Raqib v0.15.0
A score command that turns a scan into an answer to the next question, what do I fix first, and a real bug fix it surfaced along the way.
score
raqib.sh score runs a scan and then rates it:
- A grade from A to F and a number out of 100, from a weighted count of the findings by severity.
- The principals that carry the most risk, ranked, worst severity and most findings first, each with the change that closes it, so there is a clear order to work in rather than a flat list.
- A rollup by tactic.
It reads the same findings the scan prints, so raqib.sh score, raqib.sh score --offline export.json, and python -m raqib score export.json all work, with --json for the machine readable form. In both the bash scanner and the Python engine.
A bug the score surfaced
Building the score compared the two engines by severity, not just by count, and caught a real divergence: the bash GCP model tested a public member against the ambient input instead of the principal, so allUsers and allAuthenticatedUsers were read as broad data access rather than the critical "a role is granted to everyone" finding they are. The Python engine was already correct. Fixed, and the two now agree.
A stronger guarantee
The parity test now compares the two engines finding for finding, on severity, tactic, and principal, not only on the total, so a divergence like that one cannot pass again.
Quality
- 145 tests pass, the bash scanner and the Python engine in lockstep on every cloud.
Independent tool, not affiliated with or endorsed by any cloud provider. Read only: it lists and describes authorization configuration and never changes anything.