7.1 Patch Update on the Existing VM

A patch update is an in-place application package update. It replaces the OCLM application wheel and dependency wheel files used by the existing virtual environment. It does not update customer configuration, Operator CA trust files, CMP identity files, or HTTPS serving certificate files.

Oracle provides the patch as a .tar archive with the following contents:

oclm-patch-VERSION.tar
├── oclm_service-VERSION-py3-none-any.whl
└── dependencies/
    └── *.whl

Table 7-2 Patch Update Package Artifacts

Artifact	Required	Purpose
oclm-patch-VERSION.tar	Mandatory	Oracle-provided patch archive containing the application wheel and dependency wheels.
oclm_service-VERSION-py3-none-any.whl	Mandatory	OCLM application package.
dependencies/*.whl	Mandatory	Offline dependency wheel files required by the OCLM application package.
/opt/oclm-service/bin/upgrade.sh	Mandatory	Patch helper already present on the OCLM VM.

Note:

The OCLM VM does not include the tar utility. Extract the archive on an approved administration host and securely copy the extracted files to the OCLM VM.

Extract the patch on the administration host

Verify the Oracle-provided archive according to the release-specific checksum instructions. Extract and inspect the patch package on an approved administration host:

mkdir -p oclm-patch-VERSION
tar -xf oclm-patch-VERSION.tar -C oclm-patch-VERSION

Confirm that the extracted package contains exactly one OCLM application wheel and all required dependency wheels.

Copy the extracted patch to the OCLM VM

Use a customer approved secure transfer method to copy the extracted directory to the OCLM VM. The following example uses scp:

scp -r oclm-patch-VERSION   admusr@<oclm-node-ip>:/home/admusr/

Validate the copied patch files

Log in to the OCLM VM and confirm that the application and dependency wheel files are present:

ssh admusr@<oclm-node-ip>

PATCH_DIR=/home/admusr/oclm-patch-VERSION

find "$PATCH_DIR" -maxdepth 1 -name 'oclm_service-*.whl' -print
find "$PATCH_DIR/dependencies" -name '*.whl' -print

Stop OCLM and back up the existing wheel files

Stop the OCLM service and create a backup of the currently installed application and dependency wheel files. Retain this backup until patch acceptance is complete.

sudo systemctl stop oclm-service
sudo systemctl status --no-pager oclm-service

BACKUP_DIR=/home/admusr/oclm-patch-backup-$(date -u +%Y%m%d%H%M%S)

sudo mkdir -p "$BACKUP_DIR/wheels"
sudo cp -p /opt/oclm-service/oclm_service-*.whl "$BACKUP_DIR/"
sudo cp -p /opt/oclm-service/wheels/*.whl "$BACKUP_DIR/wheels/"
sudo chown -R admusr:admusr "$BACKUP_DIR"

ls -l "$BACKUP_DIR"
ls -l "$BACKUP_DIR/wheels"

Do not continue if the backup fails. This backup contains only application and dependency wheel files; it does not include customer configuration, Operator CA trust files, CMP identity files, or HTTPS serving certificate files.

Copy the New Patch Artifacts

Remove the previous wheel files and copy the extracted patch artifacts to the locations used by upgrade.sh:

PATCH_DIR=/home/admusr/oclm-patch-VERSION

sudo install -d -m 0755 /opt/oclm-service/wheels

sudo rm -f /opt/oclm-service/oclm_service-*.whl
sudo rm -f /opt/oclm-service/wheels/*.whl

sudo install -m 0644   "$PATCH_DIR"/oclm_service-*.whl   /opt/oclm-service/

sudo cp -p   "$PATCH_DIR"/dependencies/*.whl   /opt/oclm-service/wheels/

sudo chown admusr:admusr   /opt/oclm-service/oclm_service-*.whl   /opt/oclm-service/wheels/*.whl

Run the Patch

Run the patch helper from the OCLM VM:

sudo bash /opt/oclm-service/bin/upgrade.sh

The helper installs the OCLM application and its dependencies from the local wheel files. After successful installation, it restarts oclm-service.service.

Expected successful output includes:

Upgraded OCLM Python wheel in /opt/oclm-service/venv using /opt/oclm-service/oclm_service-VERSION-py3-none-any.whl
Restarted oclm-service.service

Validate the Patch

Validate the service status, listener, installed package version, and recent logs:

sudo systemctl status --no-pager oclm-service
sudo ss -ltnp | grep ':8989'
sudo tail -n 200 /var/log/oclm.log

Perform an approved certificate create and retrieve test before accepting the patch. After acceptance, remove the staged patch files according to the customer retention policy. Retain the patch backup until rollback is no longer required.