katello 4.18.0 → 4.19.0.rc1

data/app/services/katello/candlepin/message_handler.rb

@@ -46,27 +46,9 @@ module Katello
         case subject
         when 'pool.created', 'pool.deleted'
           content['entityId']
-        when 'entitlement.created', 'entitlement.deleted'
-          content['referenceId']
         end
       end
 
-      def create_pool_on_host
-        return if self.subscription_facet.nil? || pool.nil?
-        old_host_ids = subscription_facet_host_ids
-        ::Katello::SubscriptionFacetPool.where(subscription_facet_id: self.subscription_facet.id,
-                                               pool_id: pool.id).first_or_create
-        pool.import_audit_record(old_host_ids)
-      end
-
-      def remove_pool_from_host
-        return if self.subscription_facet.nil? || pool.nil?
-        old_host_ids = subscription_facet_host_ids
-        ::Katello::SubscriptionFacetPool.where(subscription_facet_id: self.subscription_facet.id,
-                                               pool_id: pool.id).destroy_all
-        pool.import_audit_record(old_host_ids)
-      end
-
       def import_pool(index_hosts = true)
         if pool
           ::Katello::EventQueue.push_event(::Katello::Events::ImportPool::EVENT_TYPE, pool.id)
@@ -86,29 +68,6 @@ module Katello
           Rails.logger.info "Deleted Katello::Pool with cp_id=#{pool_id}"
         end
       end
-
-      def handle_content_access_mode_modified
-        # Ideally the target_name would be the Candlepin Owner key
-        # Since it's the displayName, and we don't update that after org creation, there could be a mismatch
-        # For now, find the Candlepin Owner displayName from this event, and tie it back to a Katello org based on owner key
-        owners = Katello::Resources::Candlepin::Owner.all
-        owner = owners.find { |o| o['displayName'] == target_name }
-
-        unless owner
-          fail("Candlepin Owner %s could not be found" % target_name)
-        end
-
-        org = ::Organization.find_by!(label: owner['key'])
-
-        Rails.logger.error "Received content_access_mode_modified event for org #{org.label}. This event is no longer supported."
-        org.simple_content_access?(cached: false)
-      end
-
-      private
-
-      def subscription_facet_host_ids
-        ::Katello::SubscriptionFacetPool.where(pool_id: pool_id).joins(:subscription_facet).pluck(:host_id)
-      end
     end
   end
 end

data/app/services/katello/content_unit_indexer.rb

@@ -39,18 +39,14 @@ module Katello
           end
 
           # Even after this bug (https://github.com/pulp/pulp_rpm/issues/2821) is fixed,
-          # it is possible to have duplicate errata asosociated to a repo.
+          # it is possible to have duplicate errata associated to a repo.
           if @content_type.label == 'erratum'
             to_insert.uniq! { |row| row["pulp_id"] || row[:pulp_id] }
           end
 
           next if to_insert.empty?
           insert_timestamps(to_insert)
-          if @content_type.mutable
-            @model_class.upsert_all(to_insert, unique_by: :pulp_id)
-          else
-            @model_class.insert_all(to_insert, unique_by: :pulp_id)
-          end
+          upsert_with_deadlock_retry(to_insert)
         end
 
         import_associations(units) if @repository
@@ -107,11 +103,13 @@ module Katello
       def push(unit)
         if @service_class.backend_unit_identifier
           pulp_href = unit.dig(@service_class.backend_unit_identifier)
+          pulp_prn = unit['prn']
         else
           pulp_href = nil
+          pulp_prn = nil
         end
         unit_id = unit[@service_class.unit_identifier]
-        @values[unit_id] = pulp_href
+        @values[unit_id] = { href: pulp_href, prn: pulp_prn }
       end
 
       def db_values
@@ -121,7 +119,10 @@ module Katello
         @final_values = ::Katello::ContentUnitIndexer.pulp_id_to_id_map(@content_type, @values.keys).map do |pulp_id, katello_id|
           #:repository_id => X, :erratum_id => y
           row = {:repository_id => @repository.id, @content_type.model_class.unit_id_field => katello_id}
-          row[pulp_href_association_name] = @values[pulp_id] if pulp_href_association_name
+          if pulp_href_association_name
+            row[pulp_href_association_name] = @values[pulp_id][:href]
+            row[pulp_prn_association_name] = @values[pulp_id][:prn] if pulp_prn_association_name
+          end
           row
         end
         ContentUnitIndexer.insert_timestamps(@content_type.model_class, @final_values)
@@ -131,6 +132,10 @@ module Katello
       def pulp_href_association_name
         'erratum_pulp3_href' if @content_type.label == 'erratum'
       end
+
+      def pulp_prn_association_name
+        'erratum_prn' if @content_type.label == 'erratum'
+      end
     end
 
     def insert_timestamps(units)
@@ -154,17 +159,19 @@ module Katello
         @service_class.supports_id_fetch?
     end
 
-    def sync_repository_associations(assocication_tracker, additive: false)
+    def sync_repository_associations(association_tracker, additive: false)
       unless additive
         ActiveRecord::Base.connection.uncached do
           repo_associations_to_destroy = @model_class.repository_association_class.where(repository_id: @repository.id).where.
-            not(@model_class.unit_id_field => assocication_tracker.unit_ids)
+            not(@model_class.unit_id_field => association_tracker.unit_ids)
           clean_filter_rules(repo_associations_to_destroy) if repo_associations_to_destroy.present? && [::Katello::ModuleStream, ::Katello::Erratum, ::Katello::PackageGroup].include?(@model_class)
           repo_associations_to_destroy.destroy_all
         end
       end
-      return if assocication_tracker.db_values.empty?
-      @model_class.repository_association_class.upsert_all(assocication_tracker.db_values, :unique_by => association_class_uniqiness_attributes)
+      return if association_tracker.db_values.empty?
+      @model_class.repository_association_class.upsert_all(association_tracker.db_values, :unique_by => association_class_uniqueness_attributes)
+
+      clean_duplicate_docker_tags if @model_class == Katello::DockerTag
     end
 
     def clean_filter_rules(repo_associations_to_destroy)
@@ -190,7 +197,46 @@ module Katello
       end
     end
 
-    def association_class_uniqiness_attributes
+    def clean_duplicate_docker_tags
+      # Deduplicate docker tags by name, keeping the one with the newest updated_at
+      deduplicated_tags = @repository.docker_tags.group_by(&:name).map { |_name, tags| tags.max_by(&:updated_at) }
+      return if deduplicated_tags.empty?
+      valid_names = deduplicated_tags.map(&:name)
+      valid_taggable_ids = deduplicated_tags.map(&:id)
+
+      # Remove duplicate tags with same names as valid tags, keeping only the newest ones
+      # Lookup by docker_manifest is important; docker_tags usually only contains the newest tag.
+      tag_ids_to_remove = @repository.docker_manifests
+                            .joins(:docker_tags)
+                            .where(katello_docker_tags: { name: valid_names })
+                            .where.not(katello_docker_tags: {id: valid_taggable_ids})
+                            .pluck('katello_docker_tags.id')
+
+      return if tag_ids_to_remove.empty?
+      Rails.logger.info("Removing #{tag_ids_to_remove.count} duplicate docker tag associations in repository '#{@repository.label}'")
+      Katello::DockerTag.where(id: tag_ids_to_remove).destroy_all
+    end
+
+    def upsert_with_deadlock_retry(to_insert)
+      retry_count = 0
+      begin
+        if @content_type.mutable
+          @model_class.upsert_all(to_insert, unique_by: :pulp_id)
+        else
+          @model_class.insert_all(to_insert, unique_by: :pulp_id)
+        end
+      rescue ActiveRecord::Deadlocked
+        retry_count += 1
+        if retry_count <= 3
+          sleep(rand(1..5))
+          retry
+        else
+          raise
+        end
+      end
+    end
+
+    def association_class_uniqueness_attributes
       columns = [@model_class.unit_id_field, 'repository_id']
       found = ActiveRecord::Base.connection.indexes(@model_class.repository_association_class.table_name).find do |index|
         index.columns.sort == columns.sort

data/app/services/katello/product_content_finder.rb

@@ -22,13 +22,22 @@ module Katello
 
       roots = Katello::RootRepository.where(:product_id => considered_products).subscribable
       roots = roots.in_content_view_version(versions).distinct if versions.present?
-      content_ids = roots.where.not(:content_id => nil).pluck(:content_id)
-      structured_apt_roots = roots.where(:content_id => nil)
-      if structured_apt_roots.any?
-        deb_repos_query = Katello::Repository.where(root: structured_apt_roots)
-        environment = consumable.respond_to?(:environment) ? consumable.environment : consumable.content_view_environments.select(:environment_id).map(&:environment_id)
-        deb_repos = match_environment ? deb_repos_query.where(content_view_version: versions, environment: environment) : deb_repos_query.where(:library_instance_id => nil)
-        content_ids += deb_repos.pluck(:content_id)
+      content_ids = roots.where.not(:content_type => ::Katello::Repository::DEB_TYPE).pluck(:content_id)
+      deb_roots = roots.where(:content_type => ::Katello::Repository::DEB_TYPE)
+      if deb_roots.any?
+        # deb? roots need to be considered separately because they do not have content_ids on the root!
+        deb_repos_query = Katello::Repository.where(root: deb_roots)
+        deb_repos_library = Set.new
+        deb_repos_batch = []
+        if match_environment
+          consumable.content_view_environments.each do |cve|
+            deb_repos_batch = deb_repos_query.where("content_view_version_id = ? AND environment_id = ?", cve.content_view_version_id, cve.environment_id).where.not(library_instance_id: deb_repos_library.to_a)
+            deb_repos_library.merge(deb_repos_batch.pluck(:library_instance_id))
+            content_ids += deb_repos_batch.pluck(:content_id)
+          end
+        else
+          content_ids += deb_repos_query.where(:library_instance_id => nil).pluck(:content_id)
+        end
       end
 
       consumable.organization.enabled_product_content_for(content_ids)

data/app/services/katello/pulp3/alternate_content_source.rb

@@ -81,7 +81,7 @@ module Katello
       def create_remote
         if smart_proxy_acs&.remote_href.nil?
           response = super
-          smart_proxy_acs.update!(remote_href: response.pulp_href)
+          smart_proxy_acs.update!(remote_href: response.pulp_href, remote_prn: response.prn)
         end
       end
 
@@ -106,7 +106,7 @@ module Katello
           end
           response = api.alternate_content_source_api.create(name: generate_backend_object_name, paths: paths.sort,
                                                              remote: smart_proxy_acs.remote_href)
-          smart_proxy_acs.update!(alternate_content_source_href: response.pulp_href)
+          smart_proxy_acs.update!(alternate_content_source_href: response.pulp_href, alternate_content_source_prn: response.prn)
           return response
         end
       end

data/app/services/katello/pulp3/ansible_collection.rb

@@ -22,6 +22,7 @@ module Katello
       def self.generate_model_row(unit)
         {
           pulp_id: unit['pulp_href'],
+          pulp_prn: unit['prn'],
           checksum: unit['sha256'],
           namespace: unit['namespace'],
           version: unit['version'],

data/app/services/katello/pulp3/api/content_guard.rb

@@ -31,21 +31,21 @@ module Katello
         def refresh
           found = list(name: default_name).results.first
           if found && found.ca_certificate != ca_cert
-            partial_update(found.pulp_href)
+            partial_update(found.pulp_href)  # Still use pulp_href for API calls
           else
             found = create
           end
-          persist_if_needed(found.pulp_href)
+          persist_if_needed(found)
         end
 
-        def persist_if_needed(href)
+        def persist_if_needed(content_guard_obj)
           return if self.smart_proxy.pulp_mirror?
           Katello::Util::Support.active_record_retry do
             found = Katello::Pulp3::ContentGuard.find_by(:name => default_name)
             if found
-              found.update(pulp_href: href)
+              found.update(pulp_href: content_guard_obj.pulp_href, pulp_prn: content_guard_obj.prn)
             else
-              Katello::Pulp3::ContentGuard.create(name: default_name, pulp_href: href)
+              Katello::Pulp3::ContentGuard.create(name: default_name, pulp_href: content_guard_obj.pulp_href, pulp_prn: content_guard_obj.prn)
             end
           end
         end

data/app/services/katello/pulp3/api/core.rb

@@ -64,6 +64,10 @@ module Katello
           PulpcoreClient::RepositoriesApi.new(core_api_client)
         end
 
+        def core_repository_versions_api
+          PulpcoreClient::RepositoryVersionsApi.new(core_api_client)
+        end
+
         def repositories_api
           repository_type.repositories_api_class.new(api_client)
         end
@@ -237,6 +241,12 @@ module Katello
           end
         end
 
+        def core_repository_versions_list_all(options = {})
+          self.class.fetch_from_list do |page_opts|
+            core_repository_versions_api.list(page_opts.merge(options))
+          end
+        end
+
         def list_all(options = {})
           self.class.fetch_from_list do |page_opts|
             repositories_api.list(page_opts.merge(options))

data/app/services/katello/pulp3/content_view_version/export.rb

@@ -133,12 +133,27 @@ module Katello
           MetadataGenerator.new(export_service: self).generate!
         end
 
-        def self.find_generated_export_view(destination_server:, organization:, name:, generated_for:, create_by_default: false)
-          name += "-#{destination_server}" unless destination_server.blank?
-          select_method = create_by_default ? :first_or_create : :first
-          ::Katello::ContentView.where(name: name,
-                                       organization: organization,
-                                       generated_for: generated_for).send(select_method)
+        def self.find_export_view(name:, organization:, generated_for:, destination_server: nil)
+          full_name = destination_server.blank? ? name : "#{name}-#{destination_server}"
+
+          ::Katello::ContentView.where(
+            name: full_name,
+            organization: organization,
+            generated_for: generated_for
+          ).first
+        end
+
+        # Find or create export view
+        def self.find_or_create_export_view(name:, organization:, generated_for:, destination_server: nil)
+          find_export_view(name: name, organization: organization, generated_for: generated_for, destination_server: destination_server) ||
+            begin
+              full_name = destination_server.blank? ? name : "#{name}-#{destination_server}"
+              ::Katello::ContentView.create!(
+                name: full_name,
+                organization: organization,
+                generated_for: generated_for
+              )
+            end
         end
 
         def format
@@ -151,13 +166,13 @@ module Katello
           when UNDEFINED
             fail ::Katello::Errors::InvalidExportFormat, _("Export format must be specified for library exports.")
           when IMPORTABLE
-            return find_generated_export_view(create_by_default: true,
+            return find_or_create_export_view(
                                      destination_server: destination_server,
                                      organization: organization,
                                      name: ::Katello::ContentView::EXPORT_LIBRARY,
                                      generated_for: :library_export)
           when SYNCABLE
-            return find_generated_export_view(create_by_default: true,
+            return find_or_create_export_view(
                                      destination_server: destination_server,
                                      organization: organization,
                                      name: "#{::Katello::ContentView::EXPORT_LIBRARY}-SYNCABLE",
@@ -172,10 +187,10 @@ module Katello
           when UNDEFINED
             fail ::Katello::Errors::InvalidExportFormat, _("Export format must be specified for non-incremental repository exports.")
           when IMPORTABLE
-            return find_generated_export_view(create_by_default: true, destination_server: nil, organization: repository.organization,
+            return find_or_create_export_view(destination_server: nil, organization: repository.organization,
               name: "Export-#{repository.label}-#{repository.library_instance_or_self.id}", generated_for: :repository_export)
           when SYNCABLE
-            return find_generated_export_view(create_by_default: true, destination_server: nil, organization: repository.organization,
+            return find_or_create_export_view(destination_server: nil, organization: repository.organization,
               name: "Export-SYNCABLE-#{repository.label}-#{repository.library_instance_or_self.id}", generated_for: :repository_export_syncable)
           else
             fail ::Katello::Errors::InvalidExportFormat, _("Unknown repository export format '%s'.") % format

data/app/services/katello/pulp3/deb.rb

@@ -31,6 +31,7 @@ module Katello
         unit = unit.try(:with_indifferent_access)
         return {
           pulp_id: unit[unit_identifier],
+          pulp_prn: unit[:prn],
           checksum: unit[:sha256],
           filename: unit[:relative_path],
           name: unit[:package],

data/app/services/katello/pulp3/docker_manifest.rb

@@ -27,6 +27,7 @@ module Katello
           schema_version: unit['schema_version'],
           digest: unit['digest'],
           pulp_id: unit[unit_identifier],
+          pulp_prn: unit['prn'],
           annotations: unit['annotations'],
           labels: unit['labels'],
           is_bootable: unit['is_bootable'] || unit['type'] == 'bootable',

data/app/services/katello/pulp3/docker_manifest_list.rb

@@ -29,6 +29,7 @@ module Katello
           schema_version: unit['schema_version'],
           digest: unit['digest'],
           pulp_id: unit[unit_identifier],
+          pulp_prn: unit['prn'],
           annotations: unit['annotations'],
           labels: unit['labels'],
           is_bootable: unit['is_bootable'] || unit['type'] == 'bootable',

data/app/services/katello/pulp3/docker_tag.rb

@@ -18,6 +18,7 @@ module Katello
       def self.generate_model_row(unit)
         row = {
           pulp_id: unit[unit_identifier],
+          pulp_prn: unit['prn'],
           name: unit['name'],
         }
 

data/app/services/katello/pulp3/file_unit.rb

@@ -25,6 +25,7 @@ module Katello
 
         {
           pulp_id: unit[unit_identifier],
+          pulp_prn: unit['prn'],
           name: filename,
           path: unit['relative_path'],
           checksum: unit['sha256'],

data/app/services/katello/pulp3/generic_content_unit.rb

@@ -20,6 +20,7 @@ module Katello
       def self.generate_model_row(unit, content_type)
         {
           pulp_id: unit['pulp_href'],
+          pulp_prn: unit['prn'],
           name: content_type&.model_name&.call(unit),
           version: content_type&.model_version&.call(unit),
           filename: content_type&.model_filename&.call(unit),

data/app/services/katello/pulp3/module_stream.rb

@@ -68,6 +68,7 @@ module Katello
         shared_attributes = unit.keys & Katello::ModuleStream.column_names
         to_return = unit.select { |key, _v| shared_attributes.include?(key) }
         to_return['pulp_id'] = unit['pulp_href']
+        to_return['pulp_prn'] = unit['prn']
         to_return[:created_at] = DateTime.now
         to_return[:updated_at] = DateTime.now
         to_return

data/app/services/katello/pulp3/package_group.rb

@@ -58,6 +58,7 @@ module Katello
       def self.generate_model_row(unit)
         custom_json = {}
         custom_json['pulp_id'] = unit['pulp_href']
+        custom_json['pulp_prn'] = unit['prn']
         custom_json['name'] = unit['name']
         custom_json['description'] = unit['description']
         custom_json

data/app/services/katello/pulp3/repository/apt.rb

@@ -7,6 +7,15 @@ module Katello
         UNIT_LIMIT = 10_000
         SIGNING_SERVICE_NAME = 'katello_deb_sign'.freeze
 
+        def pulp_primary_api
+          # Sometimes we need to make sure we are talking to the pulp primary and not a smart proxy!
+          if smart_proxy.pulp_primary?
+            api
+          else
+            self.class.instance_for_type(repo, ::SmartProxy.pulp_primary).api
+          end
+        end
+
         def initialize_empty
           # For every empty APT library instance repository we must add at least a release component to
           # ensure we have a publishable repo with consumable metadata. Otherwise smart proxy syncs will
@@ -15,6 +24,25 @@ module Katello
           api.content_release_components_api.create(opts)
         end
 
+        def pulp_components
+          return [] if repo.version_href.blank?
+          return ["all"] if version_missing_structure_content?
+          pulp_primary_api.content_release_components_api.list({:repository_version => repo.version_href}).results.map { |x| x.plain_component }.uniq
+        end
+
+        def sanitize_pulp_distribution(distribution)
+          return "flat-repo" if distribution == "/"
+          return distribution.chomp("/") if distribution&.end_with?("/")
+          # Only needed for repository versions created with pulp_deb <= 3.6
+          distribution
+        end
+
+        def pulp_distributions
+          return [] if repo.version_href.blank?
+          return ["default"] if version_missing_structure_content?
+          pulp_primary_api.content_release_components_api.list({:repository_version => repo.version_href}).results.map { |x| sanitize_pulp_distribution(x.distribution) }.uniq
+        end
+
         def remote_options
           deb_remote_options = {
             policy: root.download_policy,
@@ -39,13 +67,7 @@ module Katello
         end
 
         def mirror_remote_options
-          distributions = if repo.deb_using_structured_apt? && !version_missing_structure_content?
-                            repo.deb_pulp_distributions.join(' ')
-                          else
-                            'default'
-                          end
-
-          super.merge({distributions: distributions})
+          super.merge({distributions: pulp_distributions.join(' ')})
         end
 
         def version_missing_structure_content?
@@ -54,9 +76,7 @@ module Katello
           # It may also affect filtered CV versions created with very old Katello versions.
           # This method can identify such cases, so that we may fall back to simple publishing.
           return false if repo.version_href.blank?
-          # We cannot just use api here, because this is sometimes the proxy api, and we always want to talk to the primary!
-          api_primary = self.class.instance_for_type(repo, ::SmartProxy.pulp_primary).api
-          version = api_primary.repository_versions_api.read(repo.version_href)
+          version = pulp_primary_api.repository_versions_api.read(repo.version_href)
           apt_content_types = version&.content_summary&.present&.keys
           return apt_content_types.include?('deb.package') && !apt_content_types.include?('deb.package_release_component')
         end
@@ -67,9 +87,6 @@ module Katello
           if version_missing_structure_content?
             popts.merge!({ structured: false })
             popts.merge!({ simple: true })
-          else
-            popts.merge!({ structured: true })
-            popts.merge!({ simple: true }) unless repository.deb_using_structured_apt?
           end
           popts[:signing_service] = ss[0].pulp_href if ss && ss.length == 1
           popts

data/app/services/katello/pulp3/repository.rb

@@ -25,6 +25,21 @@ module Katello
         href.include?('/publications/')
       end
 
+      # Build a PRN from a Pulp href
+      # @param href [String] Pulp href (e.g., "/pulp/api/v3/contentguards/certguard/rhsm/uuid/")
+      # @param pulp_plugin [String] Pulp plugin name (e.g., "certguard", "container", "rpm")
+      # @param pulp_model [String] Pulp model name (e.g., "rhsmcertguard", "containerrepository", "rpmrepository")
+      # @return [String, nil] PRN string (e.g., "prn:certguard.rhsmcertguard:uuid") or nil if href doesn't match expected format
+      def self.build_prn(href, pulp_plugin, pulp_model)
+        return nil unless href
+
+        # Extract UUID from href (last non-empty path segment)
+        uuid = href.split('/').reject(&:empty?).last
+        return nil unless uuid
+
+        "prn:#{pulp_plugin}.#{pulp_model}:#{uuid}"
+      end
+
       def partial_repo_path
         fail NotImplementedError
       end
@@ -70,14 +85,14 @@ module Katello
 
       def create_remote
         response = super
-        repo.update!(:remote_href => response.pulp_href)
+        repo.update!(:remote_href => response.pulp_href, :remote_prn => response.prn)
       end
 
       def update_remote
         href = repo.remote_href
         if remote_options[:url].blank?
           if href
-            repo.update(remote_href: nil)
+            repo.update(remote_href: nil, remote_prn: nil)
             delete_remote(href: href)
           end
         else
@@ -109,7 +124,10 @@ module Katello
       end
 
       def self.instance_for_type(repo, smart_proxy)
-        Katello::RepositoryTypeManager.enabled_repository_types[repo.root.content_type].pulp3_service_class.new(repo, smart_proxy)
+        repo_types = Katello::RepositoryTypeManager.enabled_repository_types(false)
+        # Populate cache on first call if empty
+        repo_types = Katello::RepositoryTypeManager.enabled_repository_types if repo_types.empty?
+        repo_types[repo.root.content_type].pulp3_service_class.new(repo, smart_proxy)
       end
 
       def should_purge_empty_contents?
@@ -157,7 +175,8 @@ module Katello
 
       def distribution_needs_update?
         if distribution_reference
-          expected = secure_distribution_options(relative_path).except(:name).compact
+          # FIXME: Workaround for https://github.com/pulp/pulpcore/issues/7004
+          expected = secure_distribution_options(relative_path).except(:name, :content_guard_prn).compact
           actual = get_distribution&.to_hash || {}
           expected != actual.slice(*expected.keys)
         elsif repo.environment
@@ -180,7 +199,8 @@ module Katello
           RepositoryReference.where(
             root_repository_id: repo.root_id,
             content_view_id: repo.content_view.id,
-            repository_href: response.pulp_href).create!
+            repository_href: response.pulp_href,
+            repository_prn: response.prn).create!
           response
         end
       end
@@ -279,7 +299,9 @@ module Katello
       end
 
       def create_distribution(path)
-        distribution_data = api.distribution_class.new(secure_distribution_options(path))
+        options = secure_distribution_options(path)
+        options.delete(:content_guard_prn) # Remove PRN field before sending to Pulp
+        distribution_data = api.distribution_class.new(options)
         unless ::Katello::RepositoryTypeManager.find(repo.content_type).pulp3_skip_publication
           fail_missing_publication(distribution_data.publication)
         end
@@ -300,7 +322,8 @@ module Katello
           unless ::Katello::RepositoryTypeManager.find(repo.content_type).pulp3_skip_publication
             fail_missing_publication(options[:publication])
           end
-          distribution_reference.update(:content_guard_href => options[:content_guard])
+          content_guard_prn = options.delete(:content_guard_prn) # Extract PRN and remove from options
+          distribution_reference.update(:content_guard_href => options[:content_guard], :content_guard_prn => content_guard_prn)
           api.distributions_api.partial_update(distribution_reference.href, options)
         end
       end
@@ -368,7 +391,23 @@ module Katello
       def save_distribution_references(hrefs)
         hrefs.each do |href|
           pulp3_distribution_data = api.get_distribution(href)
-          path, content_guard_href = pulp3_distribution_data&.base_path, pulp3_distribution_data&.content_guard
+          path = pulp3_distribution_data&.base_path
+          content_guard_href = pulp3_distribution_data&.content_guard
+
+          # FIXME: Workaround for ansible distributions not returning PRN
+          # Remove once https://github.com/pulp/pulp_ansible/issues/2320 is fixed
+          if repo.ansible_collection?
+            prn = self.class.build_prn(href, 'ansible', 'ansibledistribution')
+          else
+            prn = pulp3_distribution_data&.prn
+          end
+
+          # Build content_guard PRN from href if content_guard exists
+          # FIXME: Workaround for https://github.com/pulp/pulpcore/issues/7004
+          content_guard_prn = if content_guard_href&.include?('/contentguards/certguard/rhsm/')
+                                self.class.build_prn(content_guard_href, 'certguard', 'rhsmcertguard')
+                              end
+
           if distribution_reference
             found_distribution = read_distribution(distribution_reference.href)
             unless found_distribution
@@ -377,7 +416,14 @@ module Katello
           end
           unless distribution_reference
             # Ensure that duplicates won't be created in the case of a race condition
-            DistributionReference.where(path: path, href: href, repository_id: repo.id, content_guard_href: content_guard_href).first_or_create!
+            DistributionReference.where(
+              path: path,
+              href: href,
+              prn: prn,
+              repository_id: repo.id,
+              content_guard_href: content_guard_href,
+              content_guard_prn: content_guard_prn
+            ).first_or_create!
           end
         end
       end
@@ -444,8 +490,11 @@ module Katello
         secured_distribution_options = {}
         if root.unprotected
           secured_distribution_options[:content_guard] = nil
+          secured_distribution_options[:content_guard_prn] = nil
         else
-          secured_distribution_options[:content_guard] = ::Katello::Pulp3::ContentGuard.first.pulp_href
+          content_guard = ::Katello::Pulp3::ContentGuard.first
+          secured_distribution_options[:content_guard] = content_guard.pulp_href
+          secured_distribution_options[:content_guard_prn] = content_guard.pulp_prn
         end
         secured_distribution_options.merge!(distribution_options(path))
       end