Navin Trusted Hub
The Navin Trusted Hub page (/admin/hub) shows the signed packages of the Hub, their scans and the installed
versions. It needs system:read; the settings and the synchronization need settings:manage.
What the screen shows
| Element | Content |
|---|---|
| Synchronization | Last sync or Never synced |
| Packages | each package with its versions, Installed versions and Scans (passed or failed per tool) |
Actions
| Button | Effect | Permission |
|---|---|---|
| Settings, Access token, Save | address, customer id, pinned keys, enforcement and token of the Hub; an empty token keeps the stored one | settings:manage |
| Sync now | downloads and verifies the signed metadata of the Hub | settings:manage |
| Import offline copy | imports a JSON metadata document of the Hub copied by hand | settings:manage |
Typical tasks
- Work offline. Export the metadata on a connected host, then Import offline copy here.
Explicit registry identity (TRT-12 migration)
hub.expected_hub defaults to empty. There is no automatic backfill: all online/offline ingestion fails closed
until an administrator pins the exact signed.hub registry identity, even when enforcement is off. This is not
the API URL: registry.example.org is illustrative, not a deployment default. Confirm the identity through your
trusted Hub administrator and verify the signing key independently; never derive it from a URL or untrusted payload.
Before upgrading, record the current identity and anti-rollback high-water mark. After upgrading, set the confirmed identity in Hub settings (the UI requires it), then reimport/resync signed metadata of the same or a higher version. A policy change atomically invalidates the authorization cache without deleting its version/content high-water mark. Setting the pin back does not revive cached authorization: signature verification is required again.
If stored nm.hub_state.hub differs, a nonempty pin change and ingestion are refused, even for a newer document.
Authority transfer is not implemented: stop and obtain an explicit administrator-approved migration policy outside
this flow. Do not delete/reset state or silently change authority to bypass this refusal. An empty API pin disables
ingestion and invalidates the cache, but preserves the high-water mark. This release does not modify live settings.
File inventory and verified evidence (TRT-04, TRT-08)
With "Install only packages approved by the Hub" (hub.enforce), a binary, an archive or a wheel is delivered only
when its sha256 is the digest of an approved target or one of its files[].digest. The Hub now produces that
inventory itself: it derives it from the OCI manifest whose sha256 is the digest of the release (one entry per layer,
named by its org.opencontainers.image.title annotation), plus the files found inside an archive layer and attested
by the scanner identity. A list supplied by the publisher is never used. The inventory is signed with the document
and repeated in the revocations: a revoked file is refused even when another target lists the same digest.
Each scan of a target carries keyid, the scanner key that attested it, and cosign holds the Cosign payload and
its signature, verifiable offline with the Navinspire Cosign public key.
A release published before this fix has no inventory: under hub.enforce its binaries and wheels stay refused
(hub_artifact_not_approved). Ask the Hub administrator for a new release (attested scans and inventory), then sync
or reimport the document. Nothing changes in the Manager: it already read files[].digest.