Meta:
Build:
Social:
ReARM - Release Governance Platform - Community Edition
ReARM CE governs releases at agentic speed. It tells you what each product is made of, its security posture and stores and manages per-release SBOMs, HBOMs, xBOMs, SAST / DAST scan results, Digital Signatures, Attestations, and other Security Artifacts and Metadata.
https://github.com/user-attachments/assets/a315c5b2-7116-4b4a-bb4b-28e77d3ae9b3
ReARM CE Demos
About
ReARM is an abbreviation for "Reliza's Artifact and Release Management". It is a Release Governance Platform to manage lifecycle for product and component releases and organize release metadata, including SBOMs, xBOMs, other security artifacts, vulnerability, weakness, policy and license violation data. See here how ReARM compares with other tools
ReARM may use any OCI-compatible storage.
ReARM was the first project that introduced the principles of Product-Component relationship within release metadata organization which is seeing increasing market adoption.
ReARM is developed by Reliza. Read about project history on our blog.
Installation
Minimum installation only requires operational Docker with Docker Compose. Production installation is recommended on Kubernetes using included ReARM Helm chart.
To install ReARM, follow documentation here.
Project links
ReARM Product Status Information
- ReARM itself - General Availability
- Transparency Exchange API (TEA) implementation - TEA v 0.4.0 Public Alpha available on ReARM Demo Instance (see below for details)
Motivation
ReARM is a xBOM management system that allows organizations to maintain compliance within various regulatory frameworks, including:
While highlighting regulatory pressure, we strive to make sure that ReARM bears minimum or no overhead on developers and more so provides real value in terms of managing technology releases and their metadata. In other words, our goal is creating a product that would be useful for developers and managers, while also solving the compliance problem.
Present Capabilities
- Storage for 10+ years (e.g., to meet EU CRA retention requirements) and retrieval of SBOMs / xBOMs for software and hardware, per release, including signatures and signing details with rich export capabilities (e.g., option to exclude Dev / Test dependencies or option to list only top level dependencies)
- Seamless creation of aggregated BOMs on Component and Product Release levels
- Maintaining representation of organization's products and components with branches and releases
- Automated creation of release versions and changelogs between releases
- Integration with Dependency-Track for analysis of vulnerabilities and policies, including license policy, while optimizing Dependency-Track performance via data deduplication
- Search for presence of dependencies in organization's software based on Dependency-Track data
- Integration with various CI systems (including GitHub Actions, Azure DevOps, Jenkins, GitLab CI and others) to produce BOMs and upload them with other release metadata to ReARM
- Release approval logic with triggers based on approvals and / or vulnerabilities or policy violations (ReARM Pro only)
- Marketing release workflow (Commercial Edition only)
- Component release-level alerts and changelog for changes in SBOM dependencies
- Finding audit (includes audit for vulnerabilities, weaknesses, policy violations)
- RBAC
- VEX import and export workflow (CycloneDX, OpenVEX). Import workflow supports staging area.
- Agentic Dashboard
Future Capabilities (Medium-Term Roadmap)
- Better handling and prescribed workflows for Attestations
- Options to exchange BOM data with public or specific people or organizations only (via both Transparency Exchange API and ReARM own capabilities)
Releases
ReARM follows Trunk Based Development (TBD) methodology. This means that maintainers commit directly to the main branch where possible. Consumers should use releases marked as SHIPPED (or GENERAL_AVAILABILITY).
Refer to ReARM Community Edition Product on ReARM Demo Instance for the constantly updated list of ReARM releases. SHIPPED releases are also published under GitHub Releases in this repository.
Helm chart and docker compose files tagged to a release contain a list of specific images that correspond to particular release.
Transparency Exchange API
Creators of ReARM are part of active contributors of Transparency Exchange API (TEA) that aims to build standard API for exchanging supply chain artifacts and intelligence.
A lot of core ReARM ideas are shared as a part of the TEA workgroup with permissive Open Source licensing.
ReARM currently supports most of TEA v 0.4.0 functionality and we are working to expand and improve support. Refer to usage and status documentation on ReARM Documentation Website here.
Related Projects
Public Demo
Public Demo is available at https://demo.rearmhq.com. When you register for the demo, you get read-only account for the Demo organization and can browse several existing demo Components, Products, Releases. You may then also create your own organization and try organizing storage for your own release metadata - refer to the tutorial Upload Your First BOM. Note, that while your data on Public Demo is private, it is subject to deletion at any time and without notice.
Developing ReARM
Generate TEA-overlay from TEA OpenAPI spec
OpenAPI Spec can be found here - https://github.com/CycloneDX/transparency-exchange-api/blob/main/spec/openapi.yaml
And then copied into tea-spec/ directory in this repository as well. The copy here is TEA 1.0.0 (info.version: 1.0.0), taken from that repository at commit d496de7000d1ec330671189a13cf8bf078eafc1c (the file last changed in a31ee8caebdd818867b016d43c8656a1b51eb8aa).
To generate initial tea-server spring service, pin the generator and run
npx @openapitools/openapi-generator-cli version-manager set 7.21.0
npx @openapitools/openapi-generator-cli generate -i tea-spec/openapi.yaml -g spring -o tea-server/ --additional-properties="useSpringBoot3=true,modelPackage=io.reliza.model.tea,apiPackage=io.reliza.ws.tea,modelNamePrefix=Tea" --parameter-name-mappings mediaType=requestedMediaType
The parameter name mapping renames only the Java parameter of the artifact download operations' mediaType query parameter (the HTTP name stays mediaType): without it the generated ArtifactApi does not compile, because its example bodies declare a local variable of the same name. Only model/tea/*.java, ws/tea/*Api.java and ws/tea/ApiUtil.java are taken from tea-server/.
Local Development
- Create a docker container for database:
docker run --name rearm-postgres -d -p 5440:5432 -e POSTGRES_PASSWORD=relizaPass postgres:17
This part will be continued (TODO).
Licensing
ReARM Community Edition is licensed under the GNU AGPL v3.
Contributions are accepted under the repository's license plus a grant that lets Reliza relicense them, including for ReARM Pro — see Licensing of contributions before opening a pull request.
The deploy directory is an exception: everything in it - the Docker Compose stacks and the Helm charts - is licensed under the MIT License, so you can adapt and redistribute your deployment configuration without AGPL obligations. See deploy/README.md for details.
Third-party components redistributed in this repository keep their own licenses. In particular, the upstream Dependency-Track Helm chart vendored under deploy/helm/dtrack5-helm/charts/ is Apache-2.0, with a copy of that license included alongside it.
Contact Reliza
Easiest way to contact us is through our Discord Community - find #rearm channel there and either post in this channel or send a direct message to maintainers.
You can also send us an email to [email protected].
