The ActiveState Managed Distribution

The ActiveState Managed Distribution is a complete runtime environment (with installers) for all the OS platforms you need to deploy on. It is fully managed and maintained by ActiveState on behalf of the customer, ensuring the open-source components used are free of bugs and vulnerabilities. ActiveState’s expertise in legacy and emerging language tech stacks will help save valuable engineering time, that can then be spent on other value-producing tasks.

Managed Distributions use “dependency vendoring”, a strategy that checks third-party software source code directly into your product’s codebase before adopting dependencies into your source control system (rather than relying on a package manager to install dependencies on demand).

After identifying a vulnerability, your Managed Distribution

• Notifies you of the vulnerability.
• Locates a newer version of the dependency that resolves the vulnerability.
• Builds the new configuration from source code, and ensures it works with your existing runtime and environment.
• Packages your revised runtime, and then updates all existing configurations.

What are the uses for a Managed Distribution?

• An “All-In-One” Runtime Environment
• A Multi-Project Updater
• Vetting your dependencies from the ActiveState catalog of third-party dependencies to ensure security, maintainability, and appropriate licensing according to your corporate guidelines.
• Securely build your set of required dependencies from source code, including native libraries using our tamper-proof secure build service.
• Offload the task of managing open source dependencies at scale across multiple operating systems and disparate teams to ActiveState.
• Package your set of dependencies for all target operating systems, ensuring reproducible environments that contain only dependencies that work together.
• Optionally make your built dependencies available via our artifact repository for easier management and distribution.
• Maintain a catalog of dependencies and transitive/operating system dependencies over time so you can always reproduce the build.
• Monitor dependencies for vulnerabilities, datedness, and create a fork with the updated dependencies for you to take at any time. Users with a Managed Distribution can use the “Fork It” feature to create a copy and customize it by removing packages. When ActiveState updates the distribution, all forked projects will be prompted to update.

To find out more about Managed Distributions see the following

• Creating a Managed Distribution
• Updating your Managed Distribution
• Dependency Vendoring Without The Work – ActiveState Managed Distributions

Creating a Managed Distribution

The process for creating a Managed Distribution from a new project is outlined below.

1. Create a project
2. Add the packages to your project
3. Configure your packages
4. Expect a build error
5. Contact us
6. Next steps

A note about Python package naming conventions

This process can save time and avoid miscommunications that can arise in email exchanges and will allow us to see and assess which packages your project needs.

1. Create a project

After signing in to your ActiveState account go to your organization’s page and click the +Project button. Follow the steps here to create a new project.

2. Add your packages

Under the Configuration tab for your new project, use the interface to select your packages.

To add package(s) that are not currently on the Platform use the Import From File feature on your project’s Configuration tab. This will bring up the prompt shown below. Copy your requirements into the field provided and click Import to finish.

Managed Distributions allow you to request packages and versions which are not yet available on the Platform (these requests may result in an expected error message). If you are requesting packages or versions that are not currently available on the Platform you will receive an “Unable to Resolve Dependencies” message. This message can be ignored as this will be resolved during the build of your Managed Distribution.

3. Configure your Packages

The Platform allows you to choose a specific version– or range of versions– for your packages. The Auto option is selected by default, which allows the Platform to automatically select compatible package versions and dependencies.

• Packages dependent on your requirements will automatically be added to the build and highlighted in green.
• Packages dependent on your requirements that are already present are highlighted in blue.
• Packages that must be removed for compatibility or have been manually removed will be highlighted in red.

When you are satisfied with your selections click Save Changes Anyway.

4. Expected Build Error

If you have selected packages or versions that are not currently available on the Platform or require dependencies that are not currently available to build, your project’s dependencies will fail to resolve. This is to be expected and will be reviewed by our engineering team.

5. Contact Us

After saving the list of packages on the Configuration tab, let us know that you would like us to apply these changes to your Managed Distribution. Send an email to enterprise-support@activestate.com and include the link to the project in your message (copied from your web browser). We will work to resolve all dependencies and notify you when your Managed Distribution build is complete.

6. Next Steps

Our build engineering team will review your build and requirements, identifying any packages or issues that need specific attention. These will be summarized if needed and suggestions will be made to resolve them. In most cases, a short meeting will be scheduled to discuss these recommendations.

Note For Python: Package Naming

The first step to requesting a new package in an ActiveState Managed Distribution is to find the correct distribution name of the package. Some special considerations must be made for Python packages. The distribution name is the name of the package as it is listed in the package index. The central package index for Python is PyPi, and all Python packages on the ActiveState Platform mirror the distribution names on PyPi.

The name of a Python package listed on a package index (distribution name) is not necessarily the name you use to import the package. The distribution name is not the same as the import name. For example, you can use the pip package manager (which pulls packages from the PyPi index) to install the package with the distribution name “mysql-python”:

pip install mysql-python

When you try to import this package into your Python project you will get an error.

import mysql-python -> package not found error
import mySqlDb -> correct import

This can create confusion because some import names will actually be distribution names for other packages. Looking at your import statements alone it is impossible to determine which packages you actually need to provide ActiveState. If you used ActiveState runtimes during your development process this is not an issue as the correct distribution names will be listed in your project.

If you used pip or conda for development, generate a requirements.txt file and use that to identify the distribution names of the package you provide to ActiveState.

Updating your Managed Distribution

Updating your ActiveState Managed Distribution to include new packages or versions can be done by creating and submitting a change request. The easiest and fastest way to capture your change request is to:

1. Create a fork of your Managed Distribution
2. Make changes to the fork using the ActiveState Platform
3. Notify ActiveState when you are satisfied with your changes

This can save time and avoid miscommunications that can arise in email exchanges, and will allow us to see exactly which changes you have made by examining the project history. Before making changes to a Python project please see our Note about Python package naming.

Create a fork of your Managed Distribution

Create a fork of your Managed Distribution by going to your current distribution and clicking the Fork It button. Place the fork in the same organization as the current Managed Distribution and add the postfix “-Update-mm/dd/yy” to the default name to identify the change request. This fork will now be user changeable.

Make changes to the fork using the ActiveState Platform

When you are satisfied with your changes, leave a message for our team in the field under “Save your changes?” and click Save Changes Anyway. If you need more than 100 characters, make your changes in batches (in separate commits) and write a message for each commit.

All changes will be available for each commit in the distribution’s History tab. Using this, we can verify that the correct changes are made to the managed distribution.

If you have made a change that you are not happy with, simply update the fork with the correct information and save a new commit. We will make the final changes based on the state of your project at the latest commit.

Notify ActiveState when you are satisfied with your changes

When you are satisfied with the list of packages on the Configuration tab, let us know that you would like us to apply these changes to your build.

Send an email to enterprisesupport@activestate.com and include the link to your forked distribution in your message (copied from your web browser).

Note about Python package naming

An important part of requesting a new package in an ActiveState Managed Distribution is to find the correct distribution name of the package, this is particularly important for Python packages.

The distribution name is the name of the package as it is listed in the package index. The central package index for Python is PyPi, and all Python packages on the ActiveState platform mirror the distribution names on PyPi.

The name of a Python package listed on a package index (distribution name) is not necessarily the name you use to import the package. The distribution name is not the same as the import name. . For example, you can use the pip package manager (which pulls packages from the PyPi index) to install the package with the distribution name “mysql-python”:

pip install mysql-python

When you try to import this package into your Python project you will get an error.

import mysql-python -> package not found error
import mySqlDb -> correct import

This can create confusion because some import names will actually be distribution names for other packages. Looking at your import statements alone, it is impossible to determine which packages you actually need to provide ActiveState. If you used ActiveState runtimes during your development process this is not an issue as the correct distribution names will be listed in your project.

If you used pip or Conda for development, generate a requirements.txt file and use that to identify the distribution names of the packages provided to ActiveState.