Update almalinux-deploy.sh for --preserve-rhsm by nlaphine · Pull Request #278 · AlmaLinux/almalinux-deploy

nlaphine · 2026-08-26T03:00:26Z

Adds --preserve-rhsm to stop the script from destroying repositories on enterprise servers managed by Foreman (or RedHat Satellite for the mega rich).
Also removes the need for servers to have access to the internet for updates.

Testing
Tested on RHEL v8, 9 and 10 using Foreman 3.19 with Katello 4.21
Also used in production on several servers so far.

Added README_PRESERVE_RHSM.md to further explain the expected setup for using this option.

Addresses #276

Peter

yuravk · 2026-08-26T08:07:07Z

 DOWNGRADE='NO'
 REPO_URL=https://repo.almalinux.org/almalinux
 LOCAL_REPO='NO'
+PRESERVE_RHSM='NO'


To fix the line 1630: DNF_UPGRADE: unbound variable

Suggested change

PRESERVE_RHSM='NO'

PRESERVE_RHSM='NO'

DNF_UPGRADE='NO'

yuravk · 2026-08-26T08:12:40Z

        for pkg in $(rpm -qa | grep -E 'shim|fwupd|grub2'); do
            if [[ "AlmaLinux" != "$(rpm -q --queryformat '%{vendor}' "$pkg")" ]]; then
-                yum reinstall "${pkg}" -y
+            # There is a timing issue where some packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here


Secure Boot package reinstall is a safety regression and unrelated to the feature. And we can't ignore errors here.

Suggested change

# There is a timing issue where some packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here

yuravk · 2026-08-26T08:14:19Z

            if [[ "AlmaLinux" != "$(rpm -q --queryformat '%{vendor}' "$pkg")" ]]; then
-                yum reinstall "${pkg}" -y
+            # There is a timing issue where some packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here
+                yum reinstall -y "${pkg}"  || true


If the AlmaLinux-signed shim/kernel isn't actually installed, a Secure Boot machine won't boot after migration.

Suggested change

yum reinstall -y "${pkg}" || true

yum reinstall "${pkg}" -y

yuravk · 2026-08-26T08:14:48Z

        kernel_package="$(rpm -qf "$kernel_path")"
        if [[ "AlmaLinux" != "$(rpm -q --queryformat '%{vendor}' "${kernel_package}")" ]]; then
-            yum reinstall "${kernel_package}" -y
+        # There is a timing issue where kernel packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here


Secure Boot package reinstall is a safety regression and unrelated to the feature. And we can't ignore errors here.

Suggested change

# There is a timing issue where kernel packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here

yuravk · 2026-08-26T08:15:19Z

        if [[ "AlmaLinux" != "$(rpm -q --queryformat '%{vendor}' "${kernel_package}")" ]]; then
-            yum reinstall "${kernel_package}" -y
+        # There is a timing issue where kernel packages are available on RHEL but not yet on AlmaLinux mirrors, so we ignore errors here
+            yum reinstall -y "$kernel_package" || true


If the AlmaLinux-signed shim/kernel isn't actually installed, a Secure Boot machine won't boot after migration.

Suggested change

yum reinstall -y "$kernel_package" || true

yum reinstall "${pkg}" -y

yuravk · 2026-08-26T08:21:26Z

+         LOCAL_REPO='NO'
+         REPO_URL=''
+         DNF_UPGRADE='NO'
+         dnf install -y python3-dnf-plugin-post-transaction-actions >/dev/null


System-modifying in the option-parsing block, before root check, logging, etc ...

Suggested change

dnf install -y python3-dnf-plugin-post-transaction-actions >/dev/null

yuravk · 2026-08-26T08:22:00Z

+         REPO_URL=''
+         DNF_UPGRADE='NO'
+         dnf install -y python3-dnf-plugin-post-transaction-actions >/dev/null
+         echo -e '# AlmaLinux Repo files break dnf if no proxy is available\nalmalinux-re*:in:/usr/bin/rm -f /etc/yum.repos.d/almalinux*.repo' > /etc/dnf/plugins/post-transaction-actions.d/almalinux-repos.conf


Move this into a proper stage function called from main() (after assert_run_as_root)

Suggested change

echo -e '# AlmaLinux Repo files break dnf if no proxy is available\nalmalinux-re*:in:/usr/bin/rm -f /etc/yum.repos.d/almalinux*.repo' > /etc/dnf/plugins/post-transaction-actions.d/almalinux-repos.conf

yuravk · 2026-08-26T08:29:01Z

    local release_path
    local panel_type
    local panel_version
    assert_run_as_root


Install the dnf post-transaction-actions plugin and a hook (new function)

Suggested change

setup_preserve_rhsm_hook

yuravk · 2026-08-26T08:32:38Z

    report_step_done "Remove RHEL repositories' files if any"
    save_status_of_stage "remove_redhat_repo_files"
 }



Suggested change

# Installs the dnf post-transaction-actions plugin and a hook which removes

# AlmaLinux repository files as soon as almalinux-release/almalinux-repos

# create them. Only used with --preserve-rhsm, where repositories are

# managed by subscription-manager (Foreman/Katello).

setup_preserve_rhsm_hook() {

if [[ "${PRESERVE_RHSM}" != "YES" ]]; then

return 0

fi

if get_status_of_stage "setup_preserve_rhsm_hook"; then

return 0

fi

local -r step='Install dnf post-transaction-actions hook for --preserve-rhsm'

local -r hook_dir='/etc/dnf/plugins/post-transaction-actions.d'

local output

if ! output=$(dnf install -y python3-dnf-plugin-post-transaction-actions 2>&1); then

report_step_error "${step}" "${output}"

exit 1

fi

mkdir -p "${hook_dir}"

printf '%s\n' '# AlmaLinux Repo files break dnf if no proxy is available' \

'almalinux-re*:in:/usr/bin/rm -f /etc/yum.repos.d/almalinux*.repo' \

> "${hook_dir}/almalinux-repos.conf"

report_step_done "${step}"

save_status_of_stage "setup_preserve_rhsm_hook"

}

Initial commit for almalinux-deploy.sh changes

e0f2d4c

yuravk reviewed Aug 26, 2026

View reviewed changes

Navigation Menu

Uh oh!

Update almalinux-deploy.sh for --preserve-rhsm - #278

Update almalinux-deploy.sh for --preserve-rhsm#278
nlaphine wants to merge 1 commit into
AlmaLinux:masterfrom
nlaphine:master

nlaphine commented Aug 26, 2026 •

edited

Loading

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

yuravk Aug 26, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

	yum reinstall -y "$kernel_package" \|\| true
	yum reinstall "${pkg}" -y

+# Installs the dnf post-transaction-actions plugin and a hook which removes
+# AlmaLinux repository files as soon as almalinux-release/almalinux-repos
+# create them. Only used with --preserve-rhsm, where repositories are
+# managed by subscription-manager (Foreman/Katello).
+setup_preserve_rhsm_hook() {
+    if [[ "${PRESERVE_RHSM}" != "YES" ]]; then
+        return 0
+    fi
+    if get_status_of_stage "setup_preserve_rhsm_hook"; then
+        return 0
+    fi
+    local -r step='Install dnf post-transaction-actions hook for --preserve-rhsm'
+    local -r hook_dir='/etc/dnf/plugins/post-transaction-actions.d'
+    local output
+    if ! output=$(dnf install -y python3-dnf-plugin-post-transaction-actions 2>&1); then
+        report_step_error "${step}" "${output}"
+        exit 1
+    fi
+    mkdir -p "${hook_dir}"
+    printf '%s\n' '# AlmaLinux Repo files break dnf if no proxy is available' \
+        'almalinux-re*:in:/usr/bin/rm -f /etc/yum.repos.d/almalinux*.repo' \
+        > "${hook_dir}/almalinux-repos.conf"
+    report_step_done "${step}"
+    save_status_of_stage "setup_preserve_rhsm_hook"
+}

Uh oh!

Conversation

nlaphine commented Aug 26, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

nlaphine commented Aug 26, 2026 •

edited

Loading