2,700+
Enterprise Clients
The ActiveState Alternative That Keeps Patching After Upstream Stops
Most of the packages your developers need are already vetted and waiting in SecureChain. When a version you run stops getting upstream fixes, TuxCare writes the patch and ships it on a published SLA. ActiveState’s clock doesn’t start until upstream ships a fix.
Talk to Us
See which of your packages we cover
How the Two Catalogs Compare
| Feature |
SecureChain
|
ActiveState |
|---|---|---|
| Catalog model | ✓One shared catalog of pre-vetted packages, rebuilt from source | ✓A private catalog for each customer, drawn from ActiveState's library and rebuilt from source |
| SLSA provenance | ✓Level 3 | ✓Level 3 |
| SBOM and VEX | ✓Included | ✓Included |
| CVE remediation SLA | ✓Published for every severity, and the clock runs whether or not upstream has a fix | ⚠Advertised at 5, 10, and 30 business days, starting once an upstream fix exists |
| Who writes the fix? | ✓Upstream, fixes plus our own patches, on the version you run | ✗Upstream-dependent |
| End of life (EOL) patching | ✓Continues under Endless Lifecycle Support, on the exact versions you run | ⚠Coverage ends at end of life; a custom agreement is required after that |
| EOL remediation SLA | ✓Yes, measured from CVE disclosure | ✗None published |
| Versions dropped without notice | ✓Patched on a published SLA, no EOL announcement needed | ✗None published |
| Malware defense | ✓Source code inspected at intake for hidden malicious behavior and suspicious patterns, not just known signatures | ⚠No published method; no word on whether source code is inspected |
| On-demand packages | ✓Most packages are already in the catalog; anything missing is added at no extra cost | ⚠Catalog contents are chosen per customer, and every missing component is a wait |
Patches Shouldn't Stop Because Upstream Did
Older releases rarely get a farewell notice. Upstream just moves on. SecureChain keeps patching the version you run, on a published SLA, so an aging dependency doesn't turn into a surprise migration project.
Get a Quote
Three Differences You Feel in Production
Pull vetted packages from day one
SecureChain ships with thousands of packages per ecosystem already vetted, so the common dependencies are there before anyone files a request. ActiveState catalogs are assembled per customer.
Keep getting patches after upstream stops
Plenty of open source libraries never announce an end of life. They just stop shipping fixes. SecureChain notices and keeps patching. ActiveState covers them under a separate agreement, if you ask.
Catch what nobody has flagged yet
A clean CVE record doesn't make a package safe. SecureChain scans the source of every package at intake for hidden malware. ActiveState doesn't document how its malware checks work.
We’ve Been Powering Enterprise-Grade Patching At
Unprecedented Scale – and We're Just Getting Started
14,000+
Vulnerabilities Fixed
420,000+
Patches Delivered
70,000+Packages Curated
Switch Without Rebuilding Your Pipeline
-
Move from your ActiveState catalog to TuxCare builds of the versions you already run, with a one-time setup per repository.
-
Keep your package managers and install commands. Every package comes with SLSA Level 3 provenance, an SBOM, and VEX.
Get Your Packages Today and Your Patches on Time
Send over the packages and versions your team depends on. We'll show you what's already in the catalog and where TuxCare takes over when upstream stops.
Get a Quote
Frequently Asked Questions
ActiveState has built open source language runtimes since the late 1990s and is best known for Python, Perl, and Tcl. Its Curated Catalog is a private repository of components drawn from its library, built from source in SLSA Level 3 infrastructure, with signed SBOMs and provenance. Its advertised remediation SLAs start once an upstream fix exists.
SecureChain starts you with a shared catalog of pre-vetted packages, so most of what you need is there on day one. When a CVE lands in a version you run and upstream has no fix, TuxCare writes one and ships it on a published SLA. And every package's source is inspected for malicious behavior before it enters the catalog.
Usually not. Most packages are already in the SecureChain catalog. Anything missing is added at no extra cost and supported like everything else.
SecureChain keeps patching it on a published SLA, first under SecureChain and then under Endless Lifecycle Support, for as long as you run that version. That includes libraries that drop older releases without saying so.
Yes. When upstream has a fix, SecureChain uses it. When upstream falls short, TuxCare engineers write and backport the fix to the exact version you run.
SecureChain inspects the source of every package at intake for suspicious code patterns, supply chain risks such as install-time hooks and obfuscated payloads, and known malware. ActiveState’s documented checks match components against known CVEs and known malicious packages.
Every SecureChain package ships with SLSA Level 3 provenance, an SBOM, and VEX data, the same evidence set auditors ask for.
Yes. Point your repository manager or package manager at SecureChain instead of your ActiveState catalog, then re-verify your provenance attestations. Your builds and workflows stay the same.
Yes. SecureChain works with JFrog Artifactory, Sonatype Nexus, and GitHub Packages, or your package manager can point at it directly.
TuxCare has spent 15 years patching open source software, much of it long after upstream support ended. SecureChain brings that engineering earlier in the supply chain. Its malware analysis draws on Imunify, our sister organization, which runs one of the largest server-side malware detection platforms in hosting.