Adding content to orcharhino

Start adding content to orcharhino by organizing products and repositories, securing upstream connections, and synchronizing or uploading packages for your hosts.

Products and repositories in orcharhino

Products group related repositories in orcharhino. Each repository stores packages or other content that you synchronize from upstream or upload directly.

You can organize content in products. Products bundle an arbitrary number of repositories.

Products require a subscription for hosts to access. orcharhino creates a subscription for each product you create.

Best practices for products and repositories

Follow these recommendations when you organize products and repositories in orcharhino to simplify content views and avoid synchronization issues.

  • Use one content type per product and content view, for example, Deb content only.

  • Use file repositories for installation media. File repositories require a PULP_MANIFEST file that you can create using pulp-manifest /path/to/files. Use local repositories with file:///path/to/files as Upstream URL in orcharhino, for example, for installation media. Alternatively, place the installation media file repositories on a web server that is accessible to the hosts during provisioning.

    ATIX AG provides file type repositories for installation media. You can synchronize them to provision hosts in disconnected environments by using local installation media. For a list of upstream URLs, see Using file repositories for installation media for Debian/Ubuntu in the ATIX Service Portal.

    ATIX AG provides the following installation media as file type repository:

    • Debian 13

    • Debian 12

    • Debian 11

    • Ubuntu 26.04

    • Ubuntu 24.04

    • Ubuntu 22.04

    • Ubuntu 20.04

    • Ubuntu 18.04

    For more information, see Managing custom file type content.

  • Make file repositories available over HTTP. If you set Protected to true, you can only download content using a global debugging certificate.

  • Automate the creation of multiple products and repositories by using a Hammer script or an Ansible Playbook.

  • Avoid uploading content to repositories with an Upstream URL. Instead, create a repository to synchronize content and upload content to without setting an Upstream URL.

    If you upload content to a repository that already synchronizes another repository, the content might be overwritten, depending on the mirroring policy and content type.

Authenticating and securing content with content credentials

Upstream content often uses HTTPS and signed metadata or packages. Import SSL certificates when upstream servers use custom or private certificate authorities so orcharhino can connect securely. Import GPG keys so orcharhino can verify signatures on metadata of Deb content.

Importing custom SSL certificates by using orcharhino management UI

Import SSL certificates and keys into content credentials before synchronizing content from upstream servers that use HTTPS or client authentication. This might include client certificates and keys or CA certificates.

Procedure

  1. In the orcharhino management UI, navigate to Content > Content Credentials. In the Content Credentials window, click Create Content Credential.

  2. In the Name field, enter a name for your SSL certificate.

  3. From the Type list, select SSL Certificate.

  4. In the Content Credentials Content field, paste your SSL certificate, or click Browse to upload your SSL certificate.

  5. Click Save.

Importing custom SSL certificates by using Hammer CLI

Import SSL certificates and keys into content credentials before synchronizing content from upstream servers that use HTTPS or client authentication. This might include client certificates and keys or CA certificates.

Procedure

  1. Copy the SSL certificate to your orcharhino Server:

    $ scp My_SSL_Certificate root@orcharhino.example.com:~/.

    Or download the SSL certificate to your orcharhino Server from an online source:

    $ wget -P ~ http://upstream-orcharhino.example.com/pub/katello-server-ca.crt

  2. Upload the SSL Certificate to orcharhino:

    $ hammer content-credential create \
--content-type cert \
--name "My_SSL_Certificate" \
--organization "My_Organization" \
--path ~/My_SSL_Certificate

Extracting GPG public key fingerprints from Release files

Extract GPG key fingerprints from Debian Release files when you need to verify Deb repository signatures.

This example verifies the signature for the Release file from Debian 11.

Procedure

  1. Download the Release and Release.gpg files:

    $ wget https://deb.debian.org/debian/dists/bullseye/Release
$ wget https://deb.debian.org/debian/dists/bullseye/Release.gpg

  2. Verify the signature:

    $ gpg --verify Release.gpg Release

    Note the GPG key fingerprint for any missing public GPG keys above the Can’t check signature: No public key message. These fingerprints will be used in the next step.

  3. If you cannot verify the signature, import the missing GPG public keys based on their fingerprint:

    $ gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys A7236886F3CCCAAD148A27F80E98404D386FA1D9
$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver hkps://keyserver.ubuntu.com --recv-keys A4285295FC7B1A81600062A9605C66F00D6C9793

  4. Optional: Verify the signature again:

    $ gpg --verify Release.gpg Release

  5. Export the ASCII-armored GPG public keys to a file:

    $ gpg --armor --export A7236886F3CCCAAD148A27F80E98404D386FA1D9 4CB50190207B4758A3F73A796ED0E7B82643E131 A4285295FC7B1A81600062A9605C66F00D6C9793 > debian_11.txt

    Ensure that gpg returns a Good signature message for each signature.

    Upload the .txt file to orcharhino. For more information, see Importing a custom gpg key by using orcharhino management UI into orcharhino.

Importing a GPG key by using orcharhino management UI

Import a vendor GPG key into orcharhino so orcharhino validates signatures on repository metadata when it synchronizes content from upstream.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Content > Content Credentials.

  2. Click Create Content Credential.

  3. Enter the name of your repository and select GPG Key from the Type list.

  4. Either paste the GPG key into the Content Credential Contents field, or click Browse and select the GPG key file that you want to import.

    If your repository contains content signed by multiple GPG keys, you must enter all required GPG keys in the Content Credential Contents field with new lines between each key, for example:

    -----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFy/HE4BEADttv2TCPzVrre+aJ9f5QsR6oWZMm7N5Lwxjm5x5zA9BLiPPGFN
4aTUR/g+K1S0aqCU+ZS3Rnxb+6fnBxD+COH9kMqXHi3M5UNzbp5WhCdUpISXjjpU
XIFFWBPuBfyr/FKRknFH15P+9kLZLxCpVZZLsweLWCuw+JKCMmnA
=F6VG
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFw467UBEACmREzDeK/kuScCmfJfHJa0Wgh/2fbJLLt3KSvsgDhORIptf+PP
OTFDlKuLkJx99ZYG5xMnBG47C7ByoMec1j94YeXczuBbynOyyPlvduma/zf8oB9e
Wl5GnzcLGAnUSRamfqGUWcyMMinHHIKIc1X1P4I=
=WPpI
-----END PGP PUBLIC KEY BLOCK-----

  5. Click Save.

Importing a GPG key by using Hammer CLI

Import a vendor GPG key into orcharhino so orcharhino validates signatures on repository metadata when it synchronizes content from upstream.

Prerequisites
Procedure

  1. Copy the GPG key to your orcharhino Server:

    $ scp ~/_My_GPG_Public_Key_ root@orcharhino.example.com:~/.

  2. Upload the GPG key to orcharhino:

    $ hammer content-credentials create \
--content-type gpg_key \
--name "My_GPG_Key" \
--organization "My_Organization" \
--path ~/_My_GPG_Public_Key_

Creating products

A product in orcharhino groups related repositories. Create a product before you add repositories.

For Red Hat content, orcharhino automatically creates a product when you enable a repository.

Creating a product by using orcharhino management UI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products, click Create Product.

  2. In the Name field, enter a name for the product. orcharhino automatically completes the Label field based on what you have entered for Name.

  3. Optional: From the GPG Key list, select the GPG key for the product.

  4. Optional: From the SSL CA Cert list, select the SSL CA certificate for the product.

  5. Optional: From the SSL Client Cert list, select the SSL client certificate for the product.

  6. Optional: From the SSL Client Key list, select the SSL client key for the product.

  7. Optional: From the Sync Plan list, select an existing sync plan or click Create Sync Plan and create a sync plan for your product requirements.

  8. In the Description field, enter a description of the product.

  9. Click Save.

Creating a product by using Hammer CLI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

  • Create a product:

    $ hammer product create \
--name "My_Name" \
--organization-id My_Organization_ID

Creating repositories

Repositories hold synchronized or uploaded content for a product. Add repository definitions for Deb and Yum content, or enable Red Hat repositories or SUSE repositories, then synchronize or upload packages as required.

Adding Deb repositories by using orcharhino management UI

Add Deb repositories with upstream URLs and GPG verification so you can synchronize Debian or Ubuntu content in orcharhino.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Content > Products and select the product that you want to use, and then click New Repository.

  2. In the Name field, enter a name for the repository. orcharhino automatically completes the Label field based on what you have entered for Name.

  3. Optional: In the Description field, enter a description for the repository.

  4. From the Type list, select deb as type of repository.

  5. Optional: In the Upstream URL field, enter the URL of the external repository to use as a source. You can find the upstream URLs on Debian-based systems in /etc/apt/sources.list.

    If you do not enter an upstream URL, you can manually upload packages.

  6. In the Releases/Distributions field, set one or multiple releases separated by whitespace. The distributions specify the path from the repository root to the Release file. Repositories that omit the dists directory are using the deprecated flat repository structure. To synchronize a flat repository, you must specify exactly one distribution that ends with a /.

    For official Debian repositories, set a codename in the Releases/Distributions field, for example trixie for Debian 13 or bookworm for Debian 12. Avoid using stable or testing because the codename they reference changes over time. This helps to avoid drastic changes once a new Debian version is released and the reference is changed. To keep things easy to manage and to avoid potential performance and network issues during synchronization, create one repository per release in orcharhino. For official Ubuntu repositories, use the Ubuntu suite, for example resolute or resolute-updates.

  7. Optional: In the Components field, enter a component. This indicates the licensing terms of the software packages.

    In Debian, it is divided into main, contrib, and non-free. For official Debian or Ubuntu repositories, ATIX AG recommends leaving this field empty to synchronize all available components. Note that some third party Debian repositories use the components in ways that may require setting an explicit selection.

    Ensure that you enter both Releases and Components exactly as they are in an /etc/apt/sources.list file.

  8. Optional: In the Architectures field, enter one or multiple architectures separated by whitespace.

    orcharhino always synchronizes packages of architecture all regardless of your architecture selection.

    If you want to make the repository available to all hosts regardless of the architecture, ensure to select No restriction.

  9. Optional: In the Errata URL field, enter the URL of an errata service.

    The ATIX AG Debian and Ubuntu Errata service provides errata for Debian and Ubuntu. When creating a repository of type deb, point the Errata URL to ATIX AG Debian and Ubuntu Errata service. Use https://dep.atix.de/dep/api/v1/debian for Debian, https://dep.atix.de/dep/api/v1/ubuntu for Ubuntu, and https://dep.atix.de/dep/api/v1/ubuntu-esm for Ubuntu-ESM.

    An erratum contains the information which packages have to be updated to fix a security issue. Debian and Ubuntu errata are derived from the Debian security announcements (DSA) and the Ubuntu security notices (USN).

    You must add Debian and Ubuntu errata to the security repository. For Debian, you need the My_Debian_Release-security repository, for example, trixie-security. For Ubuntu, you need the My_Ubuntu_Release-security repository, for example, resolute-security.

  10. Optional: Select the Verify SSL checkbox if you want to verify that the upstream repository’s SSL certificates are signed by a trusted CA.

  11. Optional: In the Upstream Username field, enter the user name for the upstream repository if required for authentication. Clear this field if the repository does not require authentication.

  12. Optional: In the Upstream Password field, enter the corresponding password for the upstream repository. Clear this field if the repository does not require authentication.

  13. Optional: In the Upstream Authentication Token field, provide the token of the upstream repository user for authentication. Leave this field empty if the repository does not require authentication.

  14. From the Download Policy list, select the type of synchronization orcharhino Server performs. For more information, see Download Policies Overview content-management.

  15. From the Mirroring Policy list, select the type of content synchronization orcharhino Server performs. For more information, see Mirroring Policies Overview content-management.

  16. Optional: In the HTTP Proxy Policy field, select an HTTP proxy.

  17. Optional: You can clear the Unprotected checkbox to require a subscription entitlement certificate for accessing this repository. By default, the repository is published through HTTP.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.

  18. Optional: From the GPG Key list, select the GPG key if you want to verify the signatures of the Release files associated with the Debian repository.

  19. Optional: In the SSL CA Cert field, select the SSL CA Certificate for the repository.

  20. Optional: In the SSL Client cert field, select the SSL Client Certificate for the repository.

  21. Optional: In the SSL Client Key field, select the SSL Client Key for the repository.

  22. Click Save to create the repository.

Next steps

Adding Deb repositories by using Hammer CLI

Add Deb repositories with upstream URLs and GPG verification so you can synchronize Debian or Ubuntu content in orcharhino.

Prerequisites
Procedure

  • Create a Deb repository:

    $ hammer repository create \
--content-type "deb" \
--deb-architectures "My_Deb_Architectures" \
--deb-components "My_Deb_Components" \
--deb-releases "My_Deb_Releases" \
--gpg-key-id "My_GPG_Key_ID" \
--name "My_Repository" \
--organization "My_Organization" \
--product "My_Product" \
--publish-via-http true \
--url My_Upstream_URL

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Next steps

Adding orcharhino Clients for Debian

orcharhino Clients are required to register hosts to orcharhino. You can add them to your orcharhino during the installation process or afterwards. For more information, see orcharhino Clients gen3 in the ATIX Service Portal.

Procedure

  1. Create a product named orcharhino Clients for Debian. For more information, see Creating a product by using orcharhino management UI.

  2. Create a repository for Debian 13. You can find the URLs of all orcharhino Clients in orcharhino Clients gen3 in the ATIX Service Portal. For more information, see Adding Deb repositories by using orcharhino management UI.

  3. Synchronize the orcharhino Clients for Debian to your orcharhino. For more information, see Synchronizing repositories by using orcharhino management UI.

  4. Create a content view to make the .deb packages consumable by content hosts. For more information, see Creating a content view by using orcharhino management UI.

  5. Create an activation key to register content hosts to orcharhino. For more information, see Creating an activation key by using orcharhino management UI.

  6. Optional: Create a host group to simplify the process of creating hosts. For more information, see Creating a host group by using orcharhino management UI.

Uploading content to repositories

You can upload content to repositories to distribute content that you cannot synchronize from an upstream URL.

Uploading content to file type repositories by using orcharhino management UI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products.

  2. Select a product by name.

  3. Select a file type repository by name.

  4. Click Browse to search and select the file you want to upload.

  5. Click Upload to upload the selected file to orcharhino Server.

  6. Visit the URL where the repository is published to see the file.

Additional resources

Uploading content to file type repositories by using Hammer CLI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

  • Upload files to your file type repository:

    $ hammer repository upload-content \
--id My_Repository_ID \
--organization-id My_Organization_ID \
--path My_Example_File

    The --path option can indicate a file, a directory of files, or a glob expression of files. Globs must be escaped by single or double quotes.

Additional resources

Uploading content to Deb repositories by using orcharhino management UI

You can upload individual Deb packages to a Deb repository to distribute Deb content that you cannot synchronize.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products.

  2. Select your product.

  3. Select the Deb repository that you want to upload packages to. Do not upload packages to a repository if you have set the Upstream URL.

  4. Under Upload Package, click Browse…​ and select the Deb package that you want to upload.

  5. Click Upload.

Verification

  • To view all Deb packages in this repository, click the number next to Packages under Content Counts.

Troubleshooting

  • If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value. In the orcharhino management UI, navigate to Administer > Settings. The Sync task timeout setting is located on the Tasks tab.

Next steps

  • Add your Deb repository to a content view. For more information, see Creating a content view by using orcharhino management UI.

  • If your Deb repository is unprotected, hosts can consume its content by using the Published At URL.

    In the Default Organization View content view, the URL consists of your orcharhino Proxy FQDN, /pulp/content/, your organization label, /Library/custom/, your product label, /, your repository label, and a trailing /, for example, https://foreman.example.com/pulp/content/Example/Library/custom/my-software/my-app/. Use katello as the distribution to set up the repository on your host.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Additional resources

Uploading content to Deb repositories by using Hammer CLI

You can upload individual Deb packages to a Deb repository to distribute Deb content that you cannot synchronize.

Procedure

  • Upload a Deb package:

    $ hammer repository upload-content \
--content-type deb \
--id My_Repository_ID \
--path /path/to/example-package.deb
Verification

  • Verify that your Deb repository contains the Deb package that you have uploaded:

    $ hammer deb list --repository-id My_Repository_ID
Troubleshooting

  • If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value:

    $ hammer settings set --name foreman_tasks_sync_task_timeout --value seconds
Next steps

  • Add your Deb repository to a content view. For more information, see Creating a content view by using Hammer CLI.

  • If your Deb repository is unprotected, hosts can consume its content by using the Published At URL.

    In the Default Organization View content view, the URL consists of your orcharhino Proxy FQDN, /pulp/content/, your organization label, /Library/custom/, your product label, /, your repository label, and a trailing /, for example, https://foreman.example.com/pulp/content/Example/Library/custom/my-software/my-app/. Use katello as the distribution to set up the repository on your host.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Additional resources

Repository definitions for client operating systems

Use these repository definitions when you create repositories in orcharhino to synchronize client operating system content from upstream sources.

Additional resources

Repository definitions for Debian

Upstream repositories for Debian include main, updates, security, and the orcharhino Client for Debian.

Table 1. Debian 13
Repository name Upstream URL Releases/Distributions Components Architectures

Debian 13 main

https://deb.debian.org/debian/

trixie

main

amd64

Debian 13 updates

https://deb.debian.org/debian/

trixie-updates

main

amd64

Debian 13 security

https://deb.debian.org/debian-security/

trixie-security

main

amd64

orcharhino Client for Debian

see orcharhino Clients gen3 in the ATIX Service Portal

stable

main

amd64
Table 2. Debian 12
Repository name Upstream URL Releases/Distributions Components Architectures

Debian 12 main

https://deb.debian.org/debian/

bookworm

main

amd64

Debian 12 updates

https://deb.debian.org/debian/

bookworm-updates

main

amd64

Debian 12 security

https://deb.debian.org/debian-security/

bookworm-security

main

amd64

orcharhino Client for Debian

see orcharhino Clients gen3 in the ATIX Service Portal

stable

main

amd64
Table 3. Debian 11
Repository name Upstream URL Releases/Distributions Components Architectures

Debian 11 main

https://deb.debian.org/debian/

bullseye

main

amd64

Debian 11 updates

https://deb.debian.org/debian/

bullseye-updates

main

amd64

Debian 11 security

https://deb.debian.org/debian-security/

bullseye-security

main

amd64

orcharhino Client for Debian

see orcharhino Clients gen3 in the ATIX Service Portal

stable

main

amd64

GPG public keys for Debian

You can download the GPG public keys from debian.org. Alternatively, you can check which GPG public key is required to verify the Release.gpg file.

Debian 13 (Trixie) main
$ wget https://ftp.debian.org/debian/dists/trixie/Release && wget https://ftp.debian.org/debian/dists/trixie/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key B8E5F13176D2A7A75220028078DBA3BC47EF2265
$ gpg --keyserver keys.gnupg.net --recv-key 41587F7DB8C774BCCF131416762F67A0B2C39DE4
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 B8E5F13176D2A7A75220028078DBA3BC47EF2265 41587F7DB8C774BCCF131416762F67A0B2C39DE4 > debian_trixie_main.txt
Debian 13 (Trixie) updates
$ wget https://ftp.debian.org/debian/dists/trixie-updates/Release && wget https://ftp.debian.org/debian/dists/trixie-updates/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key B8E5F13176D2A7A75220028078DBA3BC47EF2265
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 B8E5F13176D2A7A75220028078DBA3BC47EF2265 > debian_trixie_updates.txt
Debian 13 (Trixie) security
$ wget https://security.debian.org/debian-security/dists/trixie-security/Release && wget https://security.debian.org/debian-security/dists/trixie-security/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
$ gpg --keyserver keys.gnupg.net --recv-key 89C87ACEA5DD6B8E6A7068808E9F831205B4BA95
$ gpg --armor --export B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8 89C87ACEA5DD6B8E6A7068808E9F831205B4BA95 > debian_trixie_security.txt
Debian 12 (Bookworm) main
$ wget http://ftp.debian.org/debian/dists/bookworm/Release && wget http://ftp.debian.org/debian/dists/bookworm/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key B8E5F13176D2A7A75220028078DBA3BC47EF2265
$ gpg --keyserver keys.gnupg.net --recv-key 4D64FEC119C2029067D6E791F8D2585B8783D481
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 B8E5F13176D2A7A75220028078DBA3BC47EF2265 4D64FEC119C2029067D6E791F8D2585B8783D481 > debian_bookworm_main.txt
Debian 12 (Bookworm) updates
$ wget http://ftp.debian.org/debian/dists/bookworm-updates/Release && wget http://ftp.debian.org/debian/dists/bookworm-updates/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key B8E5F13176D2A7A75220028078DBA3BC47EF2265
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 B8E5F13176D2A7A75220028078DBA3BC47EF2265 > debian_bookworm_updates.txt
Debian 12 (Bookworm) security
$ wget https://security.debian.org/debian-security/dists/bookworm-security/Release && wget https://security.debian.org/debian-security/dists/bookworm-security/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key ED541312A33F1128F10B1C6C54404762BBB6E853
$ gpg --keyserver keys.gnupg.net --recv-key B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
$ gpg --armor --export ED541312A33F1128F10B1C6C54404762BBB6E853 B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8 > debian_bookworm_security.txt
Debian 11 (Bullseye) main
$ wget http://ftp.debian.org/debian/dists/bullseye/Release && wget http://ftp.debian.org/debian/dists/bullseye/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key A4285295FC7B1A81600062A9605C66F00D6C9793
$ gpg --keyserver keys.gnupg.net --recv-key A7236886F3CCCAAD148A27F80E98404D386FA1D9
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 A4285295FC7B1A81600062A9605C66F00D6C9793 A7236886F3CCCAAD148A27F80E98404D386FA1D9 > debian_bullseye_main.txt
Debian 11 (Bullseye) updates
$ wget http://ftp.debian.org/debian/dists/bullseye-updates/Release && wget http://ftp.debian.org/debian/dists/bullseye-updates/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key 4CB50190207B4758A3F73A796ED0E7B82643E131
$ gpg --keyserver keys.gnupg.net --recv-key A7236886F3CCCAAD148A27F80E98404D386FA1D9
$ gpg --armor --export 4CB50190207B4758A3F73A796ED0E7B82643E131 A7236886F3CCCAAD148A27F80E98404D386FA1D9 > debian_bullseye_updates.txt
Debian 11 (Bullseye) security
$ wget https://security.debian.org/debian-security/dists/bullseye-security/Release && wget https://security.debian.org/debian-security/dists/bullseye-security/Release.gpg
$ gpg --verify Release.gpg Release
$ gpg --keyserver keys.gnupg.net --recv-key B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8
$ gpg --keyserver keys.gnupg.net --recv-key ED541312A33F1128F10B1C6C54404762BBB6E853
$ gpg --armor --export B0CAB9266E8C3929798B3EEEBDE6D2B9216EC7A8 ED541312A33F1128F10B1C6C54404762BBB6E853 > debian_bullseye_security.txt

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").