ActiveState Platform vs CRACI

ActiveState Platform hosts custom runtimes assembled from source. Projects specify runtime components, preserve project history and provide deployment instructions; their artifacts may include packages, dependencies, patches and bundles, but not contributors’ first-party code. Create projects in the web interface or with the State Tool CLI, then deploy and activate them locally. Projects can remain personal, be shared with an organization or be public. The platform supports Windows, macOS and Linux deployments, and its GraphQL API can build open-source software for different operating systems and languages without requiring users to manage build infrastructure. It provides immutable SBOMs in SPDX formats and describes build safeguards including reproducible builds, checksum checks and isolated containers. A free organization plan costs nothing and is limited to public projects. Curated Catalog annual pricing is $25,000 for fewer than 100 employees, $50,000 for 100–999 employees and $150,000 for 1,000 or more; those prices do not apply to legacy Platform subscriptions.

CRACI is a web service providing managed continuous-integration runners that capture software dependencies during builds and monitor them for vulnerabilities. It creates build-time SBOMs containing transitive dependencies and declared licenses, with CycloneDX and SPDX export formats. Monitored SBOMs are reevaluated as vulnerabilities emerge, and the service supports triage, fix routing, and VEX. GitHub Actions is the supported CI integration today; other CI systems are roadmap items. CRACI records packages from npm, PyPI, RubyGems, Cargo, Go, Nix, OCI registries, Debian, Ubuntu, Alpine, and Git or other source downloads. Jobs use a prevalidated egress policy that fails closed, and policy gates can stop builds during execution. Managed runners are Linux on x86-64 and ARM64; Windows, macOS, and on-premises runners are planned. CRACI says source code is processed during builds but not stored, while build data is hosted in Europe. Its API returns SBOMs, network traces, and provenance, though the pricing FAQ says reports cannot be exported. Pro has no monthly fee and meters usage at $0.002 /vCPU-minute.