠ BREAKING CHANGES

• state: remove storageclass and distro (#5624)
• limit v1beta1 init package values chart inputs (#5631)
• removed deprecated SDK fields and bridges (#5615)
• error when package secret write fails (#5621)
• compress Zarf state (#5619)
• default to v1beta1 init package (#5598)
• removed deprecated k8s api migration (#5613)
• state enhancement updates (#5525)
• error when variables are used with v1beta1 (#5606)
• remove daemon pull through crane (#5568)
• remove zarf tools registry export (#5562)
• remove deprecated commands and flags (#5605)
• replace global architecture state with per-operation options (#5498)
• remove sbom viewer (#5563)
• delete artifact server (#5561)

Features

• compress Zarf state (#5619) (c242327)
• default to v1beta1 init package (#5598) (6c2e879)
• delete artifact server (#5561) (2b51f6c)
• deprecate v1alpha1 packages (#5623) (b0ca5a9)
• dev sha256sum not working with extract-path flag (#5160) (badae8f)
• dev: add --confirm flag to patch-git (#5531) (f0861e2)
• error when package secret write fails (#5621) (b17ad04)
• error when variables are used with v1beta1 (#5606) (8e854f4)
• limit v1beta1 init package values chart inputs (#5631) (24cdbc5)
• oci: added chuncked retryable resumable blob pulls (#5597) (d0d271c)
• remove daemon pull through crane (#5568) (c7fc4d4)
• remove deprecated commands and flags (#5605) (3501866)
• remove sbom viewer (#5563) (f8e60d0)
• remove zarf tools registry export (#5562) (f3961a9)
• removed deprecated k8s api migration (#5613) (dbb02f0)
• removed deprecated SDK fields and bridges (#5615) (0cf9039)
• state enhancement updates (#5525) (517db72)
• state: remove storageclass and distro (#5624) (aa632e0)

Bug Fixes

• deep copy values on merge so a chart mapping can't leak into later components (#5585) (8802592)
• print a valid skeleton import example from the CLI (#5530) (a9d5dd5)

Refactoring

• replace global architecture state with per-operation options (#5498) (049d855)

What's Changed

🚀 Updates

• chore(main): release 1.0.0 by @zarf-release-please[bot] in #5567

Full Changelog: v1.0.0-rc1...v1.0.0

Verifying Init Packages

The init packages in this release are signed with keyless Sigstore signing. Verify with:

amd64:

zarf package verify zarf-init-amd64-v1.0.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

arm64:

zarf package verify zarf-init-arm64-v1.0.0.tar.zst \
  --certificate-identity "https://github.com/zarf-dev/zarf/.github/workflows/release.yml@refs/tags/v1.0.0" \
  --certificate-oidc-issuer "https://token.actions.githubusercontent.com"

See RELEASES.md for details.