Skip to Content
Bash Script GuidesOracle Linux 9 to Rocky Linux from CIQ

Oracle Linux 9 to Rocky Linux from CIQ

Overview

migrate2rlc.sh converts Oracle Linux 9 systems to Rocky Linux from CIQ (RLC) using the CIQ Depot. Like OL8, Oracle Linux 9 requires UEK kernel force-removal, Oracle repo cleanup, and GRUB boot entry repair. Additionally, OL9 may have FIPS mode enabled, which must be disabled before migration.

The script auto-detects Oracle Linux 9 and applies all OL-specific handlers automatically.

Prerequisites

  • Oracle Linux 9.x (any minor version) with internet access
  • Root or sudo privileges
  • CIQ Depot credentials (username and token)
  • At least 2 GB free disk space
  • FIPS mode disabled (if currently enabled)
  • A maintenance window (reboot required)
  • Backups of any critical data

Migration Command

./migrate2rlc.sh -r -t rlc-pro -u <depot-username> -p <depot-token>

Supported tiers: rlc-pro, rlc-plus, rlc-96-lts

The -r flag triggers an automatic reboot. Omit it to reboot manually.

What Happens During Migration

  1. Pre-flight checks: validates system, disk space, third-party repo detection
  2. FIPS check: verifies FIPS is disabled, exits with guidance if enabled
  3. Edge case detection: identifies Oracle-specific packages and configs
  4. UEK kernel removal: force-removes UEK packages via rpm --nodeps
  5. Oracle repo cleanup: disables or removes all ol9_* repositories
  6. Package swap: replaces oraclelinux-release with Rocky equivalents
  7. Depot enrollment: installs depot CLI, authenticates, enables tier product
  8. distro-sync: synchronizes all packages to RLC repository versions
  9. Release package install: installs rlc-pro-release (EL9 Pro tier only)
  10. GRUB repair: updates saved_entry to Rocky kernel BLS entry
  11. Post-migration update: CIQ kernel install, service verification, summary
  12. Reboot: boots into Rocky kernel with CIQ packages

Oracle Linux 9 Specific Notes

FIPS Mode Must Be Disabled

If Oracle Linux 9 has FIPS mode enabled, the migration will fail due to cryptographic policy conflicts during the package swap. Check FIPS status:

fips-mode-setup --check

If enabled, disable it before running the migration:

fips-mode-setup --disable
reboot

Then run migrate2rlc.sh after the system comes back up.

UEK Kernel Force-Removal

Same as OL8: Oracle's UEK kernel is removed via rpm -e --nodeps because its dependency chains prevent clean dnf removal. The Rocky/CIQ kernel replaces it during distro-sync.

Oracle Repository Handling

The script detects and disables all Oracle-specific repositories:

  • ol9_baseos_latest, ol9_appstream
  • ol9_UELN
  • ol9_developer, ol9_developer_EPEL
  • ol9_addons

Third-party repos are temporarily disabled during migration and restored afterward.

GRUB saved_entry Fix

After UEK removal, fix_grub_default() updates the GRUB environment:

  1. Reads saved_entry from /boot/grub2/grubenv
  2. Identifies the Rocky kernel BLS entry ID ({machine-id}-{kernel-version})
  3. Writes the corrected saved_entry
  4. Removes stale UEK BLS entries from /boot/loader/entries/
  5. Regenerates grub.cfg

This prevents boot failure caused by GRUB referencing a removed UEK entry.

rlc-pro-release Package

On EL9, the rlc-pro-release package is available and installed automatically when migrating to the Pro tier. This package sets the correct branding in /etc/redhat-release and /etc/os-release. Do not manually edit these files after migration, as the RPM owns them.

For Plus tier, no tier-specific release package exists on EL9. For LTS tier, rlc-lts96-release is installed instead.

openssl-fips-provider Conflict

On OL9, the openssl-fips-provider-so package may conflict with Rocky's openssl-fips-provider during the pre-migration dnf update. The script automatically removes openssl-fips-provider-so before the update to avoid file conflicts.

Post-Migration Verification

After reboot, confirm the migration:

cat /etc/os-release
rpm -q rocky-release rlc-pro-release ciq-rocky-gpg-keys
depot list
uname -r

The kernel should show a CIQ build suffix. Run the verification script for a full check:

./verify_migration.sh

Tier Changes

To switch tiers after initial migration:

./migrate2rlc.sh -r -t rlc-plus -u <depot-username> -p <depot-token>

The script detects the existing RLC installation and performs a tier change. All six tier permutations are supported (Pro, Plus, LTS in any combination). On EL9, the tier-specific release package is swapped automatically.

Troubleshooting

Boot failure after migration

Check /boot/grub2/grubenv from rescue mode. The saved_entry must reference a valid BLS entry in /boot/loader/entries/. Remove any stale UEK entries.

If the migration fails with crypto policy errors, confirm FIPS is fully disabled with fips-mode-setup --check. A reboot is required after disabling FIPS.

openssl-fips-provider file conflict

If dnf reports a file conflict between openssl-fips-provider-so and openssl-fips-provider, manually remove the Oracle package first: dnf remove openssl-fips-provider-so, then retry.

Oracle repos reappear

Verify oraclelinux-release was fully replaced: rpm -q oraclelinux-release should return "not installed."

DISCLAIMER

The migrate2rlc script and playbook are provided "as is" without warranty of any kind, express or implied. Use of these tools is entirely at your own risk. CIQ, Inc. assumes no responsibility or liability for any data loss, system downtime, service disruption, or other damage resulting from the use or misuse of these tools. It is the user's responsibility to ensure adequate backups and testing in a non-production environment before performing any migration on production systems.

Oracle Linux 8 to Rocky Linux from CIQAlmaLinux 8 to Rocky Linux from CIQ