ReARM

ReARM is a release governance platform for tracking software composition, security posture, shipment clearance, supporting evidence, and what shipped. It organizes versioned SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and portfolio-wide searches. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR enriches SBOMs with supplier, copyright, and license details. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases and support manual or automated approvals, recording approver identity, timestamps, and evidence snapshots in an immutable audit trail. Integrations include GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider. Community Edition is self-hosted under AGPL 3.0. It can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings need Dependency-Track or imported VDR files. External deployments require TLS.

ReARM combines software inventory, findings management, release approval, and evidence retention. The Community Edition can store BOMs independently, but vulnerability scanning and policy findings require additional inputs or integration.

ReARM suits organizations managing software composition, release approvals, and supporting evidence across products and releases. Teams considering self-hosting should account for the Dependency-Track or imported VDR requirement for vulnerability scanning and policy findings.

ReARM is a release-governance system for organizations that must connect software composition, security decisions, evidence, and shipment approvals. It is most suitable for teams operating several products or releases under audit or compliance pressure. Choose it for governed, traceable releases; look elsewhere if you only need a lightweight BOM repository or standalone scanner.

Overview

ReARM links what a product contains with its security posture, release status, and retained proof of approval. That joined-up model is valuable when a release decision must be explained later, not just recorded as a pass/fail result. Organization, product, component, and release scopes give larger portfolios a way to keep findings and evidence tied to the right ownership level.

The main qualification is its analysis dependency. Community Edition can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require a self-managed Dependency-Track connection or imported VDR files. It is therefore a governance layer around analysis inputs rather than a self-contained scanner.

Key features

Versioned SBOMs and XBOMs are organized by release, component, and product. Cross-version dependency diffs and portfolio-wide dependency search help teams see where a component changed and where it appears elsewhere, which is more useful than handling each BOM as an isolated document. Reliza BEAR enriches SBOMs with supplier, copyright, and license metadata.

ReARM retains HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata with releases for more than 10 years. That long retention supports investigations and compliance evidence, provided the organization is prepared to manage the associated records.

Findings from Dependency-Track and other tools are aggregated across vulnerabilities, weaknesses, policy violations, and license violations. Triage and audit views can be applied at organization, product, component, or release scope. Release policies can run automatically, while approvals may be manual or automated; the immutable audit trail records approver identity, timestamp, and an evidence snapshot.

Integrations cover GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track, and Microsoft Azure identity provider. The Transparency Exchange API supports distributing SBOMs and artifacts to downstream consumers. Release workflows, approval gates, environment tracking, release monitoring, vulnerability and license analysis, and policy enforcement are all supported, with TLS required for deployments outside localhost.

Pricing

ReARM CE costs nothing, billed Free Forever. It is self-hosted for a single organization, includes core SBOM/XBOM storage and retrieval, and comes with community support. Vulnerabilities and violations depend on a self-managed Dependency-Track integration. This is the sensible entry point for BOM storage and teams able to operate the infrastructure themselves.

ReARM Pro - Starter costs $195 a month for 1-14 users, with up to 65GB of compressed artifact storage, managed Dependency-Track, priority support with an 8-hour response time, and a 60-day free trial. It adds managed analysis without requiring the larger deployment commitments of higher tiers.

ReARM Pro - Standard costs $1,350 a month for 15-39 users. It includes Starter features, a private VPC/VNet with SSO and unlimited artifact storage, an on-premises deployment option, enhanced 24x7 support with a 4-hour response time, and a 60-day trial. The price is aimed at established teams whose storage, identity, and deployment requirements exceed Starter.

ReARM Pro - Enterprise is $75 per user per month for 40 or more users. It includes all Standard features, 24x7 premium support with a 1-hour response time, an air-gapped deployment option, and a 60-day trial. Its per-user billing makes it the tier for large organizations that need the strongest support and isolation options.

Platforms

ReARM is offered through web and API interfaces, with self-hosted deployment. Community Edition can be installed using Docker Compose or a Kubernetes Helm chart and is licensed under AGPL 3.0. The deployment model supports both self-managed and hosted arrangements across the plans.

Who it's for

ReARM fits security, engineering, and release teams that need auditable approval gates across multiple products, especially where long-lived evidence and SBOM exchange matter. Its documented alignment helps organizations addressing EU CRA, US Executive Orders 14028 and 14144, Section 524B of the FD&C Act, or India's RBI and SEBI requirements.

It is less appropriate for a small team wanting only a scanner, because findings require Dependency-Track or imported VDR data, or for organizations unwilling to operate self-hosted infrastructure when choosing the free edition.

Pros and cons

Pros

• Evidence stays with releases: More than 10 years of retained BOM, finding, signature, attestation, and build records supports audits and post-release investigation.
• Approval records are defensible: Immutable identity, timestamp, and evidence snapshots make shipment decisions traceable.
• Portfolio visibility: Dependency diffs and cross-product search expose reuse and change across releases.
• Deployment flexibility: API, web, self-hosted, VPC/VNet, on-premises, and air-gapped options cover varied operating constraints.

Cons

• Scanning is not standalone: Vulnerability and policy findings require Dependency-Track or imported VDR files.
• Free edition is operationally demanding: It is self-hosted, limited to one organization, and backed by community support.
• Paid tiers rise sharply: Starter begins at $195 a month, while Standard is $1,350 a month before Enterprise per-user pricing.
• Deployment security needs care: TLS is required outside localhost because login fails over plain HTTP.

Alternatives

Choose Exodos Labs instead if a freemium inventory platform with a 1-user Community plan at no cost and unlimited inventories better matches your scale.

Ortelius is a free option with up to five components, unlimited users, and endpoint tracking in its free plan.

Pick FOSSA if its free tier's limits of five projects, 10 contributing developers, one release group, and five dependency levels suit your scanning scope.

Interlynk offers a forever-free community tier with no per-seat or per-SBOM metering.

Consider OTNOS SBOM 360 when a free plan capped at 50 monitored assets, one user, and two CSV imports per month is sufficient.

Sonatype Nexus Repository is an alternative repository platform with a free Community Edition and paid Pro Edition.

CAST SBOM Manager is a freemium desktop-oriented option for Linux and Windows.

Keysight Eggplant Test is paid enterprise software with a quote-based plan and a free trial.

For broader category browsing, see SBOM Management Software and Release Management Software.

Verdict

ReARM is a strong choice for organizations that need release approvals, findings, and durable evidence in one governed record, with deployment options that extend to private, on-premises, or air-gapped environments. Its decisive weakness is the need for Dependency-Track or imported VDRs for vulnerability and policy analysis, so teams seeking an all-in-one scanner or a simpler BOM tool should look elsewhere.