Overview

ReARM is organized around the composition and security posture of a product, the evidence attached to it, and whether a particular release has been cleared to ship. That model can give teams a more useful record than a collection of standalone BOM files: component data, findings and approval evidence can be considered in the context of a product and release.

The boundary is important. ReARM can store and version BOMs without Dependency-Track, but vulnerability scanning and policy findings require Dependency-Track or imported VDR files. Organizations expecting ReARM alone to perform vulnerability analysis will need another source for those findings.

Key features

Versioned SBOMs and XBOMs are organized by release, component and product, with cross-version dependency diffs and portfolio-wide dependency search. This is useful for teams tracking component changes across several products or releases; it is more structure than teams that only need to archive a BOM may require. Reliza BEAR enriches SBOMs with supplier, copyright and license metadata.

ReARM stores HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations and build metadata with releases for 10+ years. Findings from Dependency-Track and other tools can be triaged and audited at organization, product, component or release scope. This combines evidence retention with findings review, though scanning and policy findings still depend on Dependency-Track or imported VDRs.

Release policies can check releases automatically, while approvals can be manual or automated. The audit trail records approver identity, timestamp and an evidence snapshot, supporting review of who approved a release and on what basis. Integrations include GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, Dependency-Track and Microsoft Azure identity provider. Transparency Exchange API support provides a route to distribute SBOMs and artifacts to downstream consumers.

Community Edition can be deployed with Docker Compose or a Kubernetes Helm chart under AGPL 3.0. For deployments outside localhost, TLS is required because login fails on a plain-HTTP page. ReARM supports xBOM needs associated with EU CRA, US Executive Orders 14028 and 14144, Section 524B of the FD&C Act, and India's RBI and SEBI.

Pricing

ReARM uses a freemium model, with paid plans from $195/mo and a free 60-day trial on the Pro plans.

ReARM CE: 0.00 USD per free, billed Free Forever. It is self-hosted, limited to a single organization, and includes community support, core SBOM/XBOM storage and retrieval, and vulnerabilities and violations through a self-managed Dependency-Track integration. It suits teams comfortable operating the integration themselves; it does not include the managed Dependency-Track or paid support of Starter.
ReARM Pro - Starter: 195.00 USD per month, billed $195 Per Month. It covers 1-14 users, up to 65GB compressed artifact storage, priority support with an 8-hour response time, and managed Dependency-Track. This is the entry paid fit for smaller teams wanting managed analysis, but the user and storage ceilings matter as release evidence grows.
ReARM Pro - Standard: 1350.00 USD per month, billed $1,350 Per Month. For 15-39 users, it includes Starter features, a private VPC/VNet with SSO and unlimited artifact storage, an on-prem deployment option, and enhanced 24x7 support with a 4-hour response time. It targets larger teams needing private deployment and storage headroom.
ReARM Pro - Enterprise: 75.00 USD per month, billed $75 per user per month for 40+ users. It includes all Standard features, premium 24x7 support with a 1-hour response time, and an air-gapped deployment option. The per-user term makes the total dependent on seat count; this tier is aimed at organizations with larger teams and stricter deployment or support needs.

Platforms

ReARM is available through an API and web interface, with self-hosted deployment also supported. Community Edition is explicitly self-hosted; the Pro tiers include private or on-prem deployment options at their respective levels.

Who it's for

ReARM is a fit for product security and release teams that need to connect BOM versions, findings, retained evidence and approval records across multiple products. It is less compelling for teams seeking only BOM storage or a standalone vulnerability scanner, since its governance workflow adds little to the former and its scanning findings depend on external inputs.

Pros and cons

Pro: BOMs, findings and approvals are tied to product and release scope, helping teams trace what changed and what was approved.
Pro: Evidence retention covers multiple artifact types for 10+ years, with identity and evidence snapshots captured in an immutable approval trail.
Pro: Self-hosted Community Edition is free forever and supports Docker Compose or Kubernetes Helm deployment.
Con: Vulnerability scanning and policy findings require Dependency-Track or imported VDR files, so ReARM is not sufficient as a standalone analysis source.
Con: Starter is capped at 14 users and 65GB compressed artifact storage; teams needing 15 or more users move to the substantially higher-priced Standard tier.
Con: Self-hosted deployments outside localhost require TLS for login, adding a deployment requirement teams must plan for.

Alternatives

For other release and SBOM tools, see Release Management Software and SBOM Management Software.

For a different software category, PlayStation Emulators is a list of alternatives.

Other alternatives include no$psx, PCSX-Redux, Avocado, DuckStation, Gamma, HopStation, QuackStation and ScePSX.

Verdict

Choose ReARM if release governance needs to join BOM history, security findings, durable evidence and auditable approvals in one workflow. Its key advantage is that connection between product composition and shipment clearance; look elsewhere if you need vulnerability scanning without Dependency-Track or imported VDRs, or if your requirement is simply BOM storage.

	Apache Trusted Releases	ReARM
Free plan	No	Yes
Free trial	No	Yes
Paid from	—	$75/mo
Open source	No	No
Platforms	api, self-hosted, Web	api, self-hosted, Web
Release workflows	Yes	Yes
Approval gates	Yes	Yes
Free plan	—	Yes
Environment tracking	—	Yes
Audit trail	—	Yes

Apache Trusted Releases vs ReARM

Apache Trusted Releases

ReARM