Feb 06

Downloading and using Gold Image with AutoUpgrade

We are happy to announce that starting in AutoUpgrade 26.2, it is possible to use and download Gold Images on the tool, which will speed up your patching process!

Let’s get started!

How does it work?

The Gold Image feature works by transparently calling the Oracle Update Advisor service, providing the list of patches on the patch config parameter, and ask this service to return with the database home zipped as a gold image so AU can simply extract it.

For customers using AutoUpgrade behind a firewall, it is necessary to allow HTTPS (port 443) connections to transport.oracle.com and objectstorage.us-ashburn-1.oraclecloud.com.

If the same image you are requesting was already requested previously (by any other user), the service will have it cached. Usually, it takes about ~7 minutes or less for the file to be available for download when it is cached. However, if the image needs to be generated for the first time, it can take up to 2 hours for it to be generated.

This Oracle Update Advisor service also requires that not just the MOS user/password be provided, but also the MOS CSI. Because of this requirement, we added a new option on the AU wallet so the CSI can be loaded:

To add the CSI, you run:

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -load_password
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Starting AutoUpgrade Patching Password Loader - Type help for available options

MOS> add
The specified command is in an invalid format.
  To add MOS credentials: add -user [email protected]
  To add CSI #: add -csi <csi #>

MOS> add -csi 12345678

MOS> save

Also, we added a new config file parameter, named gold_image. The accepted values for it are:

  • NO

Gold Image will not be used. This will force the previous (current) behaviour. Patches are individually downloaded from MOS and applied. However, remember that for releases before 26ai, in this mode, it is required that the base release be placed in the patches folder.

  • YES

The Gold Image feature is enabled. When this value is provided, AU will request and download the generated Gold Image for all patches from Oracle Update Advisor service, except for anything that is a number in the patch parameter (one-offs). So, the one-off patches are still downloaded and applied individually from MOS. This option will require that the MOS CSI be loaded into the keystore.

  • ALL

The Gold Image feature is enabled. Differently from YES, if ALL is provided, AU will download the generated Gold Image for all patches from Oracle Update Advisor service. This option will require that the MOS CSI be loaded into the keystore.

Why not always use ALL instead of YES? Because the chances that the requested image is already cached (another user requested it before) are much higher when you exclude one-offs. So, it is faster to simply download the image, excluding the one-offs, and apply them later via opatch.

  • AUTO (default)

The default value of AUTO will automatically decide the best approach, selecting between YES or NO.

If all of these preconditions below are met, then AUTO is resolved as YES. Otherwise, AUTO is resolved as NO:

    • A valid CSI with My Oracle Support credentials is loaded into the AutoUpgrade Patching keystore.
    • Connection to Oracle Updater is successful.
      • Note that if you are behind a firewall, https://transport.oracle.com/ needs to be whitelisted.
    • The requested platform is LINUX.X64.
    • The requested RU is available on the Oracle Update Advisor service (the service only provides the 3 latest RUs).

ALL vs YES

Let’s compare the flow of using YES vs ALL for a config file with the following properties: patch=RU,OJVM,OPATCH,OCW,37690446,34672698

  • If gold_image=YES:
    1. Request Gold Image for RU,OJVM,OPATCH,OCW. Generation time will be about 7 min (if cached).
    2. Download Gold Image from Oracle Update Advisor service. Example: autoupgrade_linux-x86-64_19.28_db_home.zip.
    3. Download 37690446 and 34672698 from MOS.
    4. Unzip Gold Image as new Oracle Home.
    5. Apply each downloaded patch.
  • If gold_image=ALL:
    1. Request Gold Image for everything. Generation time – about 2 hrs (if not cached).
    2. Download Gold Image from Oracle Update Advisor service. Example: autoupgrade_linux-x86-64_19.28_db_home.zip.
    3. Unzip Gold Image as new Oracle Home.

So, even though ALL has fewer steps, the time we wait for having the Gold Image is usually higher than applying the 2 extra one-offs, which are small.

Trying the feature

Let’s finally play with this new feature:

First, download the latest release of AutoUpgrade and ensure it is at least 26.2:

$ wget https://download.oracle.com/otn-pub/otn_software/autoupgrade.jar
--2026-02-04 13:46:04--  https://download.oracle.com/otn-pub/otn_software/autoupgrade.jar
Resolving download.oracle.com (download.oracle.com)... 23.37.8.103
Connecting to download.oracle.com (download.oracle.com)|23.37.8.103|:443... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://edelivery.oracle.com/otn-pub/otn_software/autoupgrade.jar [following]
--2026-02-04 13:46:05--  https://edelivery.oracle.com/otn-pub/otn_software/autoupgrade.jar
Resolving edelivery.oracle.com (edelivery.oracle.com)... 23.55.213.198, 2600:1419:6200:10a8::366, 2600:1419:6200:10bb::366
Connecting to edelivery.oracle.com (edelivery.oracle.com)|23.55.213.198|:443... connected.
HTTP request sent, awaiting response... 302 Moved Temporarily
Location: https://download.oracle.com/otn-pub/otn_software/autoupgrade.jar?AuthParam=1770212885_5d957e026f73e3b40d9fc1a392869a7b [following]
--2026-02-04 13:46:05--  https://download.oracle.com/otn-pub/otn_software/autoupgrade.jar?AuthParam=1770212885_5d957e026f73e3b40d9fc1a392869a7b
Connecting to download.oracle.com (download.oracle.com)|23.37.8.103|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 6729677 (6.4M) [application/x-jar]
Saving to: ‘autoupgrade.jar’

100%[=====================================================================================================================================================>] 6,729,677   --.-K/s   in 0.1s

2026-02-04 13:46:06 (52.8 MB/s) - ‘autoupgrade.jar’ saved [6729677/6729677]

Now, let’s create a config file with the following entries and request a download:

$ cat > patch.cfg << 'EOF'
> global.global_log_dir=/home/oracle/autoupgrade/log
> global.keystore=/home/oracle/autoupgrade/keystore
>
> patch1.sid=DB193H11
> patch1.source_home=/u01/app/oracle/product/19.3.0.0/dbhome_1
> patch1.target_home=/u01/app/oracle/product/%RELEASE%.%UPDATE%/dbhome_1
> patch1.restoration=YES
> patch1.folder=/home/oracle/autoupgrade/patches
> patch1.patch=RU,OJVM,OPATCH,OCW
> patch1.download=YES
> patch1.gold_image=YES
> EOF

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -mode download
AutoUpgrade Patching 26.2 launched with default internal options
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded
For prefix patch1, if gold_image is set to YES or ALL, both CSI and MOS credentials need to be loaded into the keystore. Use -load_password option

So, as you can see, we need to add the CSI to the AU wallet. Let’s do it:

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -load_password
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Starting AutoUpgrade Patching Password Loader - Type help for available options

MOS> add
The specified command is in an invalid format.
  To add MOS credentials: add -user [email protected]
  To add CSI #: add -csi <csi #>
MOS> add -csi 12345678

AutoUpgrade Patching keystore Password is required prior to operation
Enter wallet password:
Continuing...

MOS> exit
Save the AutoUpgrade Patching keystore before exiting [YES|NO] ? yes

AutoUpgrade Patching Password Loader finished - Exiting AutoUpgrade Patching

Now trying to download again:

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -mode download
AutoUpgrade Patching 26.2 launched with default internal options
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Connected to Oracle Updater service - Requesting gold images
AutoUpgrade Patching has finished processing the gold image requests

-----------------------------------------------------
Downloading files to /home/oracle/autoupgrade/patches
-----------------------------------------------------
Gold Image - 19.30.0.0.0
    File: autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip - VALIDATED
-----------------------------------------------------

Nice, the base image was downloaded. It took me about 7 minutes for the file to be generated, plus 4 minutes to download it.

Let’s check the patches included on it:

$ unzip -j /home/oracle/autoupgrade/patches/autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip inventory/ContentsXML/oui-patch.xml
Archive:  /home/oracle/autoupgrade/patches/autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip
  inflating: oui-patch.xml

$ xmllint --xpath '//ONEOFF[@TYPE="unknown"]/DESC' oui-patch.xml \
>   | sed 's:</DESC>:</DESC>\n:g' \
>   | sed -n 's:.*<DESC>\(.*\)</DESC>:\1:p'
Database Release Update : 19.30.0.0.260120(REL-JAN260130) (38632161)
OCW RELEASE UPDATE 19.30.0.0.0 (38661284)
OJVM RELEASE UPDATE: 19.30.0.0.260120 (38523609)

$

So, as you can see, the RU, OCW, and OJVM of the 19.30 release (latest as of today) are included in one single dbhome image file. Pretty cool.

Now what if I change:
patch=RU,OJVM,OPATCH,OCW,38854064,37690446,34672698,34774667,29213893
And keep the gold_image=YES. What will happen?

$ cat > patch.cfg << 'EOF'
> global.global_log_dir=/home/oracle/autoupgrade/log
> global.keystore=/home/oracle/autoupgrade/keystore
>
> patch1.sid=DB193H11
> patch1.source_home=/u01/app/oracle/product/19.3.0.0/dbhome_1
> patch1.target_home=/u01/app/oracle/product/%RELEASE%.%UPDATE%/dbhome_1
> patch1.restoration=YES
> patch1.folder=/home/oracle/autoupgrade/patches
> patch1.patch=RU,OJVM,OPATCH,OCW,38854064,37690446,34672698,34774667,29213893
> patch1.download=YES
> patch1.gold_image=YES
> EOF

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -mode download
AutoUpgrade Patching 26.2 launched with default internal options
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Connected to Oracle Updater service - Requesting gold images
AutoUpgrade Patching has finished processing the gold image requests

Connected to MOS - Searching for specified patches

-----------------------------------------------------
Downloading files to /home/oracle/autoupgrade/patches
-----------------------------------------------------
OPatch 12.2.0.1.49 for DB 19.0.0.0.0 (Jan 2026)
    File: p6880880_190000_Linux-x86-64.zip - VALIDATED

OCI: DATA CORRUPTION SEEN IN MIDDLE OF DBRU PATCHING TO 19.29 AND LOST WRITE DETECTED IN THE STNABY
    File: p38854064_1930000DBRU_Linux-x86-64.zip - VALIDATED

ORA-600 [KTATMKREF-RS] ERRORS IN THE ALERT LOG POST-PATCH 37260974 (19.26.0.0.250121 DBRU)
    File: p37690446_1930000DBRU_Linux-x86-64.zip - VALIDATED

ORA-00800: SOFT EXTERNAL ERROR, ARGUMENTS: [SET PRIORITY FAILED], [VKTM] , DISM(16)
    File: p34672698_1930000DBRU_Linux-x86-64.zip - VALIDATED

ORA-7445 IN PURGE QUEUE TABLE
    File: p34774667_1930000DBRU_Linux-x86-64.zip - VALIDATED

DBMS_STATS FAILING WITH ERROR ORA-01422 WHEN GATHERING STATS FOR USER$ TABLE
    File: p29213893_1930000DBRU_Generic.zip - VALIDATED

Gold Image - 19.30.0.0.0
    File: autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip - LOCATED
-----------------------------------------------------

$

As you can see above, it used the same Gold Image as before and downloaded the extra one-offs. What if I change now gold_image=ALL?

$ cat > patch.cfg << 'EOF'
> global.global_log_dir=/home/oracle/autoupgrade/log
> global.keystore=/home/oracle/autoupgrade/keystore
>
> patch1.sid=DB193H11
> patch1.source_home=/u01/app/oracle/product/19.3.0.0/dbhome_1
> patch1.target_home=/u01/app/oracle/product/%RELEASE%.%UPDATE%/dbhome_1
> patch1.restoration=YES
> patch1.folder=/home/oracle/autoupgrade/patches
> patch1.patch=RU,OJVM,OPATCH,OCW,38854064,37690446,34672698,34774667,29213893
> patch1.download=YES
> patch1.gold_image=ALL
> EOF

$ $ORACLE_HOME/jdk/bin/java -jar autoupgrade.jar -patch -config patch.cfg -mode download
AutoUpgrade Patching 26.2 launched with default internal options
Processing config file ...
Loading AutoUpgrade Patching keystore
AutoUpgrade Patching keystore is loaded

Connected to Oracle Updater service - Requesting gold images
AutoUpgrade Patching has finished processing the gold image requests

-----------------------------------------------------
Downloading files to /home/oracle/autoupgrade/patches
-----------------------------------------------------
Gold Image - 19.30.0.0.0
    File: autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip - VALIDATED
-----------------------------------------------------

$

It took about 2 hours for the Oracle Update Advisor service to prepare the image and 5 minutes to download the file (the file is placed on an OCI bucket). If it were cached, it would be fast. Now, checking the contents:

$ unzip -j /home/oracle/autoupgrade/patches/autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip inventory/ContentsXML/oui-patch.xml
Archive:  /home/oracle/autoupgrade/patches/autoupgrade_linux-x86-64_19.30.0.0.0_db_home.zip
  inflating: oui-patch.xml

$ xmllint --xpath '//ONEOFF[@TYPE="unknown"]/DESC' oui-patch.xml \
>   | sed 's:</DESC>:</DESC>\n:g' \
>   | sed -n 's:.*<DESC>\(.*\)</DESC>:\1:p'
Database Release Update : 19.30.0.0.260120(REL-JAN260130) (38632161)
OCW RELEASE UPDATE 19.30.0.0.0 (38661284)
DBMS_STATS FAILING WITH ERROR ORA-01422 WHEN GATHERING STATS FOR USER$ TABLE
OJVM RELEASE UPDATE: 19.30.0.0.260120 (38523609)
OCI  DATA CORRUPTION SEEN IN MIDDLE OF DBRU PATCHING TO 19.29 AND LOST WRITE DETECTED IN THE STNABY
ORA-600 [KTATMKREF-RS] ERRORS IN THE ALERT LOG POST-PATCH 37260974 (19.26.0.0.250121 DBRU)
ORA-7445 IN PURGE QUEUE TABLE
ORA-00800  SOFT EXTERNAL ERROR, ARGUMENTS  [SET PRIORITY FAILED], [VKTM] , DISM(16)

$

As we can see, it has all the patches that were requested already applied to that image.

Have you enjoyed? Please leave a comment or give a 👍!

12 comments

Skip to comment form

    • marten hinrichs on February 17, 2026 at 04:53
    • #
    • Reply

    Hi,

    if i try this i became following error =>
    [oracle@oel9 goldimage]$ java -jar autoupgrade.jar -patch -config goldimage.cfg -mode download
    AutoUpgrade Patching 26.2.260205 launched with default internal options
    Processing config file …
    The following errors were found in the configuration file:
    The source_home parameter for prefix patch1 does not exist or is not a directory – /u01/app/oracle/product/19.3.0.0/db
    [oracle@oel9 goldimage]$ mkdir -p /u01/app/oracle/product/19.3.0.0/db

    If i then create empty directory

    mkdir -p /u01/app/oracle/product/19.3.0.0/db

    i became failure =>
    [oracle@oel9 goldimage]$ java -jar autoupgrade.jar -patch -config goldimage.cfg -mode download
    AutoUpgrade Patching 26.2.260205 launched with default internal options
    Processing config file …
    Unable to derive the binary options in the ORACLE_HOME /u01/app/oracle/product/19.3.0.0/db for prefix patch1

    This is a empty Server only to create a “goldimage” . Do i miss anything? The only thing i change is the config file name. Parameters are the same,

    1. Yes, if this is an empty server, probably you are setting a source_home pointing to a non-existent folder. Remove this parameter from your config file. If the error persists, please paste the config file here so I can try to check what’s wrong.

    • cesar martinez on March 11, 2026 at 12:35
    • #
    • Reply

    Hi Rodrigo,

    i got the gold image with the parameter patch1.gold_image=ALL, but when i tried to create a new home i got the next error:

    java -jar autoupgrade.jar -patch -config config_file -mode create_home

    There were conditions found preventing AutoUpgrade Patching from successfully running

    There were conditions found preventing AutoUpgrade Patching from successfully running

    *Validating Oracle Patch files
    Unable to find any gold image containing the requested patches

    the gold image exists in the folder

    im doing something wrong?

    1. This was a bug in case you moved the patch download folder to another location, or if this Gold Image was shared between different servers. The download inventory was help on the log directory, so other executions couldn’t see or understand that gold image. This was already fixed on the latest release.

    • Carlos on April 9, 2026 at 14:46
    • #
    • Reply

    Thanks for the info Rodrigo.
    Does the creation of a golden image depend on the operating system version? For example, is it the same to create a golden image on Red Hat 8 as on Red Hat 9? Or are the libraries that can be used always the same? I’m referring to when you create the golden image locally with runInstaller. Seeing that it can be done directly in the cloud, it seems to be independent then. Thank you very much.

    1. Hi Carlos. It is the same across different operating systems given they have the same platform (Linux x86-64). However, for OL9 for example, the minimum RU level must be 19.22.

    • Reiner Kuehl on May 6, 2026 at 09:11
    • #
    • Reply

    Hi Rodrigo,
    this is pretty cool, thanks! I was able to download the gold image for 19.31. After I have copied it to another server, when running “create_home”, it is not finding the patch files. I have basically a similar issue than Cesar Martinez. I am using latest autoupgrade.jar and have copied it to the remove server including the gold image plus the autoupgrade_linux-x86-64_19.31.0.0.0_db_home.zip. We are on a RedHat 9 box.
    This is my patch.cfg file:
    global.global_log_dir=/local0/oracle/autoUpgrade/logs
    patch1.source_home=/opt/oracle/19
    patch1.target_home=/local0/oracle/product/19/19.31
    patch1.folder=/local0/oracle/patches/19.31
    patch1.download=NO
    patch1.gold_image=YES
    patch1.sid=SELCDB
    patch1.restoration=no

    This is the output:
    $ORACLE_HOME/jdk/bin/java -jar /local0/oracle/patches/19.31/autoupgrade.jar -config /local0/oracle/patches/19.31/patch.cfg -patch -mode create_home
    AutoUpgrade Patching 26.3.260401 launched with default internal options
    Processing config file …

    There were conditions found preventing AutoUpgrade Patching from successfully running

    *Validating Oracle Patch files
    Unable to find any gold image containing the requested patches

    What have I missed?

    • Reiner on May 6, 2026 at 10:59
    • #
    • Reply

    Quick correction: I have copied the downloaded gold image “autoupgrade_linux-x86-64_19.31.0.0.0_db_home.zip plus the current “autoupgrade.jar” to the remote server. Not more. I am stuck.

    • Johannes on May 11, 2026 at 06:57
    • #
    • Reply

    I have the same problem. I downloaded the latest 19.31 goldimage and unzipped that file because it contains another zip file which seems to be the gold image as autoupgrade likes it.
    I have the impression that autoupgrade verifies if the fixes in the goldimage maps the path parameter in autoupgrade.

    • Anand on May 29, 2026 at 22:56
    • #
    • Reply

    Hi,

    Great article. I noticed that for 26ai, AU downloads the full image file even if have “patch1.gold_image=NO” option in my config file. I need the traditional incremental patch file that I can unzip and run “opatch apply”. any idea why this behavior ?

    thanks

    • Russ on June 3, 2026 at 12:29
    • #
    • Reply

    I’m hitting similar issue with create_home option after downloading the gold image.

    I downloaded the gold image successfully using autoupgrade:

    java -jar $ORACLE_HOME/rdbms/admin/autoupgrade.jar -config download_gold.cfg -patch -mode download

    With this cfg file:

    global.global_log_dir=/u01/app/oracle/autoupgrade/logs
    global.keystore=/u01/app/oracle/autoupgrade/keystore
    download1.target_version=26
    download1.folder=/u01/app/oracle/software
    download1.patch=RECOMMENDED
    download1.download=yes
    download1.gold_image=yes

    This contains these images and patches – latest version of opatch is in the zip file:

    Database Release Update : 23.5.0.24.07 (36741532) Gold Image
    OCW RELEASE UPDATE 23.5.0.24.07 (36744688) Gold Image
    Database Release Update : 23.26.2.0.0 (39093711)
    OCW RELEASE UPDATE 23.26.2.0.0 (39093738)
    DATAPUMP BUNDLE PATCH 23.26.2.0.0

    Then tried to create the new oracle home using the autoupgrade -patch -mode create_home but it gives me an error:

    java -jar $ORACLE_HOME/rdbms/admin/autoupgrade.jar -config create_home.cfg -patch -mode create_home

    AutoUpgrade Patching 26.3.260401 launched with default internal options
    Processing config file …
    Loading AutoUpgrade Patching keystore
    AutoUpgrade Patching keystore is loaded
    There were conditions found preventing AutoUpgrade Patching from successfully running

    *Validating Oracle Patch files
    Unable to find any gold image containing the requested patches.

    create_home.cfg:
    global.global_log_dir=/u01/app/oracle/autoupgrade/logs
    global.keystore=/u01/app/oracle/autoupgrade/keystore
    patch1.target_version=26
    patch1.patch=RECOMMENDED
    patch1.folder=/u01/app/oracle/software
    patch1.target_home=/u01/app/oracle/product/26.0.0/db1
    patch1.download=no
    patch1.gold_image=yes
    patch1.home_settings.oracle_base=/u01/app/oracle
    patch1.home_settings.edition=EE
    patch1.home_settings.inventory_location=/u01/app/oraInventory
    patch1.home_settings.inventory_group=dba
    patch1.home_settings.osdba_group=dba
    patch1.home_settings.osbackupdba_group=dba
    patch1.home_settings.oskmdba_group=dba
    patch1.home_settings.osracdba_group=dba
    patch1.home_settings.osdgdba_group=dba
    patch1.home_settings.osoper_group=dba
    patch1.home_settings.binopt.asm=yes
    patch1.home_settings.binopt.rac=yes
    patch1.home_settings.cluster_nodes=

    This could be a bug with the new GOLD option – previously it was possible to create a home but it expected the base install plus patches to apply. I raised an SR with Oracle but just get referred to 19c KBs which don’t talk about the gold option.

    Is it possible that create_home option can do the download too?

    • Reiner Kuehl on June 15, 2026 at 04:46
    • #
    • Reply

    Hi Rodrigo, I appreciate the option to create a gold image using AutoUpgrade. As far as I can see, this is currently only possible for Oracle RDBMS. It would be really great if we could use AutoUpgrade as well to prepare a gold image for a full Oracle Client. Is this planned in the future, or have I missed it and it works already? We need to patch quite often (during a maintenance window) the Oracle Client on one server and the Oracle RDBMS on another server. It would be great if we could use the same process (using AutoUpgrade, out-of-place, gold image).

Leave a Reply

Your email address will not be published.