Scan the bundle with your existing tools

What you receive per release

Pre-deploy — gap-host scanning, before bundles cross the air-gap

1. 01
   Verify the cosign signature.

   KMS-keyed ECDSA P-256 — fully offline, no TUF or Rekor required. If this fails, the bundle does not cross the boundary.

   cosign verify-blob \
     --key cosign.pub \
     --signature genesis-platform-{ver}.tar.zst.sig \
     --insecure-ignore-tlog \
     genesis-platform-{ver}.tar.zst
   
   # genesis verify wraps the above plus sha256 check:
   genesis verify ./genesis-platform-{ver}.tar.zst

2. 02
   CVE-gate the bundle with genesis scan.

   One command. Extracts the per-image SBOM sidecar (<bundle>.tar.zst.sboms.tar.gz), runs trivy sbom against each image's CycloneDX, aggregates HIGH+CRITICAL counts into one exit code. CI-gateable as-is; pass --no-fail for report-only.

   genesis scan ./genesis-platform-{ver}.tar.zst    # gate; non-zero on HIGH/CRITICAL
   genesis scan ./genesis-ops-{ver}.tar.zst --no-fail   # report-only
   
   # Air-gapped: the trivy CVE DB ships in the portal tools set. Pull + verify
   # it once (`genesis pull --tools` writes trivy-db.tar.gz next to your
   # bundles); scan auto-detects it, or point at it explicitly:
   genesis scan ./genesis-platform-{ver}.tar.zst --trivy-db ./tools/linux-amd64/trivy-db.tar.gz
   
   # Already have a populated cache dir? That works too:
   genesis scan ./genesis-platform-{ver}.tar.zst --trivy-db ~/.cache/trivy
   
   # Or point at an internal mirror (raw trivy flags forward after --):
   genesis scan ./genesis-platform-{ver}.tar.zst -- \
     --db-repository registry.internal/trivy-db:2 --skip-db-update

   Anything after -- is forwarded verbatim to each trivy sbom call.

3. 03
   Want Grype, Snyk, Black Duck, Mend instead of trivy?

   The per-image SBOM sidecar is plain CycloneDX — every commercial scanner reads it. Extract once, then loop your scanner over each .cdx.json. Note: the merged bundle SBOM (<bundle>.tar.zst.sbom.cdx.json) is for auditor handoff only — most scanners reject it because it spans multiple OS distributions in one document. Always scan the per-image extract.

   mkdir -p /tmp/sboms
   tar -xzf ./genesis-platform-{ver}.tar.zst.sboms.tar.gz -C /tmp/sboms
   
   # Grype
   for f in /tmp/sboms/*.cdx.json; do grype sbom:"$f" --fail-on high; done
   
   # Snyk
   for f in /tmp/sboms/*.cdx.json; do snyk sbom test --file="$f" --severity-threshold=high; done

   Black Duck / Mend / Snyk UI imports take the same per-image .cdx.json via their web upload or CLI; the file format is identical.

4. 04
   Per-image registry scanning (if your scanner needs image archives, not SBOMs).

   Aqua, Twistlock, Prisma Cloud prefer to scan image archives directly. Extract them from the bundle and feed your scanner.

   zarf package inspect genesis-platform-{ver}.tar.zst       # list images
   zarf tools registry copy oci://./genesis-platform-{ver}.tar.zst dir:./images/
   
   for img in ./images/*; do
     trivy image --input "$img" --severity HIGH,CRITICAL --exit-code 1
   done

5. 05
   Helm chart misconfiguration scanning.

   Render manifests offline, run them through Kubescape / Polaris / Datree / OPA Gatekeeper / Kyverno / your in-house rego.

   zarf package inspect genesis-platform-{ver}.tar.zst --extract-helm \
     > rendered-manifests.yaml
   
   kubescape scan rendered-manifests.yaml --framework nsa,mitre,cis-eks
   polaris audit --audit-path rendered-manifests.yaml
   conftest test rendered-manifests.yaml --policy ./your-rego-policies/

6. 06
   License + secret scanning.

   FOSSA, Black Duck, Mend ingest the merged CycloneDX directly for license analysis (license analyzers don't have the multi-OS issue CVE scanners do — they only look at component metadata). gitleaks / trufflehog over the rendered manifests catch accidental secrets — Genesis manifests contain none, but check anyway.

   fossa sbom analyze ./genesis-platform-{ver}.tar.zst.sbom.cdx.json
   gitleaks detect --no-git --source ./rendered-manifests.yaml

Post-deploy — once images land in your registry

Without Zarf — the alternate path

If your security team blocks Zarf (mutating webhook policy, vendor risk review, approved-tools list), the same scanning flow works on the plain artifacts. Un-tar manually and feed your existing pipeline.

# Un-tar the bundle (zstd → tar)
zstd -d genesis-platform-{ver}.tar.zst -o genesis-platform-{ver}.tar
mkdir extracted && tar -xf genesis-platform-{ver}.tar -C extracted/

# Mirror images to your registry with skopeo (no Zarf)
for img in extracted/images/*; do
  skopeo copy oci-archive:"$img" \
    docker://your-acr.azurecr.io/$(basename "$img" .tar)
done

# Install with helm directly
helm install genesis ./extracted/charts/genesis-{ver}.tgz \
  -f your-values.yaml \
  --set global.imageRegistry=your-acr.azurecr.io \
  -n genesis --create-namespace

Every scanning step on this page still applies — they operate on the SBOM, the cosign bundle, the rendered manifests, and the image archives, none of which are Zarf-specific.

Where to go next