Adding content to orcharhino

Start adding content to orcharhino by organizing products and repositories, securing upstream connections, and synchronizing or uploading packages for your hosts.

Products and repositories in orcharhino

Products group related repositories in orcharhino. Each repository stores packages or other content that you synchronize from upstream or upload directly.

You can organize content in products. Products bundle an arbitrary number of repositories.

Products require a subscription for hosts to access. orcharhino creates a subscription for each product you create.

Best practices for products and repositories

Follow these recommendations when you organize products and repositories in orcharhino to simplify content views and avoid synchronization issues.

Use one content type per product and content view, for example, Yum content only.

Use file repositories for installation media. File repositories require a PULP_MANIFEST file that you can create using pulp-manifest /path/to/files. Use local repositories with file:///path/to/files as Upstream URL in orcharhino, for example, for installation media. Alternatively, place the installation media file repositories on a web server that is accessible to the hosts during provisioning.

ATIX AG provides file type repositories for installation media. You can synchronize them to provision hosts in disconnected environments by using local installation media. For a list of upstream URLs, see Using file repositories for installation media for Debian/Ubuntu in the ATIX Service Portal.

ATIX AG provides the following installation media as file type repository:

Debian 13
Debian 12
Debian 11
Ubuntu 26.04
Ubuntu 24.04
Ubuntu 22.04
Ubuntu 20.04
Ubuntu 18.04

For more information, see Managing custom file type content.

Make file repositories available over HTTP. If you set Protected to true, you can only download content using a global debugging certificate.
Automate the creation of multiple products and repositories by using a Hammer script or an Ansible Playbook.
Avoid uploading content to repositories with an Upstream URL. Instead, create a repository to synchronize content and upload content to without setting an Upstream URL.

If you upload content to a repository that already synchronizes another repository, the content might be overwritten, depending on the mirroring policy and content type.

Authenticating and securing content with content credentials

Upstream content often uses HTTPS and signed metadata or packages. Import SSL certificates when upstream servers use custom or private certificate authorities so orcharhino can connect securely. Import GPG keys so registered hosts can verify signatures on Yum content when they consume content from orcharhino.

Importing custom SSL certificates by using orcharhino management UI

Import SSL certificates and keys into content credentials before synchronizing content from upstream servers that use HTTPS or client authentication. This might include client certificates and keys or CA certificates.

Procedure

In the orcharhino management UI, navigate to Content > Content Credentials. In the Content Credentials window, click Create Content Credential.
In the Name field, enter a name for your SSL certificate.
From the Type list, select SSL Certificate.
In the Content Credentials Content field, paste your SSL certificate, or click Browse to upload your SSL certificate.
Click Save.

Importing custom SSL certificates by using Hammer CLI

Procedure

Copy the SSL certificate to your orcharhino Server:

$ scp My_SSL_Certificate root@orcharhino.example.com:~/.

Or download the SSL certificate to your orcharhino Server from an online source:

$ wget -P ~ http://upstream-orcharhino.example.com/pub/katello-server-ca.crt

Upload the SSL Certificate to orcharhino:

$ hammer content-credential create \
--content-type cert \
--name "My_SSL_Certificate" \
--organization "My_Organization" \
--path ~/My_SSL_Certificate

Extracting GPG keys from RPM packages

Extract GPG public keys from vendor RPM packages without installing them when upstream repositories ship keys inside a release package.

Prerequisites

You know the download URL for the RPM that ships the vendor GPG keys.

Procedure

Download the RPM to your local machine:

$ wget http://www.example.com/9.5/example-9.5-2.noarch.rpm

Extract the RPM file without installing it:

$ rpm2cpio example-9.5-2.noarch.rpm | cpio -idmv

Locate the GPG public key files under the extracted etc/pki/rpm-gpg/ directory, for example etc/pki/rpm-gpg/RPM-GPG-KEY-EXAMPLE-95.

Next steps

Use the extracted key file when you import a GPG key into orcharhino. For more information, see Importing a custom gpg key by using orcharhino management UI.

Importing a GPG key by using orcharhino management UI

Import a vendor GPG key into orcharhino so hosts validate signatures when they install signed content from authorized sources.

Prerequisites

You have a copy of the GPG key used to sign the RPM content that you want to use and manage in orcharhino. Most RPM distribution vendors provide their GPG Key on their website. You can also extract GPG key files from an RPM package. For more information, see Extracting gpg keys from rpm packages.

Procedure

In the orcharhino management UI, navigate to Content > Content Credentials.
Click Create Content Credential.
Enter the name of your repository and select GPG Key from the Type list.

Either paste the GPG key into the Content Credential Contents field, or click Browse and select the GPG key file that you want to import.

If your repository contains content signed by multiple GPG keys, you must enter all required GPG keys in the Content Credential Contents field with new lines between each key, for example:

Click Save.

Importing a GPG key by using Hammer CLI

Import a vendor GPG key into orcharhino so hosts validate signatures when they install signed content from authorized sources.

Prerequisites

You have a copy of the GPG key used to sign the RPM content that you want to use and manage in orcharhino. Most RPM distribution vendors provide their GPG Key on their website. You can also extract GPG key files from an RPM package. For more information, see Extracting gpg keys from rpm packages.

Procedure

Copy the GPG key to your orcharhino Server:

$ scp ~/etc/pki/rpm-gpg/RPM-GPG-KEY-EXAMPLE-95 root@orcharhino.example.com:~/.

Upload the GPG key to orcharhino:

$ hammer content-credentials create \
--content-type gpg_key \
--name "My_GPG_Key" \
--organization "My_Organization" \
--path ~/RPM-GPG-KEY-EXAMPLE-95

Creating products

A product in orcharhino groups related repositories. Create a product before you add repositories.

For Red Hat content, orcharhino automatically creates a product when you enable a repository.

Creating a product by using orcharhino management UI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

In the orcharhino management UI, navigate to Content > Products, click Create Product.
In the Name field, enter a name for the product. orcharhino automatically completes the Label field based on what you have entered for Name.
Optional: From the GPG Key list, select the GPG key for the product.
Optional: From the SSL CA Cert list, select the SSL CA certificate for the product.
Optional: From the SSL Client Cert list, select the SSL client certificate for the product.
Optional: From the SSL Client Key list, select the SSL client key for the product.
Optional: From the Sync Plan list, select an existing sync plan or click Create Sync Plan and create a sync plan for your product requirements.
In the Description field, enter a description of the product.
Click Save.

Creating a product by using Hammer CLI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

Create a product:

$ hammer product create \
--name "My_Name" \
--organization-id My_Organization_ID

Creating repositories

Repositories hold synchronized or uploaded content for a product. Add repository definitions for Deb and Yum content, or enable Red Hat repositories or SUSE repositories, then synchronize or upload packages as required.

Adding RPM repositories by using orcharhino management UI

Add RPM repositories from an upstream URL to distribute Yum content to your hosts. Use Repo Discovery to import multiple repositories from one source.

The Products window in the orcharhino management UI also provides a Repo Discovery function that finds all repositories from a URL and you can select which ones to add to your product. For example, you can use the Repo Discovery to search https://download.postgresql.org/pub/repos/yum/16/redhat/ and list all repositories for different AlmaLinux versions and architectures. This helps you save time importing multiple repositories from a single source.

Prerequisites

You have imported the GPG key that you want to use to verify signatures of the RPM packages. For more information, see Importing a custom gpg key by using orcharhino management UI.

Procedure

In the orcharhino management UI, navigate to Content > Products and select the product that you want to use, and then click New Repository.
In the Name field, enter a name for the repository. orcharhino automatically completes the Label field based on what you have entered for Name.
Optional: In the Description field, enter a description for the repository.
From the Type list, select yum as type of repository.
Optional: From the Restrict to Architecture list, select an architecture. If you want to make the repository available to all hosts regardless of the architecture, ensure to select No restriction.
Optional: From the Restrict to OS Version list, select the operating system version. If you want to make the repository available to all hosts regardless of the operating system version, ensure to select No restriction.
Optional: In the Upstream URL field, enter the URL of the external repository to use as a source. orcharhino supports three protocols: http://, https://, and file://. If you are using a file:// repository, you have to place it under /var/lib/pulp/sync_imports/ directory.

If you do not enter an upstream URL, you can manually upload packages.
Optional: Check the Ignore SRPMs checkbox to exclude source RPM packages from being synchronized to orcharhino.
Optional: Check the Ignore treeinfo checkbox if you receive the error Treeinfo file should have INI format. All files related to Kickstart will be missing from the repository if treeinfo files are skipped.
Select the Verify SSL checkbox if you want to verify that the upstream repository’s SSL certificates are signed by a trusted CA.
Optional: In the Upstream Username field, enter the user name for the upstream repository if required for authentication. Clear this field if the repository does not require authentication.
Optional: In the Upstream Password field, enter the corresponding password for the upstream repository. Clear this field if the repository does not require authentication.
Optional: In the Upstream Authentication Token field, provide the token of the upstream repository user for authentication. Leave this field empty if the repository does not require authentication.
From the Download Policy list, select the type of synchronization orcharhino Server performs. For more information, see Download Policies Overview content-management.
From the Mirroring Policy list, select the type of content synchronization orcharhino Server performs. For more information, see Mirroring Policies Overview content-management.
Optional: In the Retain package versions field, enter the number of versions you want to retain per package. This field is available only if you are using the additive download policy.
Optional: In the HTTP Proxy Policy field, select an HTTP proxy.
From the Checksum list, select the checksum type for the repository.

Optional: You can clear the Unprotected checkbox to require a subscription entitlement certificate for accessing this repository. By default, the repository is published through HTTP.

You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.

Optional: From the GPG Key list, select the GPG key for the product.
Optional: In the SSL CA Cert field, select the SSL CA Certificate for the repository.
Optional: In the SSL Client cert field, select the SSL Client Certificate for the repository.
Optional: In the SSL Client Key field, select the SSL Client Key for the repository.
Click Save to create the repository.

Next steps

Synchronizing repositories ad hoc

Adding RPM repositories by using Hammer CLI

Add RPM repositories from an upstream URL to distribute Yum content to your hosts.

Prerequisites

You have imported the GPG key that you want to use to verify signatures of the RPM packages. For more information, see Importing a custom gpg key by using Hammer CLI.

Procedure

Create a Yum repository:

$ hammer repository create \
--arch "My_Architecture" \
--content-type "yum" \
--gpg-key-id My_GPG_Key_ID \
--name "My_Repository" \
--organization "My_Organization" \
--os-version "My_Operating_System_Version" \
--product "My_Product" \
--publish-via-http true \
--url My_Upstream_URL

Next steps

Synchronizing repositories ad hoc

Adding orcharhino Clients for AlmaLinux

orcharhino Clients are required to register hosts to orcharhino. You can add them to your orcharhino during the installation process or afterwards. For more information, see orcharhino Clients gen3 in the ATIX Service Portal.

Procedure

Create a product named orcharhino Clients for AlmaLinux. For more information, see Creating a product by using orcharhino management UI.
Create a repository for AlmaLinux 10. You can find the URLs of all orcharhino Clients in orcharhino Clients gen3 in the ATIX Service Portal. For more information, see Adding RPM repositories by using orcharhino management UI.
Synchronize the orcharhino Clients for AlmaLinux to your orcharhino. For more information, see Synchronizing repositories by using orcharhino management UI.
Create a content view to make the .rpm packages consumable by content hosts. For more information, see Creating a content view by using orcharhino management UI.
Create an activation key to register content hosts to orcharhino. For more information, see Creating an activation key by using orcharhino management UI.
Optional: Create a host group to simplify the process of creating hosts. For more information, see Creating a host group by using orcharhino management UI.

Uploading content to repositories

You can upload content to repositories to distribute content that you cannot synchronize from an upstream URL.

Uploading content to RPM repositories by using orcharhino management UI

You can upload individual RPM packages to a RPM repository to distribute Yum content that you cannot synchronize.

You must use Hammer CLI to upload source RPM packages. For more information, see Uploading content to custom rpm repositories by using Hammer CLI.

Procedure

In the orcharhino management UI, navigate to Content > Products.
Click the name of the product.
In the Repositories tab, click the name of the RPM repository.
Under Upload Package, click Browse… and select the RPM you want to upload.
Click Upload.

Verification

To view all RPMs in this repository, click the number next to Packages under Content Counts.

Troubleshooting

If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value. In the orcharhino management UI, navigate to Administer > Settings. The Sync task timeout setting is located on the Tasks tab.

Next steps

Add your RPM repository to a content view. For more information, see Creating a content view by using orcharhino management UI.

If your RPM is unprotected, hosts can consume its content by using the Published At URL.

In the Default Organization View content view, the URL consists of your orcharhino Proxy FQDN, /pulp/content/, your organization label, /Library/custom/, your product label, /, your repository label, and a trailing /, for example, https://foreman.example.com/pulp/content/Example/Library/custom/my-software/my-app/.

Additional resources

Sync task timeout description in Administering orcharhino

Uploading content to RPM repositories by using Hammer CLI

You can upload individual RPM packages to a RPM repository to distribute Yum content that you cannot synchronize. Use Hammer CLI to upload source RPM packages.

Procedure

Upload an RPM package:

$ hammer repository upload-content \
--id My_Repository_ID \
--path /path/to/example-package.rpm

Upload a source RPM package:

$ hammer repository upload-content \
--content-type srpm \
--id My_Repository_ID \
--path /path/to/example-package.src.rpm

Verification

After the upload is complete, you can view information about a source RPM by using the commands hammer srpm list and hammer srpm info --id srpm_ID.

Troubleshooting

If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value:
```
$ hammer settings set --name foreman_tasks_sync_task_timeout --value seconds
```

Next steps

Add your RPM repository to a content view. For more information, see Creating a content view by using Hammer CLI.

If your RPM is unprotected, hosts can consume its content by using the Published At URL.

Additional resources

Sync task timeout description in Administering orcharhino

Uploading content to file type repositories by using orcharhino management UI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

In the orcharhino management UI, navigate to Content > Products.
Select a product by name.
Select a file type repository by name.
Click Browse to search and select the file you want to upload.
Click Upload to upload the selected file to orcharhino Server.
Visit the URL where the repository is published to see the file.

Additional resources

Managing file type content in Managing Content

Uploading content to file type repositories by using Hammer CLI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

Upload files to your file type repository:
```
$ hammer repository upload-content \
--id My_Repository_ID \
--organization-id My_Organization_ID \
--path My_Example_File
```
The --path option can indicate a file, a directory of files, or a glob expression of files. Globs must be escaped by single or double quotes.

Additional resources

Managing file type content in Managing Content

Repository definitions for client operating systems

Use these repository definitions when you create repositories in orcharhino to synchronize client operating system content from upstream sources.

Additional resources

Creating a custom product by using orcharhino management UI
Adding custom rpm repositories by using orcharhino management UI

Repository definitions for AlmaLinux

Upstream repositories for AlmaLinux include BaseOS, AppStream, extras, and the optional orcharhino Client for AlmaLinux.

Table 1. AlmaLinux 10
Repository name	Upstream URL
`AlmaLinux 10 BaseOS`	`https://repo.almalinux.org/almalinux/10/BaseOS/x86_64/os/`
`AlmaLinux 10 AppStream`	`https://repo.almalinux.org/almalinux/10/AppStream/x86_64/os/`
`AlmaLinux 10 extras`	`https://repo.almalinux.org/almalinux/10/extras/x86_64/os/`
`orcharhino Client for AlmaLinux`	see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-10

Table 2. AlmaLinux 9
Repository name	Upstream URL
`AlmaLinux 9 BaseOS`	`https://repo.almalinux.org/almalinux/9/BaseOS/x86_64/os/`
`AlmaLinux 9 AppStream`	`https://repo.almalinux.org/almalinux/9/AppStream/x86_64/os/`
`AlmaLinux 9 extras`	`https://repo.almalinux.org/almalinux/9/extras/x86_64/os/`
`orcharhino Client for AlmaLinux`	see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-9

Table 3. AlmaLinux 8
Repository name	Upstream URL
`AlmaLinux 8 BaseOS`	`https://repo.almalinux.org/almalinux/8/BaseOS/x86_64/os/`
`AlmaLinux 8 AppStream`	`https://repo.almalinux.org/almalinux/8/AppStream/x86_64/os/`
`AlmaLinux 8 extras`	`https://repo.almalinux.org/almalinux/8/extras/x86_64/os/`
`orcharhino Client for AlmaLinux`	see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://repo.almalinux.org/almalinux/RPM-GPG-KEY-AlmaLinux-8

GPG public keys for AlmaLinux

You can download the GPG public key from repo.almalinux.org.

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").