fix(scan): close two fail-open paths in trustabl-scan.sh (#9)

[Paramjeet-singh-neu]

Closes #9.

Both spots in scan/trustabl-scan.sh fail open, so a broken run can be reported as a clean repo. @fxmedus flagged these and asked for a direction decision rather than a surprise PR — so this implements the fail-closed direction they leaned toward, and I've laid out the alternative for each below in case you prefer it.

1. Missing overall_score no longer scores 100

jq -r '.overall_score // 1' supplies the maximum value when the field is absent, so a truncated / malformed / schema-drifted report read as readiness 100, risk 0.

This PR: treat a missing, null, empty, or unparseable score as a scanner error and exit 2 — matching the exit-code contract in docs/EVALUATION.md (2 = scan did not complete, output not trustworthy).

RAW_SCORE=$(jq -r '.overall_score' "$JSON_FILE" 2>/dev/null)
if [ -z "$RAW_SCORE" ] || [ "$RAW_SCORE" = "null" ]; then
  echo "ERROR: no usable overall_score ..."; exit 2
fi

Alternative (smaller blast radius): change // 1 to // 0 — a missing score becomes readiness 0 / risk 100. Fails closed but red-lights via the normal gate instead of exit 2. Happy to switch to this if you prefer.

2. Checksum verification no longer degrades to a warning

An unfetchable checksums.txt, or an asset not listed in it, previously printed WARNING … skipping verification and ran the unauthenticated binary anyway.

This PR: fail closed (exit 1) unless the operator explicitly opts out with ALLOW_UNVERIFIED_DOWNLOAD=true (for a release that genuinely ships no checksums). A real checksum mismatch already exited 1 and is unchanged.

Alternative: always hard-fail with no escape hatch. I added the opt-out to avoid breaking a release that legitimately has no checksums.txt, but I can drop it if you'd rather it be unconditional.

Testing

• bash -n scan/trustabl-scan.sh passes.
• Verified the score extraction against missing-key, invalid-JSON, and valid-score inputs (exit 2 / exit 2 / proceeds).

If the new ALLOW_UNVERIFIED_DOWNLOAD input lands, I'll follow up with a one-line addition to the README inputs table.

🤖 Generated with Claude Code