I cannot unseal the system

[KoldoCanellas]

Hello, I am deploying reARM with Kubernetes. Once I have created a new user, when I access the UI, it asks me for the installation secret. I obtain it as stated in the documentation with

echo $(kubectl get secret --namespace rearm system-secret -o jsonpath="{.data.systemSecret}" | base64 --decode)

but when I enter it in the text input field, I get an error. Do you know what I might be doing wrong?

I have tried recreating the secret and restarting the backend pod, but I still get the same error.

Will each teammate have to unseal the system, or will the message appear whenever they refresh the page?

[taleodor]

Hi, what you're doing is correct. Please double check if there are any whitspace or end-of-line characters that could have made it into the secret - maybe type everything by hand.

Unsealing is a one-time thing - once you unseal, your user becomes super admin for the system. Other users won't have to deal with that process.

If you still have troubles unsealing, could you check if there is anything suspicious in the backend logs and maybe paste here?

[KoldoCanellas]

Hi,

I have tried entering the secret in several ways (one of them manually) and I get the same error. I have also tried to look at the logs and I don't see much information about it. I am attaching the logs.

  .   ____          _            __ _ _
 /\\ / ___'_ __ _ _(_)_ __  __ _ \ \ \ \
( ( )\___ | '_ | '_| | '_ \/ _` | \ \ \ \
 \\/  ___)| |_)| | | | | || (_| |  ) ) ) )
  '  |____| .__|_| |_|_| |_\__, | / / / /
 =========|_|==============|___/=/_/_/_/

 :: Spring Boot ::                (v3.5.8)

2025-12-30T15:07:24.029Z  INFO 7 --- [           main] i.r.w.App                                : Starting App v25.11.13 using Java 21.0.9 with PID 7 (/app/BOOT-INF/classes started by apprunner in /app)
2025-12-30T15:07:24.042Z  INFO 7 --- [           main] i.r.w.App                                : No active profile set, falling back to 1 default profile: "default"
2025-12-30T15:07:25.162Z  INFO 7 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Bootstrapping Spring Data JPA repositories in DEFAULT mode.
2025-12-30T15:07:25.350Z  INFO 7 --- [           main] .s.d.r.c.RepositoryConfigurationDelegate : Finished Spring Data repository scanning in 175 ms. Found 22 JPA repository interfaces.
2025-12-30T15:07:26.572Z  INFO 7 --- [           main] o.s.b.w.e.t.TomcatWebServer              : Tomcat initialized with port 8086 (http)
2025-12-30T15:07:26.589Z  INFO 7 --- [           main] o.a.c.c.StandardService                  : Starting service [Tomcat]
2025-12-30T15:07:26.589Z  INFO 7 --- [           main] o.a.c.c.StandardEngine                   : Starting Servlet engine: [Apache Tomcat/10.1.49]
2025-12-30T15:07:26.634Z  INFO 7 --- [           main] o.a.c.c.C.[.[.[/]                        : Initializing Spring embedded WebApplicationContext
2025-12-30T15:07:26.637Z  INFO 7 --- [           main] w.s.c.ServletWebServerApplicationContext : Root WebApplicationContext: initialization completed in 2501 ms
2025-12-30T15:07:26.971Z  INFO 7 --- [           main] c.z.h.HikariDataSource                   : HikariPool-1 - Starting...
2025-12-30T15:07:27.215Z  INFO 7 --- [           main] c.z.h.p.HikariPool                       : HikariPool-1 - Added connection org.postgresql.jdbc.PgConnection@219db855
2025-12-30T15:07:27.217Z  INFO 7 --- [           main] c.z.h.HikariDataSource                   : HikariPool-1 - Start completed.
2025-12-30T15:07:27.249Z  INFO 7 --- [           main] o.f.c.FlywayExecutor                     : Database: jdbc:postgresql://rearm-postgresql:5432/postgres (PostgreSQL 17.6)
2025-12-30T15:07:27.308Z  INFO 7 --- [           main] o.f.c.i.c.DbValidate                     : Successfully validated 8 migrations (execution time 00:00.035s)
2025-12-30T15:07:27.358Z  INFO 7 --- [           main] o.f.c.i.c.DbMigrate                      : Current version of schema "public": 8
2025-12-30T15:07:27.362Z  INFO 7 --- [           main] o.f.c.i.c.DbMigrate                      : Schema "public" is up to date. No migration necessary.
2025-12-30T15:07:27.479Z  INFO 7 --- [           main] o.h.j.i.u.LogHelper                      : HHH000204: Processing PersistenceUnitInfo [name: default]
2025-12-30T15:07:27.550Z  INFO 7 --- [           main] o.h.Version                              : HHH000412: Hibernate ORM core version 6.6.36.Final
2025-12-30T15:07:27.592Z  INFO 7 --- [           main] o.h.c.i.RegionFactoryInitiator           : HHH000026: Second-level cache disabled
2025-12-30T15:07:27.793Z  INFO 7 --- [           main] o.h.o.c.pooling                          : HHH10001005: Database info:
	Database JDBC URL [Connecting through datasource 'HikariDataSource (HikariPool-1)']
	Database driver: undefined/unknown
	Database version: 17.6
	Autocommit mode: undefined/unknown
	Isolation level: undefined/unknown
	Minimum pool size: undefined/unknown
	Maximum pool size: undefined/unknown
2025-12-30T15:07:28.053Z  INFO 7 --- [           main] o.s.o.j.p.SpringPersistenceUnitInfo      : No LoadTimeWeaver setup: ignoring JPA class transformer
2025-12-30T15:07:29.560Z  INFO 7 --- [           main] o.h.e.t.j.p.i.JtaPlatformInitiator       : HHH000489: No JTA platform available (set 'hibernate.transaction.jta.platform' to enable JTA platform integration)
2025-12-30T15:07:29.608Z  INFO 7 --- [           main] j.LocalContainerEntityManagerFactoryBean : Initialized JPA EntityManagerFactory for persistence unit 'default'
2025-12-30T15:07:29.893Z  INFO 7 --- [           main] o.s.d.j.r.q.QueryEnhancerFactory         : Hibernate is in classpath; If applicable, HQL parser will be used.
2025-12-30T15:07:31.888Z  WARN 7 --- [           main] JpaBaseConfiguration$JpaWebConfiguration : spring.jpa.open-in-view is enabled by default. Therefore, database queries may be performed during view rendering. Explicitly configure spring.jpa.open-in-view to disable this warning
2025-12-30T15:07:32.504Z  INFO 7 --- [           main] c.n.g.d.s.ReloadableGraphQLSource        : Rebuilding GraphQLSource
2025-12-30T15:07:33.380Z  INFO 7 --- [           main] .d.s.a.DgsSpringGraphQLAutoConfiguration : ***Schema Report***
Unmapped fields: [Permissions.permissions, User.publicSshKeys, Query.adminOrganization, Query.allOrganizations, Component.apiKeyId, Component.apiKey, Component.approvalPolicyDetails, Branch.components, SourceCodeEntry.vcsUuid, SourceCodeEntry.commits, SourceCodeEntry.reboms, Artifact.branch, Artifact.buildId, Artifact.buildUri, Artifact.cicdMeta, Artifact.isInternal, Artifact.notes, Artifact.tagRecords, Artifact.dateFrom, Artifact.dateTo, Artifact.duration, Artifact.packageType, Artifact.publisher, Artifact.group, Artifact.dependencies, Artifact.reboms, Release.commitTime, Deliverable.name, Release.ticketDetails, Release.decoratedVersionString, Release.vcsRepository, Variant.orgDetails, Branch.versionType, Branch.hasChildren, Branch.pullRequests, OrgUserData.uuid, OrgUserData.name, OrgUserData.githubId, OrgUserData.permissions, ResourceGroup.protectedEnvironments, MarketingRelease.uuid, MarketingRelease.version, MarketingRelease.status, MarketingRelease.org, MarketingRelease.orgDetails, MarketingRelease.component, MarketingRelease.componentDetails, MarketingRelease.notes, MarketingRelease.tags, MarketingRelease.lifecycle, MarketingRelease.integrateType, MarketingRelease.integrateBranch, MarketingRelease.integrateBranchDetails, MarketingRelease.devReleasePointer, MarketingRelease.lastUpdatedBy, MarketingRelease.createdDate, MarketingRelease.devReleaseDetails, MarketingRelease.events, Query.approvalPoliciesOfOrg, Query.approvalEntriesOfOrg, Query.organization, Query.getAllOrganizations, SystemInfoIsSet.defaultOrgDetails, UserGroupWebDto.createdDate, UserGroupWebDto.lastUpdatedBy, Query._service, Mutation.verifyEmail, Mutation.inviteUser, Mutation.joinUserToOrganization, Mutation.cancelInvite, Mutation.createOrganization, Mutation.setEmailProperties, Mutation.setDefaultOrganization, Mutation.createApprovalEntry, Mutation.archiveApprovalEntry, Mutation.createApprovalPolicy, Mutation.archiveApprovalPolicy, Mutation.archiveOrganization, Mutation.createResourceGroup, Mutation.acceptPolicies, Mutation.logout, Mutation.updateEmailAddress, Mutation.resendEmailVerification]
Unmapped registrations: {}
Unmapped arguments: [io.reliza.ws.ReleaseDatafetcher.getChangelogBetweenReleases for arguments [uuid1, uuid2], io.reliza.ws.ComponentDataFetcher.getComponentChangeLog for arguments [componentUuidStr, branchUuidStr, orgUuidStr], io.reliza.ws.ReleaseDatafetcher.getReleaseTagKeys for arguments [orgUuidStr], io.reliza.ws.ComponentDataFetcher.getComponent for arguments [componentUuidStr], io.reliza.ws.ComponentDataFetcher.getComponentsOfType for arguments [orgUuidStr], io.reliza.ws.BranchDataFetcher.getBranch for arguments [branchUuidStr], io.reliza.ws.BranchDataFetcher.getBranchesOfComponent for arguments [compUuidStr], io.reliza.ws.ReleaseDatafetcher.getReleases for arguments [branchFilterStr, orgFilterStr, releaseFilterStr, pullRequest], io.reliza.ws.BranchDataFetcher.getNextVersion for arguments [branchUuidStr, versionTypeStr], io.reliza.ws.VcsRepositoryDataFetcher.getVcsRepository for arguments [vcsStr], io.reliza.ws.VcsRepositoryDataFetcher.listVcsReposOfOrganization for arguments [orgUuidStr], io.reliza.ws.SourceCodeEntryDataFetcher.getSourceCodeEntry for arguments [sceUuidStr], io.reliza.ws.ArtifactDataFetcher.getArtifact for arguments [artifactUuidStr], io.reliza.ws.ArtifactDataFetcher.getArtifactVersionHistory for arguments [artifactUuidStr], io.reliza.ws.ReleaseDatafetcher.getRelease for arguments [releaseUuidStr, orgUuidStr], io.reliza.ws.OrganizationDataFetcher.getUsers for arguments [orgUuidStr], io.reliza.ws.OrganizationDataFetcher.getApplications for arguments [orgUuidStr], io.reliza.ws.OrganizationDataFetcher.getTotalsAnalytics for arguments [orgUuidStr], io.reliza.ws.OrganizationDataFetcher.getApiKeys for arguments [orgUuidStr], io.reliza.ws.oss.MarketingReleaseDatafetcher.getMarketingRelease for arguments [marketingReleaseUuidStr], io.reliza.ws.oss.MarketingReleaseDatafetcher.listMarketingReleasesOfComponent for arguments [componentUuidStr], io.reliza.ws.ReleaseDatafetcher.getArtifactReleases for arguments [artifactUuidStr], io.reliza.ws.ArtifactDataFetcher.getArtifactBomLatestVersion for arguments [artifactUuidStr], io.reliza.ws.DeliverableDataFetcher.getDeliverable for arguments [deliverableUuidStr], io.reliza.ws.DeliverableDataFetcher.listDeliverablesByComponent for arguments [componentUuidStr], io.reliza.ws.IntegrationDataFetcher.getConfiguredBaseIntegrations for arguments [orgUuid], io.reliza.ws.oss.OssIntegrationDataFetcher.getConfiguredBaseIntegrations for arguments [orgUuid], io.reliza.ws.ReleaseDatafetcher.getReleaseByHash for arguments [componentIdStr], io.reliza.ws.UserDataFetcher.acceptUserPolicies for arguments [acceptPolicies, acceptMarketing], io.reliza.ws.oss.OssOrganizationDataFetcher.updateUserPermissions for arguments [orgUuidStr, userUuidStr], io.reliza.ws.IntegrationDataFetcher.deleteIntegration for arguments [integrationType], io.reliza.ws.IntegrationDataFetcher.refetchDependencyTrackMetrics for arguments [art], io.reliza.ws.IntegrationDataFetcher.requestRefreshDependencyTrackMetrics for arguments [art], io.reliza.ws.BranchDataFetcher.createBranch for arguments [compUuidStr], io.reliza.ws.BranchDataFetcher.setNextVersion for arguments [versionTypeStr], io.reliza.ws.ReleaseDatafetcher.updateComponentReleasesIdentifiers for arguments [compUuid], io.reliza.ws.VcsRepositoryDataFetcher.updateBranch for arguments [vcsUuidStr], io.reliza.ws.BranchDataFetcher.getNewBranchVersion for arguments [branchUuidStr, bumpAction], io.reliza.ws.OrganizationDataFetcher.setOrgApiKey for arguments [orgUuidStr, keyType], io.reliza.ws.ReleaseDatafetcher.updateReleaseLifecycle for arguments [releaseId], io.reliza.ws.oss.MarketingReleaseDatafetcher.advanceLifecycle for arguments [newLifecycleStr], io.reliza.ws.oss.OssReleaseDatafetcher.approveReleaseManual for arguments [releaseUuidStr], io.reliza.ws.ReleaseDatafetcher.addArtifactManual for arguments [inputArtifactUuid], io.reliza.ws.ReleaseDatafetcher.releaseSbomExport for arguments [releaseUuidStr], io.reliza.ws.OrganizationDataFetcher.setOrgApiKey for arguments [apiKeyUuidStr], io.reliza.ws.ReleaseDatafetcher.releasecompletionfinalizerProgrammatic for arguments [releaseId], io.reliza.ws.ReleaseDatafetcher.triggerReleasecompletionfinalizer for arguments [releaseId]]
Skipped types: [MarketingRelease, MarketingReleaseLifecycle, ApprovalRole]

2025-12-30T15:07:33.441Z  INFO 7 --- [           main] s.b.a.g.s.GraphQlWebMvcAutoConfiguration : GraphQL endpoint HTTP POST /graphql
2025-12-30T15:07:33.920Z  INFO 7 --- [           main] o.s.b.w.e.t.TomcatWebServer              : Tomcat started on port 8086 (http) with context path '/'
2025-12-30T15:07:33.934Z  INFO 7 --- [           main] o.s.s.c.TaskSchedulerRouter              : More than one ScheduledExecutorService bean exists within the context, and none is named 'taskScheduler'. Mark one of them as primary or name it 'taskScheduler' (possibly as an alias); or implement the SchedulingConfigurer interface and call ScheduledTaskRegistrar#setScheduler explicitly within the configureTasks() callback: [scheduledExecutorService, dgsScheduledExecutorService]
2025-12-30T15:07:33.940Z  INFO 7 --- [           main] i.r.w.App                                : Started App in 11.228 seconds (process running for 12.488)
2025-12-30T15:08:04.574Z  INFO 7 --- [nio-8086-exec-1] o.a.c.c.C.[.[.[/]                        : Initializing Spring DispatcherServlet 'dispatcherServlet'
2025-12-30T15:08:04.574Z  INFO 7 --- [nio-8086-exec-1] o.s.w.s.DispatcherServlet                : Initializing Servlet 'dispatcherServlet'
2025-12-30T15:08:04.576Z  INFO 7 --- [nio-8086-exec-1] o.s.w.s.DispatcherServlet                : Completed initialization in 2 ms
2025-12-30T15:08:04.835Z  INFO 7 --- [nio-8086-exec-1] i.r.w.AdminWs                            : FETCHCSRF called
2025-12-30T15:14:48.680Z  INFO 7 --- [io-8086-exec-10] i.r.w.AdminWs                            : FETCHCSRF called
2025-12-30T15:15:43.089Z  INFO 7 --- [nio-8086-exec-3] i.r.w.AdminWs                            : FETCHCSRF called
2025-12-30T15:36:30.218Z  INFO 7 --- [nio-8086-exec-8] i.r.w.AdminWs                            : FETCHCSRF called
2025-12-30T15:36:30.957Z  INFO 7 --- [nio-8086-exec-4] i.r.s.VersionAssignmentService           : versionType: DEV
2025-12-30T15:41:06.870Z  INFO 7 --- [nio-8086-exec-8] i.r.w.AdminWs                            : FETCHCSRF called
2025-12-30T16:47:16.700Z  INFO 7 --- [nio-8086-exec-1] i.r.w.AdminWs                            : FETCHCSRF called

The backend has been deployed with the values, connecting to the Postgres database that is deployed in the Helm Chart.

I am also attaching the error that appears in the modal:

Failed!: An error occurred! For more details, see the full error text at https://go.apollo.dev/c/err#%7B%22version%22%3A%224.0.9%22%2C%22message%22%3A4%2C%22args%22%3A%5B%22query%22%2C%22query%22%2C%22mutation%22%5D%7D

Thank you for your prompt reply!

[taleodor]

Ok, thanks for confirming, I'll be doing test fresh deployment for unrelated issue later this week or early next week - will try to reproduce then and get back to you afterwards.

Also note, that we're preparing major release around same time frame (hopefully, next week), so maybe it'd better if you wait for that for a greenfield install anyways.

[KoldoCanellas]

Perfect, I'll keep an eye out then. I'll be running some tests over the next few days and I'll let you know if anything comes up.

Thank you very much for your prompt reply. Have a great start to the year!

[KoldoCanellas]

Hello, happy new year!

I've been trying for several days to upload an SBOM file in cyclonedx1.6+json format. I want to do this via curl and pass the file to it. All requests I make to /api or /tea return a 401 error. I've tried generating tokens with my user and as ‘Approval and Artifact Upload’ and both return a 401 error.

Is this because the system is still sealed? Am I making the request incorrectly? Or does the token need more permissions?

[taleodor]

Hi, few things here:

1. Yes, while the system is sealed nothing will work essentially. I'll try to get back to you on this before the end of this week.
2. ReARM CLI is the recommended way to interact with ReARM - https://github.com/relizaio/rearm-cli - you can use curl, but it's a bit complex since we're using GraphQL API - https://github.com/relizaio/rearm/blob/main/backend/src/main/resources/schema/schema.graphqls . Note that endpoint for that is /graphql, not /api
3. Also to start, I would recommend these 2 tutorials: https://docs.rearmhq.com/tutorials/first-bom.html and https://docs.rearmhq.com/tutorials/github-actions-docker.html
4. TEA 1.0 won't have publisher specification, so you cannot use TEA to upload things. Also, you need a flag on helm chart to enable TEA - https://docs.rearmhq.com/tea/#enable-tea-on-rearm - and note that currently this will be non-authenticated if enabled (anyone can access).

[taleodor]

Hi @KoldoCanellas ,

We've just published release 26.01.15 - please upgrade to that version (or use a fresh install which may be cleaner) and let me know if you still see issues with unsealing.

Just in case here if you choose to use fresh install, here are instructions to fully clean up the existing installation (note, this will DELETE ALL ReARM DATA):

helm uninstall rearm -n rearm
kubectl delete pvc --all -n rearm
kubectl delete ns rearm

After that you can do redo the installation.

[KoldoCanellas]

Hi @taleodor It worked for me! I updated to the latest version and it allowed me to unseal the system, and with the cli I was able to make requests without getting a 401 response.

When I deployed it, I saw that there was a typo here: https://github.com/relizaio/rearm/blob/main/deploy/helm/rearm-helm/values.yaml#L24. I modified it with registry.relizahub.com/library/rearm-oci-artifact-service:25.12.2 and everything went well.

Thank you very much for your quick response.

[taleodor]

Thank you, will fix; also note we discovered an issue with a newly introduced logic to cleanup Dependency-Track projects if you're using this integration. It's not critical, but you may have to recreate things manually if the bug occurs. Hopefully, we'll have a minor release with the patch some time next week.

[KoldoCanellas]

Ok. I'll keep that in mind. Thank you for letting me know.