Workload Images comprising one or more artifacts are managed in a decentralized and centralized manner. Local management comprises breaking any image/artifact into blocks, encrypting each block with a key known and available only to the local processing environment, and uniquely signing each encrypted block. Published versions of the images/artifacts are retained remotely in a cloud/server in encrypted and signed block format. When retrieval, modification, addition, deletion, and deployment of any given image/artifact is needed, the target device/server that is to receive the image/artifact provides a listing of encrypted blocks with the corresponding signatures that are already present on that device/server and a centralized cloud/server schedules and manages download of just those encrypted blocks that are missing to the target device/server. The target device/server assembles and installs the image/artifact using the downloaded blocks received from the cloud/server and the existing blocks already present on the target device/server.