ReARM vs TRUSCA

ReARM is a release governance platform for organizing software composition, security findings, approvals, and evidence around what ships. It versions SBOMs and XBOMs by product, component, and release, with dependency comparisons across versions and search across a portfolio. Releases can retain HBOMs, VEX, VDR, BOV, SARIF, signatures, attestations, and build metadata for 10+ years. Reliza BEAR adds supplier, copyright, and license metadata to SBOMs. ReARM gathers vulnerabilities, weaknesses, policy violations, and license violations from Dependency-Track and other tools for triage and audit. Release policies can check releases automatically and support manual or automated approvals, recording approver identity, timestamp, and an evidence snapshot in an immutable audit trail. It connects with tools including GitHub Actions, GitLab, Azure DevOps, Jenkins, Slack, Microsoft Teams, Microsoft Sentinel, and Dependency-Track. ReARM Community Edition is self-hosted under AGPL 3.0 and can store and version BOMs without Dependency-Track; vulnerability scanning and policy findings require Dependency-Track or imported VDR files. External deployments require TLS. A free plan is available; paid plans start at $195/mo, and a 60-day trial is listed.

TRUSCA is a free, open-source, self-hosted software composition analysis platform for CVE tracking, license compliance, and SBOM management. It uses cdxgen to detect packages across more than 30 language ecosystems, while Trivy matches components with NVD, OSV, GitHub Advisory, EPSS, and KEV data. Weekly database refreshes add new CVEs. TRUSCA imports CycloneDX or SPDX SBOMs and exports CycloneDX in JSON or XML and SPDX in JSON or Tag-Value. CI integrations include GitHub Actions, GitLab CI, Jenkins examples, a REST API, and API keys; build gates can fail on Critical CVEs or forbidden licenses. License workflows classify licenses as allowed, conditional, or forbidden, generate NOTICE files, and block forbidden licenses. The platform also offers approvals, an append-only audit log, email, Slack, Teams notifications, VEX triage, and EPSS prioritization. It runs through Docker Compose or Helm. It does not analyze users’ own source code.