Meta:

Build:

Social:

• Demo for Black Hat 2026 USA Arsenal: https://www.youtube.com/watch?v=PNGxlvV-EsM (28 minutes)
• Demo for SecTor 2025 Arsenal: https://www.youtube.com/watch?v=PNGxlvV-EsM (23 minutes)

ReARM is an abbreviation for "Reliza's Artifact and Release Management". It is a Release Governance Platform to manage lifecycle for product and component releases and organize release metadata, including SBOMs, xBOMs, other security artifacts, vulnerability, weakness, policy and license violation data. See here how ReARM compares with other tools

ReARM may use any OCI-compatible storage.

ReARM was the first project that introduced the principles of Product-Component relationship within release metadata organization which is seeing increasing market adoption.

ReARM is developed by Reliza. Read about project history on our blog.

Minimum installation only requires operational Docker with Docker Compose. Production installation is recommended on Kubernetes using included ReARM Helm chart.

To install ReARM, follow documentation here.

• Documentation: https://docs.rearmhq.com
• Video learning and tutorials playlist (wip): https://www.youtube.com/playlist?list=PLPABgZUOtPyXyC9YWJktF-sfu0ewpytGf
• ReARM CLI: https://github.com/relizaio/rearm-cli
• Project ReARM web-site: https://rearmhq.com
• Public Demo: https://demo.rearmhq.com
• Reliza Website: https://reliza.io
• Reliza Versioning: https://github.com/relizaio/versioning

• ReARM itself - General Availability
• Transparency Exchange API (TEA) implementation - General Availability at TEA v1.0.0

ReARM is a xBOM management system that allows organizations to maintain compliance within various regulatory frameworks, including:

• European CRA regulations, BSI TR-03183, implied use of xBOMs in NIS2 Directive and DORA
• US executive order 14028
• US Army Memorandum on SBOMs
• US executive order 14144 (later amended)
• Section 524B of the US FD&C Act and its guidance
• Reserve Bank of India (RBI) and the Securities and Exchange Board of India (SEBI) Cybersecurity and Cyber Resilience Framework SBOM requirements with faq
• South Korea is planning to implement mandatory SBOM requirements for public sector by 2027: source
• Japan has SBOM recommendations in METI SBOM Guide and via JC-STAR program

While highlighting regulatory pressure, we strive to make sure that ReARM bears minimum or no overhead on developers and more so provides real value in terms of managing technology releases and their metadata. In other words, our goal is creating a product that would be useful for developers and managers, while also solving the compliance problem.

1. Storage for 10+ years (e.g., to meet EU CRA retention requirements) and retrieval of SBOMs / xBOMs for software and hardware, per release, including signatures and signing details with rich export capabilities (e.g., option to exclude Dev / Test dependencies or option to list only top level dependencies)
2. Seamless creation of aggregated BOMs on Component and Product Release levels
3. Maintaining representation of organization's products and components with branches and releases
4. Automated creation of release versions and changelogs between releases
5. Integration with Dependency-Track for analysis of vulnerabilities and policies, including license policy, while optimizing Dependency-Track performance via data deduplication
6. Search for presence of dependencies in organization's software based on Dependency-Track data
7. Integration with various CI systems (including GitHub Actions, Azure DevOps, Jenkins, GitLab CI and others) to produce BOMs and upload them with other release metadata to ReARM
8. Release approval logic with triggers based on approvals and / or vulnerabilities or policy violations (ReARM Pro only)
9. Marketing release workflow (Commercial Edition only)
10. Component release-level alerts and changelog for changes in SBOM dependencies
11. Finding audit (includes audit for vulnerabilities, weaknesses, policy violations)
12. RBAC
13. VEX import and export workflow (CycloneDX, OpenVEX). Import workflow supports staging area.
14. Agentic Dashboard

1. Better handling and prescribed workflows for Attestations
2. Options to exchange BOM data with public or specific people or organizations only (via both Transparency Exchange API and ReARM own capabilities)

ReARM follows Trunk Based Development (TBD) methodology. This means that maintainers commit directly to the main branch where possible. Consumers should use releases marked as SHIPPED (or GENERAL_AVAILABILITY).

Refer to ReARM Community Edition Product on ReARM Demo Instance for the constantly updated list of ReARM releases. SHIPPED releases are also published under GitHub Releases in this repository.

Helm chart and docker compose files tagged to a release contain a list of specific images that correspond to particular release.

Creators of ReARM are part of active contributors of Transparency Exchange API (TEA) that aims to build standard API for exchanging supply chain artifacts and intelligence.

A lot of core ReARM ideas are shared as a part of the TEA workgroup with permissive Open Source licensing.

ReARM currently supports most of TEA v 0.4.0 functionality and we are working to expand and improve support. Refer to usage and status documentation on ReARM Documentation Website here.

• ReARM CLI: https://github.com/relizaio/rearm-cli - CLI tool to interact with ReARM for humans and automation bots
• BEAR (BOM Enrichment and Augmentation by Reliza): https://github.com/relizaio/bear - BEAR may be used for BOM enrichment before uploading to ReARM
• Reliza Versioning library: https://github.com/relizaio/versioning - Versioning library is used for automated versioning increments, comparisons and change logs handled by ReARM

Public Demo is available at https://demo.rearmhq.com. When you register for the demo, you get read-only account for the Demo organization and can browse several existing demo Components, Products, Releases. You may then also create your own organization and try organizing storage for your own release metadata - refer to the tutorial Upload Your First BOM. Note, that while your data on Public Demo is private, it is subject to deletion at any time and without notice.

OpenAPI Spec can be found here - https://github.com/CycloneDX/transparency-exchange-api/blob/main/spec/openapi.yaml

And then copied into tea-spec/ directory in this repository as well. The copy here is TEA 1.0.0 (info.version: 1.0.0), taken from that repository at commit d496de7000d1ec330671189a13cf8bf078eafc1c (the file last changed in a31ee8caebdd818867b016d43c8656a1b51eb8aa).

To generate initial tea-server spring service, pin the generator and run

npx @openapitools/openapi-generator-cli version-manager set 7.21.0
npx @openapitools/openapi-generator-cli generate -i tea-spec/openapi.yaml -g spring -o tea-server/ --additional-properties="useSpringBoot3=true,modelPackage=io.reliza.model.tea,apiPackage=io.reliza.ws.tea,modelNamePrefix=Tea" --parameter-name-mappings mediaType=requestedMediaType

The parameter name mapping renames only the Java parameter of the artifact download operations' mediaType query parameter (the HTTP name stays mediaType): without it the generated ArtifactApi does not compile, because its example bodies declare a local variable of the same name. Only model/tea/*.java, ws/tea/*Api.java and ws/tea/ApiUtil.java are taken from tea-server/.

1. Create a docker container for database:

docker run --name rearm-postgres -d -p 5440:5432 -e POSTGRES_PASSWORD=relizaPass postgres:17

This part will be continued (TODO).

ReARM Community Edition is licensed under the GNU AGPL v3.

Contributions are accepted under the repository's license plus a grant that lets Reliza relicense them, including for ReARM Pro — see Licensing of contributions before opening a pull request.

The deploy directory is an exception: everything in it - the Docker Compose stacks and the Helm charts - is licensed under the MIT License, so you can adapt and redistribute your deployment configuration without AGPL obligations. See deploy/README.md for details.

Third-party components redistributed in this repository keep their own licenses. In particular, the upstream Dependency-Track Helm chart vendored under deploy/helm/dtrack5-helm/charts/ is Apache-2.0, with a copy of that license included alongside it.

Easiest way to contact us is through our Discord Community - find #rearm channel there and either post in this channel or send a direct message to maintainers.

You can also send us an email to [email protected].