ReARM 26.11.17: TEA v1.0.0, SBOM Scoring and Agent Task Boards GA

We're announcing a major release of ReARM v26.11.17. Detailed information is available on its release view on the ReARM Demo instance. ReARM Pro installations either have already been upgraded or will be upgraded according to upgrade policies; ReARM CE users are encouraged to upgrade to benefit from the changes described below and improved security posture.

Transparency Exchange API (TEA) v1.0.0 and Publishing

ReARM's TEA implementation now follows the v1.0.0 specification. A configurable publishing module decides what each release exposes over TEA, with multiple publishing profiles on ReARM Pro and a single profile on ReARM CE. Publishing can stamp the TEI on the release, and the release view gains a TEA tab and a separate view for generated artifacts, including the TEA SBOMs. Collection tables are easier to read and show checksums, and artifacts can be downloaded directly.

TEA can be served on the ReARM domain on both editions; ReARM Pro can also serve an organization's TEA on its own mapped domain.

SBOM Scoring and Signed Exports

SBOMs are now scored by rebom, and the score is shown in the UI. SBOM exports can be signed, and they may carry the declared licence and supplier. Each merged BOM's serial number lineage now has a designated owner, merged exports fold their inputs more accurately, and several merged-BOM issues are fixed.

Regulatory Documents and FDA Submissions (ReARM Pro)

ReARM Pro adds a new REGULATORY_DOCUMENT artifact type and the option to publish FDA submissions. Regulatory features can be switched on or off in settings.

Agent Task Boards are GA

Agent task boards, introduced as a preview in 26.10.52, are now generally available on both ReARM Pro and ReARM CE. Boards load faster, lanes are paged, and the last board you opened is remembered. Task split logic and design checkpoints help coordinators shape the work, and boards show lane hints. The task page is lighter: a task can be exported as JSON, and a PR can be unlinked from it. Each PR's delivery unit is shown, along with the list of unlinked PRs. A threat model specification type joins the board's document types.

Templates and Integration

A new template action and an Auto Integrate preview let you see what auto-integration would do before it runs.

API Key Hygiene

API Key Groups let keys share permissions: every key in a group holds the group's permissions, so access is granted, changed or withdrawn once for the whole group rather than key by key. API keys and agents are now told apart everywhere they appear, by label and short id, including the agent session page and release history. CLI login approval shows a single key list with bound keys hidden by default, and creating a Free Form key shows a notice.

Statistics Page

The statistics page shows cached totals with the date they were counted; totals show as pending until the first daily count runs.

Deployment

The Helm chart now includes configurable NetworkPolicy settings.

Security and Dependency Updates

This release contains CVE sweeps across all components and fixes related to the eMudhra certificate compromise. ReARM users are encouraged to upgrade to this release to benefit from these fixes.

Release Identification

We are continuing to publish TEIs for all ReARM releases. TEI for this release: tei://demo.rearmhq.com/uuid/b9f115fb-6688-4a3f-a262-3acc04e1fc9e.