Add an OpenVox 8 to 9 upgrade guide to the 9.x docs

[miharp]

Adds an upgrade-planning page to the 9.x collection, "Upgrading from OpenVox 8 to OpenVox 9", covering what to review before moving a production deployment, alongside the existing package-mechanics page (upgrade_minor). Modeled on the shape of Puppet Core's 8-to-9 guide, with every claim checked against the OpenVox 9 sources rather than copied. Updated for the 9.0.0 release: the prerelease callout and the rc-specific notes are gone, and the page carries the details from the GA release notes and announcement (support window for OpenVox 8, platform drops, Java packaging and the Java 17 crash symptom, PostgreSQL versions, unvendored gems, the invoke-rc.d fallback removal, and a section on Windows agents defaulting to UTF-8).

Part of #456. The page links to the server 9.x, OpenVoxDB 9.x, and OpenFact 6.x release notes and to the server 9.x auth.conf page; #457, #458, and #459 have merged, so every link on the page resolves on master.

What the page covers

• Component table: Ruby 3.2 to 4.0, OpenSSL 3.0 to 3.5, OpenFact 5 to 6, JRuby 9.4 to 10.1, Java 21 or 25 (17 dropped), curl no longer bundled, puppet-resource_api 1.9 to 2.0, with a link to the component-versions page for exact versions and a note on the new major versions of the vendored *_core modules.
• Before-you-upgrade checklist: latest 8.x first, per-component release notes, platform coverage at GA (no 9 packages for EL 7, Amazon Linux 2, Fedora 42, Debian 11, or Ubuntu 25.04; Debian 12 agent only), backups.
• Ruby 4.0 review guidance for custom facts, functions, types, providers, and agent- or server-installed gems, including the Kernel#open pipe removal, Net::HTTP no longer sending a default Content-Type header, and the libraries no longer shipped (base64, multi_json, the full cgi library on the agent; gettext on the server).
• OpenFact 6 changes that affect fact code (Ruby 3.0+, exec/which deprecations, time_limit/limit aliases, ldapname removal, /opt/puppetlabs/bin search path).
• Behavior changes verified in the prerelease sources: deferred functions preprocessed by default again (openvox#462), report storage opt-in (openvox#583), and the server setting fallback (openvox#536). An agent with nothing that names a server fails whether it runs as root or not; the page quotes both messages, since the non-root text differs. As of 9.0.0-rc2 the check is satisfied by server, server_list, SRV records, or (for their own services) ca_server and report_server (openvox#659), so the rc1 workaround of keeping a server entry next to server_list is gone from the page.
• Removed settings (configprint, pluginsync, data_binding_terminus, environment_data_provider) and other removals (checksum-like file content values no longer fetched from the filebucket (openvox#170), regsubst encoding argument, the systemd provider's invoke-rc.d fallback on Debian (openvox#562), pe_serverversion, zone_core, Java keystores, legacy PAL APIs).
• Server and OpenVoxDB changes: Java 21/25 pulled in by the package dependency (EL 8 and FIPS packages are Java 21 only; a Java 17 start crashes with ClassNotFoundException: java.util.SequencedCollection), the launcher and JAVA_BIN handling, the filebucket read-authorization change (openvox-server#549) and the caveat that a modified auth.conf is kept by the package and so keeps its 8.x rules, Jetty 12 with the OpenVoxDB bootstrap.cfg jetty10-service pitfall for upgrades from 8.14.0 or earlier, PostgreSQL 14 minimum (tested against 15, 16, and 18), and the openvox-server and openvoxdb packages' dependency on agent 9 (openvoxdb-termini is unversioned, verified against the published rc1 apt and yum metadata).
• Windows agents default to UTF-8: the Ruby 3.2 build in OpenVoxProject/puppet-runtime applies revert_ruby_utf8_default_encoding.patch on Windows and the Ruby 4.0 build applies no patches, so OpenVox 9 Windows agents get upstream Ruby's UTF-8 default external encoding (the same change Puppet Core 9 documents). Also notes the MSYS2/UCRT build and the openvox9 installer directory.
• Test-then-upgrade checklist and upgrade order, including the switch to the openvox9-release repository package (on Debian and Ubuntu openvox8-release has to be removed first, since both ship /etc/apt/preferences.d/openvox-release.pref; on EL they coexist). The 9.x upgrade_minor page points at that step. The final step upgrades every OpenVox package on a server host in one package manager transaction, because the 8.x server and database packages require openvox-agent below 9.0.0 while the 9.x packages require 9.0.0 or newer, so a host running both cannot upgrade them one at a time; the server-before-database order applies only across separate hosts.

Also adds the nav entry (before "Upgrading OpenVox 9") and cross-links the page from the breaking-changes callout in upgrade_minor.

File	Change
upgrade_major.md	New page
upgrade_minor.md	Callout links to the new page; the Linux package section points at the repository-switch step; the recommended-order section says a host running several components upgrades them in one transaction
openvox_9x.yml	Nav entry

Checks

• markdownlint clean; jekyll build clean; the page renders under /openvox/9.x/upgrade_major.html and the nav and upgrade_minor callout link to it. Every cross-collection link resolves now that Add OpenVox Server 9.x docs collection as a preview (latest stays on 8.x) #457, Add OpenVoxDB 9.x docs collection as a preview (latest stays on 8.x) #458, and Add OpenFact 6.x docs collection as a preview (latest stays on 5.x) #459 are merged.
• Every testable statement on the page was run against a 9.0.0-rc1 lab (EL9, EL10, Ubuntu 24.04; 62 checks on the server host and 43 per agent, plus an in-place 8.28.1 to rc1 agent upgrade for the gem section): all pass. Four observations from that run are folded into the text: the non-root missing-server message, the removed ldapname option making a fact resolve to nothing rather than raising, a version 3 hiera.yaml still loading with a deprecation warning, and the removed settings being ignored silently where 8 warned. Not testable there and taken from sources only: the dropped Debian 11/12 and Amazon Linux 2 packages, the gem's Ruby floor, module unit tests on Ruby 4, report processors under JRuby 10, and the PAL APIs.
• Package facts (release-package coexistence on EL, the apt preferences-file conflict on Debian/Ubuntu, the termini dependency) were checked against the published rc1 packages and repository metadata.
• The 9.0.0-rc4 update (the server check, its root error text, the checksum-like content change, and the Net::HTTP header change) is taken from the rc4 source and Ruby 4.0's NEWS file and has not been run in the lab.
• The 9.0.0 update is source-verified only: the GA release notes for openvox 9.0.0, openvox-server 9.0.1, and openvoxdb 9.0.0, the release announcement, _data/supported_platforms.yml, and the puppet-runtime Ruby build configs for the Windows encoding section. Nothing in it has been run in the lab, and the Windows section in particular has not been tried on a Windows node.
• The modified-auth.conf bullet: auth.conf is config(noreplace) in the 9.0.0-rc2 EL10 rpm and is listed in conffiles in the Ubuntu 24.04 deb, and the two rule differences come from a diff of the shipped file between 8.15.2 and 9.0.0-rc2. In an 8.28.1 to 9.0.0-rc2/rc4 lab upgrade (EL10 server, EL9 and Ubuntu 24.04 agents) with the stock file, a filebucket read with an agent certificate returned 403 and the same read with the server's certificate succeeded. The kept-file behavior was observed on that run for puppet.conf (.rpmnew on EL, .dpkg-dist on Ubuntu); an upgrade with a modified auth.conf itself has not been run.

Assisted by Claude.

[bastelfreak]

Suggested change

	sudo rpm -Uvh https://yum.voxpupuli.org/openvox9-release-el-9.noarch.rpm
	sudo dnf install https://yum.voxpupuli.org/openvox9-release-el-9.noarch.rpm

let's promote new tools!

[miharp]

done