Managing Dependencies and Runtime Security ActiveState Deminar - PowerPoint PPT Presentation

Managing Dependencies and Runtime Security ActiveState Deminar

Managing Dependencies and Runtime Security About ActiveState Track-record: 97% of Fortune 1000, 20+ years open source ● Polyglot: 5 languages - Python, Perl, Tcl, Go, Ruby ● Runtime Focus: concept to development to production ●

Managing Dependencies and Runtime Security Welcome Pete Garcin, Developer Advocate, ActiveState (@rawktron)

Managing Dependencies and Runtime Security Overview Managing Project Dependencies ● Pip/requirements ○ ActivePython ○ Virtual Environments ● PipEnv ○ Runtime Security ● Q&A ●

Managing Dependencies and Runtime Security Configuring Dev Environment git clone https://github.com/ActiveState/activedeminar

Managing Dependencies and Runtime Security Your dependency tree:

Managing Dependencies and Runtime Security Managing Deps Vendored Deps ● Advantages: guaranteed security, compatibility, stability, ○ availability Disadvantages: larger repo, you have to manually ○ maintain - could be out of date, conflicts with system installs

Managing Dependencies and Runtime Security Managing Deps Requirements.txt/Pipfile ● Have to ‘install’ and build from a repo BUT you don’t ○ have to maintain the code and ship it yourself You need to pin versions to prevent bleeding edge ○ Use a virtualenv for isolation ○

Managing Dependencies and Runtime Security Managing Deps Pre-built distributions ● No discipline approach ○ Most popular packages already pre-built, tested, and ○ included in your distro, quarterly updates As the standard install across a large org or team can ○ work well Not updated frequently ○ Not customized to your needs ○ Overall may not fit your use case ○

Managing Dependencies and Runtime Security Vendoring Deps in Python Requires a virtualenv to prevent conflicts ● May involve generating your own wheels for local pip servers ● Not widely used ● Higher maintenance overhead ● Can be good/necessary if you have custom patches ●

Managing Dependencies and Runtime Security Creating requirements.txt Can use “pip freeze” but this gives us everything in our ● system environment. Let’s use pipreqs: ● ○ https://github.com/bndr/pipreqs ○ pip3 install pipreqs ○ pipreqs .

Managing Dependencies and Runtime Security Pinning Versions Pinning means forcing a specific version to be installed ● Why? Reproducible builds. ● Syntax: ● Framework==0.9.4 ○ Library>=0.2 ○

Managing Dependencies and Runtime Security Reproducible Builds Guarantee the exact same build in two locations ● Ensure you have the same versions of every package ● Requires a lockfile, or a “pip freeze” ●

Managing Dependencies and Runtime Security Virtual Environments A Virtual Environment is a self-contained, sandboxed ● environment -- just for your app. It only has the packages you specify and they are totally ● distinct from the system installed ones.

Managing Dependencies and Runtime Security Virtual Environments Complex but critical for app deployment, development. ● Can use ‘virtualenv’ to create and manage them but there ● is a new tool combining pip and virtualenv.

Managing Dependencies and Runtime Security PipEnv Enter PipEnv: New “Community Standard” application ● combines Pip/virtualenv and extends their functionality in a single app. Let’s install it here: ● https://github.com/pypa/pipenv ○ pip3 install pipenv You can initialize a clean environment, Python 3: ● pipenv -three

Managing Dependencies and Runtime Security Generating Pipfile We can generate a pipfile from our HANDY TIP ● requirements.txt using the following We can generate a virtualenv of command: ActivePython using: pipenv pipenv install --python="/home/para llels/AP36/bin/pytho n3" --site-packages install

Managing Dependencies and Runtime Security Generating Pipfile [[source]] url = "https://pypi.python.org/simple" verify_ssl = true name = "pypi" [packages] numpy = "==1.14.3" tensorflow = "==1.8.0" Flask = "==1.0.1" [dev-packages] [requires] python_version = "3.6"

Managing Dependencies and Runtime Security Generating Pipfile.lock Generate a lockfile that contains the fully resolved dep ● tree for our project: pipenv lock Required for a deterministic build. ● Warning : could fail to resolve a dependency conflict! ●

Managing Dependencies and Runtime Security Install all Dependencies Let’s spawn a shell inside our virtualenv: ● pipenv shell The “sync” command will install everything in the .lock ● file: pipenv sync

Managing Dependencies and Runtime Security Project Complete We now have a project that has: ● A virtualenv created for it distinct from our system install ○ A pipfile that defines all the deps for our project generated ○ from our requirements.txt A lockfile that is a fully resolved version of all deps for this ○ project. All deps installed for our project in that virtualenv ○ Our project ready to go! ○

Managing Dependencies and Runtime Security Running Project Remember to spawn a shell inside our virtualenv: ● pipenv shell We can deploy our flask server using this command: ● python3 app.py

Managing Dependencies and Runtime Security Verify it works Let’s check that our service is running: ● curl http://localhost:8000?file=./mypoodle.jpg

Success!

Managing Dependencies and Runtime Security Packaging and Distribution Further topics: ● Generating a setup.py ○ Generating a docker image ○

Managing Dependencies and Runtime Security Installing ActivePython Easy option: Install ActivePython ● (includes everything we need) https://www.activestate.com/act ● ivepython/downloads

Managing Dependencies and Runtime Security Future Platform Support What if we could reduce ALL of what we just did to a single command?

Managing Dependencies and Runtime Security Future Platform Support Working to streamline and simplify this process. ● Tight integration and compatibility with community tools is ● key. Share your pain points working with dependency ● management and environment configuration: peteg@activestate.com ○

Managing Dependencies and Runtime Security Future Platform Support Dependency Resolution. ● Reproducible Builds. ● Customized Builds/Environments. ● “One click” Environment Configuration. ● ● https://start.activestate.com/platform-home/

Managing Dependencies and Runtime Security Platform: Runtime Security Available now: https://www.activestate.com/platform ●

Managing Dependencies and Runtime Security Platform: Runtime Security

Managing Dependencies and Runtime Security Platform: Runtime Security Questions to consider: ● What do we do when there are security vulnerabilities ○ in one of your dependencies? How many times have you had an application ○ deployed that sits live on the production server but might not be updated frequently? It was secure when you built it, but is it still secure? ○

Managing Dependencies and Runtime Security Platform: Runtime Security As one component of the evolving ActiveState Platform, ● our security and compliance plugin for Python can give you zero discipline runtime security checks on your applications. Let’s take a look at how we configure that and what kind ● of results it can give us.

Managing Dependencies and Runtime Security Platform: Signing In Step 1 : The first thing we need to do is sign into for the ● ActiveState Platform. Get there by going to platform.activestate.com. We’ve pre-created some credentials to use. They’re ○ shared in the README: User : asguest ■ Pass : asdeminar ■

Managing Dependencies and Runtime Security Platform: Dashboard Tour Let’s take a walk through the dashboard... ●

Managing Dependencies and Runtime Security Platform: Installing Plugin The first thing we need to do is install the interpreter plugin. ● This language extension hooks directly into your python interpreter. There’s no extra code in your program -- it will just hook in and work invisibly.

Managing Dependencies and Runtime Security Platform: Installing Plugin Once we’ve downloaded, we need to install it: ● pipenv install ActiveState-SecurityScanner-0.5.5.tar.gz ...or... ● pipenv shell pip3 install ActiveState-SecurityScanner-0.5.5.tar.gz

Managing Dependencies and Runtime Security Platform: Creating an Identity Next, we’ll need to create an identity for our project. We use ● an identity to encapsulate any connected set of similar functionality, a project, a series of related services, something like that. So let’s create one.

Managing Dependencies and Runtime Security Platform: Configuring Plugin We need a configuration file ● # activestate.config file to point the plugin to our generated by asguest identity. Create a file ● Identity = 96339c86-20a9-44aa-8363-6e5d activestate.config in the f85003bf # Deminar working folder of our URL = application. https://platform.activestate .com/ Debug = False