AlmaLinux 9 to Rocky Linux from CIQ

Overview

migrate2rlc.sh converts AlmaLinux 9 systems to Rocky Linux from CIQ (RLC) using the CIQ Depot. AlmaLinux 9 follows the standard EL9 migration path with two additional considerations: FIPS mode must be disabled before migration, and the openssl-fips-provider-so package must be removed to avoid file conflicts with Rocky's openssl-fips-provider.

The script auto-detects AlmaLinux 9 and handles these issues automatically.

Prerequisites

• AlmaLinux 9.x (any minor version) with internet access
• Root or sudo privileges
• CIQ Depot credentials (username and token)
• At least 2 GB free disk space
• FIPS mode disabled (if currently enabled)
• A maintenance window (reboot required)
• Backups of any critical data

Migration Command

./migrate2rlc.sh -r -t rlc-pro -u <depot-username> -p <depot-token>

Supported tiers: rlc-pro, rlc-plus, rlc-96-lts

The -r flag triggers an automatic reboot. Omit it to reboot manually.

What Happens During Migration

1. Pre-flight checks: validates system, disk space, third-party repo detection
2. FIPS check: verifies FIPS is disabled, exits with guidance if enabled
3. openssl-fips-provider-so removal: prevents file conflict during package swap
4. Third-party repo handling: disables non-base repos temporarily
5. Package swap: replaces almalinux-release with Rocky equivalents
6. Depot enrollment: installs depot CLI, authenticates, enables tier product
7. distro-sync: synchronizes all packages to RLC repository versions
8. Release package install: installs rlc-pro-release (Pro tier on EL9)
9. Post-migration update: CIQ kernel install, service verification, summary
10. Reboot: boots into Rocky kernel with CIQ packages

AlmaLinux 9 Specific Notes

FIPS Mode Must Be Disabled

If AlmaLinux 9 has FIPS mode enabled, the migration will fail due to cryptographic policy conflicts during the package swap. Check status:

fips-mode-setup --check

If enabled, disable before migration:

fips-mode-setup --disable
reboot

Run migrate2rlc.sh after the system comes back up. FIPS can be re-enabled on the RLC system after migration if needed.

openssl-fips-provider-so Conflict

AlmaLinux 9 ships openssl-fips-provider-so, which conflicts with Rocky's openssl-fips-provider package. The two packages provide the same shared object file at the same path, causing a file conflict during the pre-migration dnf update.

The script automatically removes openssl-fips-provider-so before the update step. If running a manual migration or troubleshooting a failed attempt, remove it explicitly:

dnf remove openssl-fips-provider-so

This does not affect OpenSSL functionality. Rocky's openssl-fips-provider replaces it during distro-sync.

rlc-pro-release Package

On EL9, the rlc-pro-release package is available and installed automatically for the Pro tier. This package controls the branding in /etc/redhat-release and /etc/os-release. Do not manually edit these files, as the RPM owns their content.

For Plus tier on EL9, no tier-specific release package exists. For LTS tier, rlc-lts96-release is installed instead.

Standard Package Swap

The migration replaces AlmaLinux packages with Rocky counterparts:

• almalinux-release -> rocky-release
• almalinux-repos -> Rocky repo configuration
• almalinux-gpg-keys -> ciq-rocky-gpg-keys

No special kernel handling or GRUB repair is needed. AlmaLinux 9 uses the standard RHEL-compatible kernel, which is cleanly replaced by the CIQ kernel during distro-sync.

Third-Party Repo Detection

Dynamic pattern-based detection identifies all third-party repositories. They are disabled during migration and re-enabled afterward. No hardcoded repo names are used.

Post-Migration Verification

After reboot, confirm the migration:

cat /etc/os-release
rpm -q rocky-release rlc-pro-release ciq-rocky-gpg-keys
depot list
uname -r

The kernel should show a CIQ build suffix. Run the verification script for a full check:

./verify_migration.sh

Tier Changes

To switch tiers after initial migration:

./migrate2rlc.sh -r -t rlc-plus -u <depot-username> -p <depot-token>

The script detects the existing RLC installation and performs a tier change. All six permutations are supported. On EL9, the tier-specific release package (e.g., rlc-pro-release) is swapped or installed as appropriate.

Troubleshooting

openssl file conflict during migration

If dnf reports a file conflict between openssl-fips-provider-so and openssl-fips-provider, the automatic removal did not complete. Remove manually with dnf remove openssl-fips-provider-so and retry.

FIPS-related errors

If the migration exits with crypto policy errors, confirm FIPS is fully disabled: fips-mode-setup --check. A reboot is required after disabling.

AlmaLinux packages remain after migration

Check with rpm -qa | grep -i almalinux. Remove residual packages with dnf remove <package> and run dnf distro-sync.

Third-party repos still disabled

Check /etc/yum.repos.d/ for .disabled suffixes. Re-enable manually if the migration was interrupted before the repo restoration step.

Services not starting after reboot

Check service logs with journalctl -u <service>. The post-reboot recovery service monitors and restarts key services automatically.

DISCLAIMER

The migrate2rlc script and playbook are provided "as is" without warranty of any kind, express or implied. Use of these tools is entirely at your own risk. CIQ, Inc. assumes no responsibility or liability for any data loss, system downtime, service disruption, or other damage resulting from the use or misuse of these tools. It is the user's responsibility to ensure adequate backups and testing in a non-production environment before performing any migration on production systems.