Adding content to orcharhino

Start adding content to orcharhino by organizing products and repositories, securing upstream connections, and synchronizing or uploading packages for your hosts.

Products and repositories in orcharhino

Products group related repositories in orcharhino. Each repository stores packages or other content that you synchronize from upstream or upload directly.

You can organize content in products. Products bundle an arbitrary number of repositories.

Products require a subscription for hosts to access. orcharhino creates a subscription for each product you create.

Best practices for products and repositories

Follow these recommendations when you organize products and repositories in orcharhino to simplify content views and avoid synchronization issues.

  • Use one content type per product and content view, for example, Yum content only.

  • Use file repositories for installation media. File repositories require a PULP_MANIFEST file that you can create using pulp-manifest /path/to/files. Use local repositories with file:///path/to/files as Upstream URL in orcharhino, for example, for installation media. Alternatively, place the installation media file repositories on a web server that is accessible to the hosts during provisioning.

    ATIX AG provides file type repositories for installation media. You can synchronize them to provision hosts in disconnected environments by using local installation media. For a list of upstream URLs, see Using file repositories for installation media for Debian/Ubuntu in the ATIX Service Portal.

    ATIX AG provides the following installation media as file type repository:

    • Debian 13

    • Debian 12

    • Debian 11

    • Ubuntu 26.04

    • Ubuntu 24.04

    • Ubuntu 22.04

    • Ubuntu 20.04

    • Ubuntu 18.04

    For more information, see Managing custom file type content.

  • Make file repositories available over HTTP. If you set Protected to true, you can only download content using a global debugging certificate.

  • Automate the creation of multiple products and repositories by using a Hammer script or an Ansible Playbook.

  • For Oracle Linux content, including ULN repositories, set the mirroring policy to Additive and the Retain package versions to either one or two. This mitigates out-of-memory issues on orcharhino Server when synchronizing the content from Oracle. For more information, see Repository definitions for oracle linux on public yum servers and Repository definitions for oracle linux on uln.

  • Avoid uploading content to repositories with an Upstream URL. Instead, create a repository to synchronize content and upload content to without setting an Upstream URL.

    If you upload content to a repository that already synchronizes another repository, the content might be overwritten, depending on the mirroring policy and content type.

Authenticating and securing content with content credentials

Upstream content often uses HTTPS and signed metadata or packages. Import SSL certificates when upstream servers use custom or private certificate authorities so orcharhino can connect securely. Import GPG keys so registered hosts can verify signatures on Yum content when they consume content from orcharhino.

Importing custom SSL certificates by using orcharhino management UI

Import SSL certificates and keys into content credentials before synchronizing content from upstream servers that use HTTPS or client authentication. This might include client certificates and keys or CA certificates.

Procedure

  1. In the orcharhino management UI, navigate to Content > Content Credentials. In the Content Credentials window, click Create Content Credential.

  2. In the Name field, enter a name for your SSL certificate.

  3. From the Type list, select SSL Certificate.

  4. In the Content Credentials Content field, paste your SSL certificate, or click Browse to upload your SSL certificate.

  5. Click Save.

Importing custom SSL certificates by using Hammer CLI

Import SSL certificates and keys into content credentials before synchronizing content from upstream servers that use HTTPS or client authentication. This might include client certificates and keys or CA certificates.

Procedure

  1. Copy the SSL certificate to your orcharhino Server:

    $ scp My_SSL_Certificate root@orcharhino.example.com:~/.

    Or download the SSL certificate to your orcharhino Server from an online source:

    $ wget -P ~ http://upstream-orcharhino.example.com/pub/katello-server-ca.crt

  2. Upload the SSL Certificate to orcharhino:

    $ hammer content-credential create \
--content-type cert \
--name "My_SSL_Certificate" \
--organization "My_Organization" \
--path ~/My_SSL_Certificate

Extracting GPG keys from RPM packages

Extract GPG public keys from vendor RPM packages without installing them when upstream repositories ship keys inside a release package.

Prerequisites

  • You know the download URL for the RPM that ships the vendor GPG keys.

Procedure

  1. Download the RPM to your local machine:

    $ wget http://www.example.com/9.5/example-9.5-2.noarch.rpm

  2. Extract the RPM file without installing it:

    $ rpm2cpio example-9.5-2.noarch.rpm | cpio -idmv

  3. Locate the GPG public key files under the extracted etc/pki/rpm-gpg/ directory, for example etc/pki/rpm-gpg/RPM-GPG-KEY-EXAMPLE-95.

Next steps

Importing a GPG key by using orcharhino management UI

Import a vendor GPG key into orcharhino so hosts validate signatures when they install signed content from authorized sources.

Prerequisites

  • You have a copy of the GPG key used to sign the RPM content that you want to use and manage in orcharhino. Most RPM distribution vendors provide their GPG Key on their website. You can also extract GPG key files from an RPM package. For more information, see Extracting gpg keys from rpm packages.

Procedure

  1. In the orcharhino management UI, navigate to Content > Content Credentials.

  2. Click Create Content Credential.

  3. Enter the name of your repository and select GPG Key from the Type list.

  4. Either paste the GPG key into the Content Credential Contents field, or click Browse and select the GPG key file that you want to import.

    If your repository contains content signed by multiple GPG keys, you must enter all required GPG keys in the Content Credential Contents field with new lines between each key, for example:

    -----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFy/HE4BEADttv2TCPzVrre+aJ9f5QsR6oWZMm7N5Lwxjm5x5zA9BLiPPGFN
4aTUR/g+K1S0aqCU+ZS3Rnxb+6fnBxD+COH9kMqXHi3M5UNzbp5WhCdUpISXjjpU
XIFFWBPuBfyr/FKRknFH15P+9kLZLxCpVZZLsweLWCuw+JKCMmnA
=F6VG
-----END PGP PUBLIC KEY BLOCK-----

-----BEGIN PGP PUBLIC KEY BLOCK-----

mQINBFw467UBEACmREzDeK/kuScCmfJfHJa0Wgh/2fbJLLt3KSvsgDhORIptf+PP
OTFDlKuLkJx99ZYG5xMnBG47C7ByoMec1j94YeXczuBbynOyyPlvduma/zf8oB9e
Wl5GnzcLGAnUSRamfqGUWcyMMinHHIKIc1X1P4I=
=WPpI
-----END PGP PUBLIC KEY BLOCK-----

  5. Click Save.

Importing a GPG key by using Hammer CLI

Import a vendor GPG key into orcharhino so hosts validate signatures when they install signed content from authorized sources.

Prerequisites

  • You have a copy of the GPG key used to sign the RPM content that you want to use and manage in orcharhino. Most RPM distribution vendors provide their GPG Key on their website. You can also extract GPG key files from an RPM package. For more information, see Extracting gpg keys from rpm packages.

Procedure

  1. Copy the GPG key to your orcharhino Server:

    $ scp ~/etc/pki/rpm-gpg/RPM-GPG-KEY-EXAMPLE-95 root@orcharhino.example.com:~/.

  2. Upload the GPG key to orcharhino:

    $ hammer content-credentials create \
--content-type gpg_key \
--name "My_GPG_Key" \
--organization "My_Organization" \
--path ~/RPM-GPG-KEY-EXAMPLE-95

Creating products

A product in orcharhino groups related repositories. Create a product before you add repositories.

For Red Hat content, orcharhino automatically creates a product when you enable a repository.

Creating a product by using orcharhino management UI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products, click Create Product.

  2. In the Name field, enter a name for the product. orcharhino automatically completes the Label field based on what you have entered for Name.

  3. Optional: From the GPG Key list, select the GPG key for the product.

  4. Optional: From the SSL CA Cert list, select the SSL CA certificate for the product.

  5. Optional: From the SSL Client Cert list, select the SSL client certificate for the product.

  6. Optional: From the SSL Client Key list, select the SSL client key for the product.

  7. Optional: From the Sync Plan list, select an existing sync plan or click Create Sync Plan and create a sync plan for your product requirements.

  8. In the Description field, enter a description of the product.

  9. Click Save.

Creating a product by using Hammer CLI

Create a product to group repositories you add manually before you define repositories or upload packages.

Procedure

  • Create a product:

    $ hammer product create \
--name "My_Name" \
--organization-id My_Organization_ID

Creating repositories

Repositories hold synchronized or uploaded content for a product. Add repository definitions for Deb and Yum content, or enable Red Hat repositories or SUSE repositories, then synchronize or upload packages as required.

Adding RPM repositories by using orcharhino management UI

Add RPM repositories from an upstream URL to distribute Yum content to your hosts. Use Repo Discovery to import multiple repositories from one source.

The Products window in the orcharhino management UI also provides a Repo Discovery function that finds all repositories from a URL and you can select which ones to add to your product. For example, you can use the Repo Discovery to search https://download.postgresql.org/pub/repos/yum/16/redhat/ and list all repositories for different Oracle Linux versions and architectures. This helps you save time importing multiple repositories from a single source.

Prerequisites
Procedure

  1. In the orcharhino management UI, navigate to Content > Products and select the product that you want to use, and then click New Repository.

  2. In the Name field, enter a name for the repository. orcharhino automatically completes the Label field based on what you have entered for Name.

  3. Optional: In the Description field, enter a description for the repository.

  4. From the Type list, select yum as type of repository.

  5. Optional: From the Restrict to Architecture list, select an architecture. If you want to make the repository available to all hosts regardless of the architecture, ensure to select No restriction.

  6. Optional: From the Restrict to OS Version list, select the operating system version. If you want to make the repository available to all hosts regardless of the operating system version, ensure to select No restriction.

  7. Optional: In the Upstream URL field, enter the URL of the external repository to use as a source. orcharhino supports three protocols: http://, https://, and file://. If you are using a file:// repository, you have to place it under /var/lib/pulp/sync_imports/ directory.

    If you do not enter an upstream URL, you can manually upload packages.

  8. Optional: Check the Ignore SRPMs checkbox to exclude source RPM packages from being synchronized to orcharhino.

  9. Optional: Check the Ignore treeinfo checkbox if you receive the error Treeinfo file should have INI format. All files related to Kickstart will be missing from the repository if treeinfo files are skipped.

  10. Select the Verify SSL checkbox if you want to verify that the upstream repository’s SSL certificates are signed by a trusted CA.

  11. Optional: In the Upstream Username field, enter the user name for the upstream repository if required for authentication. Clear this field if the repository does not require authentication.

  12. Optional: In the Upstream Password field, enter the corresponding password for the upstream repository. Clear this field if the repository does not require authentication.

  13. Optional: In the Upstream Authentication Token field, provide the token of the upstream repository user for authentication. Leave this field empty if the repository does not require authentication.

  14. From the Download Policy list, select the type of synchronization orcharhino Server performs. For more information, see Download Policies Overview content-management.

  15. From the Mirroring Policy list, select the type of content synchronization orcharhino Server performs. For more information, see Mirroring Policies Overview content-management.

  16. Optional: In the Retain package versions field, enter the number of versions you want to retain per package. This field is available only if you are using the additive download policy.

  17. Optional: In the HTTP Proxy Policy field, select an HTTP proxy.

  18. From the Checksum list, select the checksum type for the repository.

  19. Optional: You can clear the Unprotected checkbox to require a subscription entitlement certificate for accessing this repository. By default, the repository is published through HTTP.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.

  20. Optional: From the GPG Key list, select the GPG key for the product.

  21. Optional: In the SSL CA Cert field, select the SSL CA Certificate for the repository.

  22. Optional: In the SSL Client cert field, select the SSL Client Certificate for the repository.

  23. Optional: In the SSL Client Key field, select the SSL Client Key for the repository.

  24. Click Save to create the repository.

Next steps

Adding RPM repositories by using Hammer CLI

Add RPM repositories from an upstream URL to distribute Yum content to your hosts.

Prerequisites
Procedure

  • Create a Yum repository:

    $ hammer repository create \
--arch "My_Architecture" \
--content-type "yum" \
--gpg-key-id My_GPG_Key_ID \
--name "My_Repository" \
--organization "My_Organization" \
--os-version "My_Operating_System_Version" \
--product "My_Product" \
--publish-via-http true \
--url My_Upstream_URL

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Next steps

Adding orcharhino Clients for Oracle Linux

orcharhino Clients are required to register hosts to orcharhino. You can add them to your orcharhino during the installation process or afterwards. For more information, see orcharhino Clients gen3 in the ATIX Service Portal.

Procedure

  1. Create a product named orcharhino Clients for Oracle Linux. For more information, see Creating a product by using orcharhino management UI.

  2. Create a repository for Oracle Linux 10. You can find the URLs of all orcharhino Clients in orcharhino Clients gen3 in the ATIX Service Portal. For more information, see Adding RPM repositories by using orcharhino management UI.

  3. Synchronize the orcharhino Clients for Oracle Linux to your orcharhino. For more information, see Synchronizing repositories by using orcharhino management UI.

  4. Create a content view to make the .rpm packages consumable by content hosts. For more information, see Creating a content view by using orcharhino management UI.

  5. Create an activation key to register content hosts to orcharhino. For more information, see Creating an activation key by using orcharhino management UI.

  6. Optional: Create a host group to simplify the process of creating hosts. For more information, see Creating a host group by using orcharhino management UI.

Uploading content to repositories

You can upload content to repositories to distribute content that you cannot synchronize from an upstream URL.

Uploading content to RPM repositories by using orcharhino management UI

You can upload individual RPM packages to a RPM repository to distribute Yum content that you cannot synchronize.

You must use Hammer CLI to upload source RPM packages. For more information, see Uploading content to custom rpm repositories by using Hammer CLI.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products.

  2. Click the name of the product.

  3. In the Repositories tab, click the name of the RPM repository.

  4. Under Upload Package, click Browse…​ and select the RPM you want to upload.

  5. Click Upload.

Verification

  • To view all RPMs in this repository, click the number next to Packages under Content Counts.

Troubleshooting

  • If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value. In the orcharhino management UI, navigate to Administer > Settings. The Sync task timeout setting is located on the Tasks tab.

Next steps

  • Add your RPM repository to a content view. For more information, see Creating a content view by using orcharhino management UI.

  • If your RPM is unprotected, hosts can consume its content by using the Published At URL.

    In the Default Organization View content view, the URL consists of your orcharhino Proxy FQDN, /pulp/content/, your organization label, /Library/custom/, your product label, /, your repository label, and a trailing /, for example, https://foreman.example.com/pulp/content/Example/Library/custom/my-software/my-app/.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Additional resources

Uploading content to RPM repositories by using Hammer CLI

You can upload individual RPM packages to a RPM repository to distribute Yum content that you cannot synchronize. Use Hammer CLI to upload source RPM packages.

Procedure

  • Upload an RPM package:

    $ hammer repository upload-content \
--id My_Repository_ID \
--path /path/to/example-package.rpm

  • Upload a source RPM package:

    $ hammer repository upload-content \
--content-type srpm \
--id My_Repository_ID \
--path /path/to/example-package.src.rpm
Verification

  • After the upload is complete, you can view information about a source RPM by using the commands hammer srpm list and hammer srpm info --id srpm_ID.

Troubleshooting

  • If the upload times out when uploading very large files on a slow network, raise the Sync task timeout setting value:

    $ hammer settings set --name foreman_tasks_sync_task_timeout --value seconds
Next steps

  • Add your RPM repository to a content view. For more information, see Creating a content view by using Hammer CLI.

  • If your RPM is unprotected, hosts can consume its content by using the Published At URL.

    In the Default Organization View content view, the URL consists of your orcharhino Proxy FQDN, /pulp/content/, your organization label, /Library/custom/, your product label, /, your repository label, and a trailing /, for example, https://foreman.example.com/pulp/content/Example/Library/custom/my-software/my-app/.

    You can consume content from orcharhino without registering your hosts to orcharhino and/or without using subscription-manager to consume content, for example, in containerized build pipelines. Any host that consumes content from orcharhino Server or orcharhino Proxy Servers is considered a managed host that requires a valid orcharhino subscription.
Additional resources

Uploading content to file type repositories by using orcharhino management UI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

  1. In the orcharhino management UI, navigate to Content > Products.

  2. Select a product by name.

  3. Select a file type repository by name.

  4. Click Browse to search and select the file you want to upload.

  5. Click Upload to upload the selected file to orcharhino Server.

  6. Visit the URL where the repository is published to see the file.

Additional resources

Uploading content to file type repositories by using Hammer CLI

If you cannot create a PULP_MANIFEST and synchronize your content from a local or remote repository to orcharhino, you can manually upload content to a file type repository.

Procedure

  • Upload files to your file type repository:

    $ hammer repository upload-content \
--id My_Repository_ID \
--organization-id My_Organization_ID \
--path My_Example_File

    The --path option can indicate a file, a directory of files, or a glob expression of files. Globs must be escaped by single or double quotes.

Additional resources

Repository definitions for client operating systems

Use these repository definitions when you create repositories in orcharhino to synchronize client operating system content from upstream sources.

Additional resources

Repository definitions for Oracle Linux on public yum servers

Upstream repositories for Oracle Linux include BaseOS, AppStream, and addons on yum.oracle.com, and the orcharhino Client for Oracle Linux.

Oracle adds packages to repositories for Oracle Linux and ULN without removing old versions. Content synchronization with the Content only mirroring policy might lead to out-of-memory issues on orcharhino Server.

You can mitigate this by setting the mirroring policy to Additive and the Retain package versions to either one or two. This means that each time orcharhino synchronizes content from Oracle, new packages are added and old packages are removed.

Note that this does not affect any published content views.
Table 1. Oracle Linux 10
Repository name Upstream URL

Oracle Linux 10 BaseOS

https://yum.oracle.com/repo/OracleLinux/OL10/baseos/latest/x86_64/

Oracle Linux 10 AppStream

https://yum.oracle.com/repo/OracleLinux/OL10/appstream/x86_64/

Oracle Linux 10 extras

https://yum.oracle.com/repo/OracleLinux/OL10/addons/x86_64/

orcharhino Client for Oracle Linux

see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://yum.oracle.com/RPM-GPG-KEY-oracle-ol9

Table 2. Oracle Linux 9
Repository name Upstream URL

Oracle Linux 9 BaseOS

https://yum.oracle.com/repo/OracleLinux/OL9/baseos/latest/x86_64/

Oracle Linux 9 AppStream

https://yum.oracle.com/repo/OracleLinux/OL9/appstream/x86_64/

Oracle Linux 9 extras

https://yum.oracle.com/repo/OracleLinux/OL9/addons/x86_64/

orcharhino Client for Oracle Linux

see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://yum.oracle.com/RPM-GPG-KEY-oracle-ol9

Table 3. Oracle Linux 8
Repository name Upstream URL

Oracle Linux 8 BaseOS

https://yum.oracle.com/repo/OracleLinux/OL8/baseos/latest/x86_64/

Oracle Linux 8 AppStream

https://yum.oracle.com/repo/OracleLinux/OL8/appstream/x86_64/

Oracle Linux 8 extras

https://yum.oracle.com/repo/OracleLinux/OL8/addons/x86_64/

orcharhino Client for Oracle Linux

see orcharhino Clients gen3 in the ATIX Service Portal

GPG key: https://yum.oracle.com/RPM-GPG-KEY-oracle-ol8

Repository definitions for Oracle Linux on ULN

Use these ULN channel labels and credentials when you create Oracle Linux repositories that synchronize content from Oracle Unbreakable Linux Network.

There are two main differences compared to generic Yum content:

  • The Upstream URL field consists of a protocol prefix uln:// and an ULN Channel Label, for example, ol7_x86_64_MySQL80_community. Combined, uln://ol7_x86_64_MySQL80_community is a valid upstream URL for a Yum repository.

  • Authentication against the repository through an Upstream Username and Upstream Password is mandatory. Use your single sign-on user name and token of your Oracle account to authenticate from orcharhino.

To obtain a list of available ULN channel labels, log in to Oracle Unbreakable Linux Network. Navigate to the channels tab and select an operating system release version and architecture. Copy the required ULN Channel Label from the list of available content.

Adding ULN repositories is different compared to Yum repositories for Oracle Linux, for example, https://yum.oracle.com/oracle-linux-9.html, which you can add as Yum-type content.

ATIX AG recommends that you limit the number of retained packages on orcharhino.

Oracle Unbreakable Linux Network (ULN) channel labels for Oracle Linux releases on x86_64. Combine each label with the uln:// prefix to form the Upstream URL for a Yum repository, for example uln://ol9_x86_64_baseos_latest. Authentication with an Upstream Username and Upstream Password is mandatory.

Oracle adds packages to repositories for Oracle Linux and ULN without removing old versions. Content synchronization with the Content only mirroring policy might lead to out-of-memory issues on orcharhino Server.

You can mitigate this by setting the mirroring policy to Additive and the Retain package versions to either one or two. This means that each time orcharhino synchronizes content from Oracle, new packages are added and old packages are removed.

Note that this does not affect any published content views.
Table 4. Oracle Linux 10
Repository Upstream URL

Addons

uln://ol10_x86_64_addons

AppStream

uln://ol10_x86_64_appstream

BaseOS latest

uln://ol10_x86_64_baseos_latest

Unbreakable Enterprise Kernel Release 8

uln://ol10_x86_64_UEKR8

kSplice

uln://ol10_x86_64_ksplice
Table 5. Oracle Linux 9
Repository Upstream URL

Addons

uln://ol9_x86_64_addons

AppStream

uln://ol9_x86_64_appstream

BaseOS latest

uln://ol9_x86_64_baseos_latest

Unbreakable Enterprise Kernel Release 7

uln://ol9_x86_64_UEKR7

kSplice

uln://ol9_x86_64_ksplice
Table 6. Oracle Linux 8
Repository Upstream URL

Addons

uln://ol8_x86_64_addons

AppStream

uln://ol8_x86_64_appstream

BaseOS latest

uln://ol8_x86_64_baseos_latest

Unbreakable Enterprise Kernel Release 6

uln://ol8_x86_64_UEKR6

kSplice

uln://ol8_x86_64_ksplice
Additional resources

GPG public keys for Oracle Linux

You can download the GPG public keys from oracle.com.

The text and illustrations on this page are licensed by ATIX AG under a Creative Commons Attribution Share Alike 4.0 International ("CC BY-SA 4.0") license. This page also contains text from the official Foreman documentation which uses the same license ("CC BY-SA 4.0").