ReARM vs sbomify

ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.

sbomify is a security artifact hub for generating, managing, analyzing and sharing software bills of materials (SBOMs) and compliance documents. It supports CycloneDX and SPDX, with generation workflows for 17 ecosystems, container images, directory scans and Yocto/OpenEmbedded builds. For CI/CD, its Action supports GitHub, while documented Docker workflows cover GitLab, Bitbucket and other systems. Vulnerability analysis integrations include Google OSV and OWASP Dependency-Track. Trust Centers let teams share security materials through a custom domain, with public or private access. Supported materials include SBOMs, VEX and CBOM artifacts, security certifications, penetration test reports and compliance attestations. Trust Center content is also available programmatically through the Transparency Exchange API. The open-source platform can be self-hosted or used as a hosted service. The free Community plan limits accounts to one product, five components, public documents and one user. Business costs $159/mo (annual); Enterprise pricing is by custom quote.