From f0af1feb490bf710e864671b9c4204693954d224 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 12:06:40 -0500
Subject: [PATCH 01/13] Packaging: add bash shebang to rpm scriptlets

Use /bin/bash instead of /bin/sh so shfmt knows that these scriptlets
run with bash by default.
See: https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_default_shell
---
 packaging/rpm/scripts/post-install.sh | 1 +
 packaging/rpm/scripts/post-remove.sh  | 1 +
 packaging/rpm/scripts/pre-install.sh  | 1 +
 packaging/rpm/scripts/pre-remove.sh   | 1 +
 4 files changed, 4 insertions(+)

diff --git a/packaging/rpm/scripts/post-install.sh b/packaging/rpm/scripts/post-install.sh
index 362ff56b6d..100d6112ad 100644
--- a/packaging/rpm/scripts/post-install.sh
+++ b/packaging/rpm/scripts/post-install.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 set -e
 
 # This %post scriptlet gets one argument, $1, the number of packages of
diff --git a/packaging/rpm/scripts/post-remove.sh b/packaging/rpm/scripts/post-remove.sh
index f2cc17a977..51436eb1f9 100644
--- a/packaging/rpm/scripts/post-remove.sh
+++ b/packaging/rpm/scripts/post-remove.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 set -e
 
 # This %postun scriptlet gets one argument, $1, the number of packages of
diff --git a/packaging/rpm/scripts/pre-install.sh b/packaging/rpm/scripts/pre-install.sh
index 36d7325661..20c8da8ba1 100644
--- a/packaging/rpm/scripts/pre-install.sh
+++ b/packaging/rpm/scripts/pre-install.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 set -e
 
 # This %pre scriptlet gets one argument, $1, the number of packages of
diff --git a/packaging/rpm/scripts/pre-remove.sh b/packaging/rpm/scripts/pre-remove.sh
index 6f65230cca..eba05d61a3 100644
--- a/packaging/rpm/scripts/pre-remove.sh
+++ b/packaging/rpm/scripts/pre-remove.sh
@@ -1,3 +1,4 @@
+#!/bin/bash
 set -e
 
 # This %preun scriptlet gets one argument, $1, the number of packages of

From cd82f306d9e59cae9918c547bafee7ae4df0a076 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 12:22:50 -0500
Subject: [PATCH 02/13] Packaging: clarify rpm/deb diffs in create_users func

---
 packaging/deb/scripts/pre-install.sh | 2 +-
 packaging/rpm/scripts/pre-install.sh | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/packaging/deb/scripts/pre-install.sh b/packaging/deb/scripts/pre-install.sh
index a19994f80a..51f25b3166 100644
--- a/packaging/deb/scripts/pre-install.sh
+++ b/packaging/deb/scripts/pre-install.sh
@@ -20,7 +20,7 @@ PACKS_GROUP=st2packs
 SYS_USER=stanley
 ST2_USER=st2
 
-## Create stackstorm users and groups
+## Create stackstorm users and groups (adduser differs from EL)
 create_users() {
     # create st2 user (services user)
     (id $ST2_USER 1>/dev/null 2>&1) ||
diff --git a/packaging/rpm/scripts/pre-install.sh b/packaging/rpm/scripts/pre-install.sh
index 20c8da8ba1..e8e975ca97 100644
--- a/packaging/rpm/scripts/pre-install.sh
+++ b/packaging/rpm/scripts/pre-install.sh
@@ -11,7 +11,7 @@ PACKS_GROUP=%{packs_group}
 SYS_USER=%{stanley_user}
 ST2_USER=%{svc_user}
 
-## Create stackstorm users and groups (differs from debian)
+## Create stackstorm users and groups (adduser differs from debian)
 create_users() {
     # create st2 user (services user)
     (id $ST2_USER 1>/dev/null 2>&1) ||

From 9c0b25dd51dd1a711d17cf8be3bf54b73d850795 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 12:24:38 -0500
Subject: [PATCH 03/13] Packaging: manually expand rpm macros in rpm scriptlets

---
 packaging/rpm/scripts/post-install.sh | 30 +++++++++++++++++++++++----
 packaging/rpm/scripts/post-remove.sh  | 29 ++++++++++++++++++++++----
 packaging/rpm/scripts/pre-install.sh  |  6 +++---
 packaging/rpm/scripts/pre-remove.sh   | 29 ++++++++++++++++++++++----
 4 files changed, 79 insertions(+), 15 deletions(-)

diff --git a/packaging/rpm/scripts/post-install.sh b/packaging/rpm/scripts/post-install.sh
index 100d6112ad..d2c2a82f30 100644
--- a/packaging/rpm/scripts/post-install.sh
+++ b/packaging/rpm/scripts/post-install.sh
@@ -7,10 +7,32 @@ set -e
 #   * on upgrade: $1 > 1
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 
-# from %post in st2-packages.git/packages/st2/rpm/st2.spec
-%service_post st2actionrunner st2api st2stream st2auth st2notifier st2workflowengine
-%service_post st2rulesengine st2timersengine st2sensorcontainer st2garbagecollector
-%service_post st2scheduler
+_ST2_SERVICES="
+st2actionrunner
+st2api
+st2auth
+st2garbagecollector
+st2notifier
+st2rulesengine
+st2scheduler
+st2sensorcontainer
+st2stream
+st2timersengine
+st2workflowengine
+"
+
+# EL 8: %service_post
+if [ $1 -eq 1 ]; then
+    # Initial installation
+    systemctl --no-reload preset ${_ST2_SERVICES} &>/dev/null || :
+fi
+# EL 9: %service_post
+if [ $1 -eq 1 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
+    # Initial installation
+    /usr/lib/systemd/systemd-update-helper install-system-units ${_ST2_SERVICES} || :
+fi
+
+systemctl --no-reload enable ${_ST2_SERVICES} &>/dev/null || :
 
 # make sure that our socket generators run
 systemctl daemon-reload >/dev/null 2>&1 || true
diff --git a/packaging/rpm/scripts/post-remove.sh b/packaging/rpm/scripts/post-remove.sh
index 51436eb1f9..e872f62d8b 100644
--- a/packaging/rpm/scripts/post-remove.sh
+++ b/packaging/rpm/scripts/post-remove.sh
@@ -7,10 +7,31 @@ set -e
 #   * on uninstall: $1 = 0
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 
-# from %postun in st2-packages.git/packages/st2/rpm/st2.spec
-%service_postun st2actionrunner %{worker_name} st2api st2stream st2auth st2notifier st2workflowengine
-%service_postun st2rulesengine st2timersengine st2sensorcontainer st2garbagecollector
-%service_postun st2scheduler
+_ST2_SERVICES="
+st2actionrunner
+st2actionrunner@
+st2api
+st2auth
+st2garbagecollector
+st2notifier
+st2rulesengine
+st2scheduler
+st2sensorcontainer
+st2stream
+st2timersengine
+st2workflowengine
+"
+
+# EL 8: %service_postun
+if [ $1 -ge 1 ]; then
+    # Package upgrade, not uninstall
+    systemctl try-restart ${_ST2_SERVICES} &>/dev/null || :
+fi
+# EL 9: %service_postun
+if [ $1 -ge 1 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
+    # Package upgrade, not uninstall
+    /usr/lib/systemd/systemd-update-helper mark-restart-system-units ${_ST2_SERVICES} || :
+fi
 
 # Remove st2 logrotate config, since there's no analog of apt-get purge available
 if [ $1 -eq 0 ]; then
diff --git a/packaging/rpm/scripts/pre-install.sh b/packaging/rpm/scripts/pre-install.sh
index e8e975ca97..81507169b6 100644
--- a/packaging/rpm/scripts/pre-install.sh
+++ b/packaging/rpm/scripts/pre-install.sh
@@ -7,9 +7,9 @@ set -e
 #   * on upgrade: $1 > 1
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 
-PACKS_GROUP=%{packs_group}
-SYS_USER=%{stanley_user}
-ST2_USER=%{svc_user}
+PACKS_GROUP=st2packs
+SYS_USER=stanley
+ST2_USER=st2
 
 ## Create stackstorm users and groups (adduser differs from debian)
 create_users() {
diff --git a/packaging/rpm/scripts/pre-remove.sh b/packaging/rpm/scripts/pre-remove.sh
index eba05d61a3..cb24381c1b 100644
--- a/packaging/rpm/scripts/pre-remove.sh
+++ b/packaging/rpm/scripts/pre-remove.sh
@@ -7,7 +7,28 @@ set -e
 #   * on uninstall: $1 = 0
 # https://docs.fedoraproject.org/en-US/packaging-guidelines/Scriptlets/#_syntax
 
-# from %preun in st2-packages.git/packages/st2/rpm/st2.spec
-%service_preun st2actionrunner %{worker_name} st2api st2stream st2auth st2notifier st2workflowengine
-%service_preun st2rulesengine st2timersengine st2sensorcontainer st2garbagecollector
-%service_preun st2scheduler
+_ST2_SERVICES="
+st2actionrunner
+st2actionrunner@
+st2api
+st2auth
+st2garbagecollector
+st2notifier
+st2rulesengine
+st2scheduler
+st2sensorcontainer
+st2stream
+st2timersengine
+st2workflowengine
+"
+
+# EL 8: %service_preun
+if [ $1 -eq 0 ]; then
+    # Package removal, not upgrade
+    systemctl --no-reload disable --now ${_ST2_SERVICES} &>/dev/null || :
+fi
+# EL 9: %service_preun
+if [ $1 -eq 0 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
+    # Package removal, not upgrade
+    /usr/lib/systemd/systemd-update-helper remove-system-units ${_ST2_SERVICES} || :
+fi

From fb75e694ce196c16de35843bdeeb3d76997efa97 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 12:31:52 -0500
Subject: [PATCH 04/13] Packaging: simplify deb pre-install script

---
 packaging/deb/scripts/pre-install.sh | 5 +----
 1 file changed, 1 insertion(+), 4 deletions(-)

diff --git a/packaging/deb/scripts/pre-install.sh b/packaging/deb/scripts/pre-install.sh
index 51f25b3166..e92c96b8a0 100644
--- a/packaging/deb/scripts/pre-install.sh
+++ b/packaging/deb/scripts/pre-install.sh
@@ -39,10 +39,7 @@ create_users() {
 }
 
 case "$1" in
-    install)
-        create_users
-        ;;
-    upgrade)
+    install | upgrade)
         create_users
         ;;
     abort-upgrade) ;;

From 63e3f56421768fbf47858f24adfe2acebea23c2f Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 12:54:09 -0500
Subject: [PATCH 05/13] packaging: begin expanding DEBHELPERs

---
 packaging/deb/scripts/post-install.sh | 45 +++++++++++++++++++++++++++
 packaging/deb/scripts/post-remove.sh  | 40 ++++++++++++++++++++++++
 packaging/deb/scripts/pre-remove.sh   | 20 ++++++++++++
 3 files changed, 105 insertions(+)

diff --git a/packaging/deb/scripts/post-install.sh b/packaging/deb/scripts/post-install.sh
index 43b9cad25d..9095c2109d 100644
--- a/packaging/deb/scripts/post-install.sh
+++ b/packaging/deb/scripts/post-install.sh
@@ -29,6 +29,21 @@ set -e
 # https://www.mankier.com/5/deb-triggers
 # https://stackoverflow.com/questions/15276535/dpkg-how-to-use-trigger
 
+# This must include ".service" to satisfy deb-systemd-{helper,invoke}
+_ST2_SERVICES="
+st2actionrunner.service
+st2api.service
+st2auth.service
+st2garbagecollector.service
+st2notifier.service
+st2rulesengine.service
+st2scheduler.service
+st2sensorcontainer.service
+st2stream.service
+st2timersengine.service
+st2workflowengine.service
+"
+
 case "$1" in
     configure)
         # make sure that our socket generators run
@@ -44,7 +59,37 @@ esac
 
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
+# includes:
+#   dh_python2: dh-virtualenv
+#   dh_systemd_enable/12.10ubuntu1
+#   dh_systemd_start/12.10ubuntu1
 
 #DEBHELPER#
 
+# based on dh_systemd_enable/12.10ubuntu1 and dh_systemd_start/12.10ubuntu1
+if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ]; then
+    for service in ${_ST2_SERVICES}; do
+        # This will only remove masks created by d-s-h on package removal.
+        deb-systemd-helper unmask "${service}" >/dev/null || true
+
+        # was-enabled defaults to true, so new installations run enable.
+        if deb-systemd-helper --quiet was-enabled "${service}"; then
+            # Enables the unit on first installation, creates new
+            # symlinks on upgrades if the unit file has changed.
+            deb-systemd-helper enable "${service}" >/dev/null || true
+        else
+            # Update the statefile to add new symlinks (if any), which need to be
+            # cleaned up on purge. Also remove old symlinks.
+            deb-systemd-helper update-state "${service}" >/dev/null || true
+        fi
+    done
+    systemctl --system daemon-reload >/dev/null || true
+    if [ -n "$2" ]; then
+        _dh_action=restart
+    else
+        _dh_action=start
+    fi
+    deb-systemd-invoke $_dh_action ${_ST2_SERVICES} >/dev/null || true
+fi
+
 exit 0
diff --git a/packaging/deb/scripts/post-remove.sh b/packaging/deb/scripts/post-remove.sh
index 0347af5c40..f75d6a0ec9 100644
--- a/packaging/deb/scripts/post-remove.sh
+++ b/packaging/deb/scripts/post-remove.sh
@@ -24,6 +24,21 @@ set -e
 #         on upgrade failed (after <new-preinst> or <old-postrm> failed)
 # https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html
 
+# This must include ".service" to satisfy deb-systemd-helper
+_ST2_SERVICES="
+st2actionrunner.service
+st2api.service
+st2auth.service
+st2garbagecollector.service
+st2notifier.service
+st2rulesengine.service
+st2scheduler.service
+st2sensorcontainer.service
+st2stream.service
+st2timersengine.service
+st2workflowengine.service
+"
+
 purge_files() {
     # This -pkgsaved.disabled file might be left over from old (buggy) deb packages
     rm -f /etc/logrotate.d/st2-pkgsaved.disabled 1>/dev/null 2>&1 || :
@@ -48,7 +63,32 @@ esac
 
 # dh_installdeb will replace this with shell code automatically
 # generated by other debhelper scripts.
+# includes:
+#   dh_python2: dh-virtualenv
+#   dh_systemd_enable/12.10ubuntu1
+#   dh_systemd_start/12.10ubuntu1
 
 #DEBHELPER#
 
+# based on dh_systemd_start/12.10ubuntu1
+if [ -d /run/systemd/system ]; then
+    systemctl --system daemon-reload >/dev/null || true
+fi
+
+for service in ${_ST2_SERVICES}; do
+    # based on dh_systemd_enable/12.10ubuntu1 and dh_systemd_start/12.10ubuntu1
+    if [ "$1" = "remove" ]; then
+        if [ -x "/usr/bin/deb-systemd-helper" ]; then
+            deb-systemd-helper mask "${service}" >/dev/null || true
+        fi
+    fi
+
+    if [ "$1" = "purge" ]; then
+        if [ -x "/usr/bin/deb-systemd-helper" ]; then
+            deb-systemd-helper purge "${service}" >/dev/null || true
+            deb-systemd-helper unmask "${service}" >/dev/null || true
+        fi
+    fi
+done
+
 exit 0
diff --git a/packaging/deb/scripts/pre-remove.sh b/packaging/deb/scripts/pre-remove.sh
index fc644fd39c..c43289f8cb 100644
--- a/packaging/deb/scripts/pre-remove.sh
+++ b/packaging/deb/scripts/pre-remove.sh
@@ -17,3 +17,23 @@ set -e
 #     <new-prerm> failed-upgrade <old-version> <new-version>
 #         on upgrade failed (after <old-prerm> failed)
 # https://www.debian.org/doc/debian-policy/ch-maintainerscripts.html
+
+# This must include ".service" to satisfy deb-systemd-invoke
+_ST2_SERVICES="
+st2actionrunner.service
+st2api.service
+st2auth.service
+st2garbagecollector.service
+st2notifier.service
+st2rulesengine.service
+st2scheduler.service
+st2sensorcontainer.service
+st2stream.service
+st2timersengine.service
+st2workflowengine.service
+"
+
+# based on dh_systemd_start/12.10ubuntu1
+if [ -d /run/systemd/system ] && [ "$1" = remove ]; then
+    systemctl stop ${_ST2_SERVICES} >/dev/null || true
+fi

From f1e5d15e9a2def1a1ded5ec0e6eddc78872dd4a0 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 13:33:14 -0500
Subject: [PATCH 06/13] packaging: forwards compat in deb scripts - no error on
 unknown arg

---
 packaging/deb/scripts/post-install.sh | 4 ++--
 packaging/deb/scripts/post-remove.sh  | 4 ++--
 packaging/deb/scripts/pre-install.sh  | 4 ++--
 3 files changed, 6 insertions(+), 6 deletions(-)

diff --git a/packaging/deb/scripts/post-install.sh b/packaging/deb/scripts/post-install.sh
index 9095c2109d..02fa10e324 100644
--- a/packaging/deb/scripts/post-install.sh
+++ b/packaging/deb/scripts/post-install.sh
@@ -52,8 +52,8 @@ case "$1" in
     abort-upgrade | abort-remove | abort-deconfigure) ;;
 
     *)
-        echo "postinst called with unknown argument \`$1'" >&2
-        exit 1
+        # echo "postinst called with unknown argument \`$1'" >&2
+        # exit 1
         ;;
 esac
 
diff --git a/packaging/deb/scripts/post-remove.sh b/packaging/deb/scripts/post-remove.sh
index f75d6a0ec9..61d4481f34 100644
--- a/packaging/deb/scripts/post-remove.sh
+++ b/packaging/deb/scripts/post-remove.sh
@@ -56,8 +56,8 @@ case "$1" in
         ;;
     remove | upgrade | failed-upgrade | abort-install | abort-upgrade | disappear) ;;
     *)
-        echo "postrm called with unknown argument \`$1'" >&2
-        exit 1
+        # echo "postrm called with unknown argument \`$1'" >&2
+        # exit 1
         ;;
 esac
 
diff --git a/packaging/deb/scripts/pre-install.sh b/packaging/deb/scripts/pre-install.sh
index e92c96b8a0..41627f4458 100644
--- a/packaging/deb/scripts/pre-install.sh
+++ b/packaging/deb/scripts/pre-install.sh
@@ -44,8 +44,8 @@ case "$1" in
         ;;
     abort-upgrade) ;;
     *)
-        echo "preinst called with unknown argument \`$1'" >&2
-        exit 1
+        # echo "preinst called with unknown argument \`$1'" >&2
+        # exit 1
         ;;
 esac
 

From e189d12139534a7e7c09ba494e610c289f2b86d6 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 8 Jan 2025 11:11:36 -0600
Subject: [PATCH 07/13] Packaging: Improve systemd logic in
 deb/scripts/post-install.sh

I initially copied the logic from some of the rpm's generated with
native deb tooling. I wanted to link to the actual sources, however,
to facilitate comparing the logic for future updates.
---
 packaging/deb/scripts/post-install.sh | 83 ++++++++++++++-------------
 1 file changed, 44 insertions(+), 39 deletions(-)

diff --git a/packaging/deb/scripts/post-install.sh b/packaging/deb/scripts/post-install.sh
index 02fa10e324..dba57021c9 100644
--- a/packaging/deb/scripts/post-install.sh
+++ b/packaging/deb/scripts/post-install.sh
@@ -44,52 +44,57 @@ st2timersengine.service
 st2workflowengine.service
 "
 
+# Native .deb maintainer scripts are injected with debhelper snippets.
+# We are using nfpm, so we inline those snippets here.
+# https://github.com/Debian/debhelper/blob/debian/12.10/dh_systemd_start
+# https://github.com/Debian/debhelper/blob/debian/12.10/dh_systemd_enable
+# https://github.com/Debian/debhelper/blob/debian/12.10/autoscripts/postinst-systemd-enable
+# https://github.com/Debian/debhelper/blob/debian/12.10/autoscripts/postinst-systemd-restart
+
+systemd_enable() {
+    # This will only remove masks created by d-s-h on package removal.
+    deb-systemd-helper unmask "${1}" >/dev/null || true
+
+    # was-enabled defaults to true, so new installations run enable.
+    if deb-systemd-helper --quiet was-enabled "${1}"; then
+        # Enables the unit on first installation, creates new
+        # symlinks on upgrades if the unit file has changed.
+        deb-systemd-helper enable "${1}" >/dev/null || true
+    else
+        # Update the statefile to add new symlinks (if any), which need to be
+        # cleaned up on purge. Also remove old symlinks.
+        deb-systemd-helper update-state "${1}" >/dev/null || true
+    fi
+}
+
+if [ -n "$2" ]; then
+    _dh_action=restart
+else
+    _dh_action=start
+fi
+
+systemd_enable_and_restart() {
+    for service in ${@}; do
+        systmd_enable "${service}"
+    done
+    if [ -d /run/systemd/system ]; then
+        systemctl --system daemon-reload >/dev/null || true
+        deb-systemd-invoke $_dh_action ${@} >/dev/null || true
+    fi
+}
+
 case "$1" in
     configure)
-        # make sure that our socket generators run
-        systemctl daemon-reload >/dev/null 2>&1 || true
+        systemd_enable_and_restart ${_ST2_SERVICES}
+        ;;
+    abort-upgrade | abort-remove | abort-deconfigure)
+        # dh_systemd_* runs this for all actions, not just configure
+        systemd_enable_and_restart ${_ST2_SERVICES}
         ;;
-    abort-upgrade | abort-remove | abort-deconfigure) ;;
-
     *)
         # echo "postinst called with unknown argument \`$1'" >&2
         # exit 1
         ;;
 esac
 
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-# includes:
-#   dh_python2: dh-virtualenv
-#   dh_systemd_enable/12.10ubuntu1
-#   dh_systemd_start/12.10ubuntu1
-
-#DEBHELPER#
-
-# based on dh_systemd_enable/12.10ubuntu1 and dh_systemd_start/12.10ubuntu1
-if [ "$1" = "configure" ] || [ "$1" = "abort-upgrade" ] || [ "$1" = "abort-deconfigure" ] || [ "$1" = "abort-remove" ]; then
-    for service in ${_ST2_SERVICES}; do
-        # This will only remove masks created by d-s-h on package removal.
-        deb-systemd-helper unmask "${service}" >/dev/null || true
-
-        # was-enabled defaults to true, so new installations run enable.
-        if deb-systemd-helper --quiet was-enabled "${service}"; then
-            # Enables the unit on first installation, creates new
-            # symlinks on upgrades if the unit file has changed.
-            deb-systemd-helper enable "${service}" >/dev/null || true
-        else
-            # Update the statefile to add new symlinks (if any), which need to be
-            # cleaned up on purge. Also remove old symlinks.
-            deb-systemd-helper update-state "${service}" >/dev/null || true
-        fi
-    done
-    systemctl --system daemon-reload >/dev/null || true
-    if [ -n "$2" ]; then
-        _dh_action=restart
-    else
-        _dh_action=start
-    fi
-    deb-systemd-invoke $_dh_action ${_ST2_SERVICES} >/dev/null || true
-fi
-
 exit 0

From fd6de4f31f0a0b6acbbcd2149c5cb1c87ac973c8 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 8 Jan 2025 11:42:44 -0600
Subject: [PATCH 08/13] Packaging: Improve systemd logic in
 deb/scripts/{post,pre}-remove.sh

I initially copied the logic from some of the rpm's generated with
native deb tooling. I wanted to link to the actual sources, however,
to facilitate comparing the logic for future updates.
---
 packaging/deb/scripts/post-remove.sh | 64 ++++++++++++++--------------
 packaging/deb/scripts/pre-remove.sh  | 27 ++++++++++--
 2 files changed, 56 insertions(+), 35 deletions(-)

diff --git a/packaging/deb/scripts/post-remove.sh b/packaging/deb/scripts/post-remove.sh
index 61d4481f34..45715929a9 100644
--- a/packaging/deb/scripts/post-remove.sh
+++ b/packaging/deb/scripts/post-remove.sh
@@ -39,6 +39,32 @@ st2timersengine.service
 st2workflowengine.service
 "
 
+# Native .deb maintainer scripts are injected with debhelper snippets.
+# We are using nfpm, so we inline those snippets here.
+# https://github.com/Debian/debhelper/blob/debian/12.10/dh_systemd_start
+# https://github.com/Debian/debhelper/blob/debian/12.10/dh_systemd_enable
+# https://github.com/Debian/debhelper/blob/debian/12.10/autoscripts/postrm-systemd
+# https://github.com/Debian/debhelper/blob/debian/12.10/autoscripts/postrm-systemd-reload-only
+
+systemd_remove() {
+    if [ -x "/usr/bin/deb-systemd-helper" ]; then
+        deb-systemd-helper mask ${@} >/dev/null || true
+    fi
+}
+
+systemd_purge() {
+    if [ -x "/usr/bin/deb-systemd-helper" ]; then
+        deb-systemd-helper purge ${@} >/dev/null || true
+        deb-systemd-helper unmask ${@} >/dev/null || true
+    fi
+}
+
+systemd_reload() {
+    if [ -d "/run/systemd/system" ]; then
+        systemctl --system daemon-reload >/dev/null || true
+    fi
+}
+
 purge_files() {
     # This -pkgsaved.disabled file might be left over from old (buggy) deb packages
     rm -f /etc/logrotate.d/st2-pkgsaved.disabled 1>/dev/null 2>&1 || :
@@ -51,44 +77,20 @@ purge_files() {
 }
 
 case "$1" in
+    remove)
+        systemd_remove ${_ST2_SERVICES}
+        systemd_reload
+        ;;
     purge)
+        systemd_purge ${_ST2_SERVICES}
+        systemd_reload
         purge_files
         ;;
-    remove | upgrade | failed-upgrade | abort-install | abort-upgrade | disappear) ;;
+    upgrade | failed-upgrade | abort-install | abort-upgrade | disappear) ;;
     *)
         # echo "postrm called with unknown argument \`$1'" >&2
         # exit 1
         ;;
 esac
 
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-# includes:
-#   dh_python2: dh-virtualenv
-#   dh_systemd_enable/12.10ubuntu1
-#   dh_systemd_start/12.10ubuntu1
-
-#DEBHELPER#
-
-# based on dh_systemd_start/12.10ubuntu1
-if [ -d /run/systemd/system ]; then
-    systemctl --system daemon-reload >/dev/null || true
-fi
-
-for service in ${_ST2_SERVICES}; do
-    # based on dh_systemd_enable/12.10ubuntu1 and dh_systemd_start/12.10ubuntu1
-    if [ "$1" = "remove" ]; then
-        if [ -x "/usr/bin/deb-systemd-helper" ]; then
-            deb-systemd-helper mask "${service}" >/dev/null || true
-        fi
-    fi
-
-    if [ "$1" = "purge" ]; then
-        if [ -x "/usr/bin/deb-systemd-helper" ]; then
-            deb-systemd-helper purge "${service}" >/dev/null || true
-            deb-systemd-helper unmask "${service}" >/dev/null || true
-        fi
-    fi
-done
-
 exit 0
diff --git a/packaging/deb/scripts/pre-remove.sh b/packaging/deb/scripts/pre-remove.sh
index c43289f8cb..41c7daf8f1 100644
--- a/packaging/deb/scripts/pre-remove.sh
+++ b/packaging/deb/scripts/pre-remove.sh
@@ -33,7 +33,26 @@ st2timersengine.service
 st2workflowengine.service
 "
 
-# based on dh_systemd_start/12.10ubuntu1
-if [ -d /run/systemd/system ] && [ "$1" = remove ]; then
-    systemctl stop ${_ST2_SERVICES} >/dev/null || true
-fi
+# Native .deb maintainer scripts are injected with debhelper snippets.
+# We are using nfpm, so we inline those snippets here.
+# https://github.com/Debian/debhelper/blob/debian/12.10/dh_systemd_start
+# https://github.com/Debian/debhelper/blob/debian/12.10/autoscripts/prerm-systemd-restart
+
+systemd_stop() {
+    if [ -d "/run/systemd/system" ]; then
+        deb-systemd-invoke stop ${@} >/dev/null || true
+    fi
+}
+
+case "$1" in
+    remove)
+        systemd_stop ${_ST2_SERVICES}
+        ;;
+    upgrade | deconfigure | failed-upgrade) ;;
+    *)
+        # echo "prerm called with unknown argument \`$1'" >&2
+        # exit 1
+        ;;
+esac
+
+exit 0

From 10ff25569d1cf395889a3e3d0228dedb7b4cfed2 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 8 Jan 2025 14:42:09 -0600
Subject: [PATCH 09/13] Packaging: Finish systemd logic in rpm/scripts

I initially copied the logic from some of the rpm's generated with
native rpm tooling. I wanted to link to the actual sources, however,
to facilitate comparing the logic for future updates.

st2.spec used %service_* macros which were defined in helper.spec
which used %systemd_* macros. Now, I've linked to the actual
systemd macro sources and cleanly combined the logic for EL8+9.
---
 packaging/rpm/scripts/post-install.sh | 20 ++++++++++++--------
 packaging/rpm/scripts/post-remove.sh  | 18 +++++++++++-------
 packaging/rpm/scripts/pre-remove.sh   | 18 +++++++++++-------
 3 files changed, 34 insertions(+), 22 deletions(-)

diff --git a/packaging/rpm/scripts/post-install.sh b/packaging/rpm/scripts/post-install.sh
index d2c2a82f30..9f2e7b0457 100644
--- a/packaging/rpm/scripts/post-install.sh
+++ b/packaging/rpm/scripts/post-install.sh
@@ -21,18 +21,22 @@ st2timersengine
 st2workflowengine
 "
 
-# EL 8: %service_post
+# Native .rpm specs use macros that get expanded into shell snippets.
+# We are using nfpm, so we inline the macro expansion here.
+# %systemd_post
+#   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
+#   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
+
 if [ $1 -eq 1 ]; then
     # Initial installation
-    systemctl --no-reload preset ${_ST2_SERVICES} &>/dev/null || :
-fi
-# EL 9: %service_post
-if [ $1 -eq 1 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
-    # Initial installation
-    /usr/lib/systemd/systemd-update-helper install-system-units ${_ST2_SERVICES} || :
+    if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        /usr/lib/systemd/systemd-update-helper install-system-units ${_ST2_SERVICES} || :
+    else # EL 8
+        systemctl --no-reload preset ${_ST2_SERVICES} &>/dev/null || :
+    fi
 fi
 
 systemctl --no-reload enable ${_ST2_SERVICES} &>/dev/null || :
 
-# make sure that our socket generators run
+# make sure that our socket/unit generators run
 systemctl daemon-reload >/dev/null 2>&1 || true
diff --git a/packaging/rpm/scripts/post-remove.sh b/packaging/rpm/scripts/post-remove.sh
index e872f62d8b..a9f67a5f5b 100644
--- a/packaging/rpm/scripts/post-remove.sh
+++ b/packaging/rpm/scripts/post-remove.sh
@@ -22,15 +22,19 @@ st2timersengine
 st2workflowengine
 "
 
-# EL 8: %service_postun
+# Native .rpm specs use macros that get expanded into shell snippets.
+# We are using nfpm, so we inline the macro expansion here.
+# %systemd_postun_with_restart
+#   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
+#   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
+
 if [ $1 -ge 1 ]; then
     # Package upgrade, not uninstall
-    systemctl try-restart ${_ST2_SERVICES} &>/dev/null || :
-fi
-# EL 9: %service_postun
-if [ $1 -ge 1 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
-    # Package upgrade, not uninstall
-    /usr/lib/systemd/systemd-update-helper mark-restart-system-units ${_ST2_SERVICES} || :
+    if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        /usr/lib/systemd/systemd-update-helper mark-restart-system-units ${_ST2_SERVICES} || :
+    else # EL 8
+        systemctl try-restart ${_ST2_SERVICES} &>/dev/null || :
+    fi
 fi
 
 # Remove st2 logrotate config, since there's no analog of apt-get purge available
diff --git a/packaging/rpm/scripts/pre-remove.sh b/packaging/rpm/scripts/pre-remove.sh
index cb24381c1b..af924e2a60 100644
--- a/packaging/rpm/scripts/pre-remove.sh
+++ b/packaging/rpm/scripts/pre-remove.sh
@@ -22,13 +22,17 @@ st2timersengine
 st2workflowengine
 "
 
-# EL 8: %service_preun
+# Native .rpm specs use macros that get expanded into shell snippets.
+# We are using nfpm, so we inline the macro expansion here.
+# %systemd_preun
+#   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
+#   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
+
 if [ $1 -eq 0 ]; then
     # Package removal, not upgrade
-    systemctl --no-reload disable --now ${_ST2_SERVICES} &>/dev/null || :
-fi
-# EL 9: %service_preun
-if [ $1 -eq 0 ] && [ -x "/usr/lib/systemd/systemd-update-helper" ]; then
-    # Package removal, not upgrade
-    /usr/lib/systemd/systemd-update-helper remove-system-units ${_ST2_SERVICES} || :
+    if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        /usr/lib/systemd/systemd-update-helper remove-system-units ${_ST2_SERVICES} || :
+    else # EL 8
+        systemctl --no-reload disable --now ${_ST2_SERVICES} &>/dev/null || :
+    fi
 fi

From ac7297b12fdde1de1da29a87df33f95c6956057f Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Wed, 8 Jan 2025 14:56:25 -0600
Subject: [PATCH 10/13] Packaging: Use systemd-update-helper in
 rpm/scripts/post-install.sh

---
 packaging/rpm/scripts/post-install.sh | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packaging/rpm/scripts/post-install.sh b/packaging/rpm/scripts/post-install.sh
index 9f2e7b0457..b65e01607c 100644
--- a/packaging/rpm/scripts/post-install.sh
+++ b/packaging/rpm/scripts/post-install.sh
@@ -36,7 +36,12 @@ if [ $1 -eq 1 ]; then
     fi
 fi
 
+# TODO: Maybe remove this as 'preset' (on install above) enables units by default
 systemctl --no-reload enable ${_ST2_SERVICES} &>/dev/null || :
 
 # make sure that our socket/unit generators run
-systemctl daemon-reload >/dev/null 2>&1 || true
+if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+    /usr/lib/systemd/systemd-update-helper system-reload || :
+else # EL 8
+    systemctl daemon-reload &>/dev/null || :
+fi

From 1f503a93e2f1c7634d56311ad0d143248fab28db Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Mon, 17 Mar 2025 13:52:27 -0500
Subject: [PATCH 11/13] packaging: drop DEBHELPER comment in pre-install script

---
 packaging/deb/scripts/pre-install.sh | 5 -----
 1 file changed, 5 deletions(-)

diff --git a/packaging/deb/scripts/pre-install.sh b/packaging/deb/scripts/pre-install.sh
index 41627f4458..9e56546be3 100644
--- a/packaging/deb/scripts/pre-install.sh
+++ b/packaging/deb/scripts/pre-install.sh
@@ -49,9 +49,4 @@ case "$1" in
         ;;
 esac
 
-# dh_installdeb will replace this with shell code automatically
-# generated by other debhelper scripts.
-
-#DEBHELPER#
-
 exit 0

From fae93194ef3f0eb391952855d6b5eb2ac01f09d4 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Tue, 18 Mar 2025 11:44:51 -0500
Subject: [PATCH 12/13] add merge conflict magnet

---
 CHANGELOG.rst | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/CHANGELOG.rst b/CHANGELOG.rst
index bdbbf0e572..51ed203988 100644
--- a/CHANGELOG.rst
+++ b/CHANGELOG.rst
@@ -79,7 +79,7 @@ Added
   to pants' use of PEX lockfiles. This is not a user-facing addition.
   #6118 #6141 #6133 #6120 #6181 #6183 #6200 #6237 #6229 #6240 #6241 #6244 #6251 #6253
   #6254 #6258 #6259 #6260 #6269 #6275 #6279 #6278 #6282 #6283 #6273 #6287 #6306 #6307
-  #6311 #6314 #6315 #6317
+  #6311 #6314 #6315 #6317 #6319
   Contributed by @cognifloyd
 * Build of ST2 EL9 packages #6153
   Contributed by @amanda11

From 775b902e36f7b48f3e8528d37dba1fd0b41cbcd6 Mon Sep 17 00:00:00 2001
From: Jacob Floyd <cognifloyd@gmail.com>
Date: Tue, 18 Mar 2025 21:13:46 -0500
Subject: [PATCH 13/13] packaging: enable shellcheck on deb/rpm scripts

---
 packaging/deb/scripts/BUILD           | 2 +-
 packaging/deb/scripts/post-install.sh | 8 +++++---
 packaging/deb/scripts/post-remove.sh  | 8 +++++---
 packaging/deb/scripts/pre-remove.sh   | 3 ++-
 packaging/rpm/scripts/BUILD           | 2 +-
 packaging/rpm/scripts/post-install.sh | 5 ++++-
 packaging/rpm/scripts/post-remove.sh  | 6 ++++--
 packaging/rpm/scripts/pre-remove.sh   | 4 +++-
 8 files changed, 25 insertions(+), 13 deletions(-)

diff --git a/packaging/deb/scripts/BUILD b/packaging/deb/scripts/BUILD
index 31c2d6bc4c..6c95f66377 100644
--- a/packaging/deb/scripts/BUILD
+++ b/packaging/deb/scripts/BUILD
@@ -1 +1 @@
-shell_sources(skip_shellcheck=True)
+shell_sources()
diff --git a/packaging/deb/scripts/post-install.sh b/packaging/deb/scripts/post-install.sh
index dba57021c9..539fe027ef 100644
--- a/packaging/deb/scripts/post-install.sh
+++ b/packaging/deb/scripts/post-install.sh
@@ -74,21 +74,23 @@ else
 fi
 
 systemd_enable_and_restart() {
-    for service in ${@}; do
-        systmd_enable "${service}"
+    for service in "${@}"; do
+        systemd_enable "${service}"
     done
     if [ -d /run/systemd/system ]; then
         systemctl --system daemon-reload >/dev/null || true
-        deb-systemd-invoke $_dh_action ${@} >/dev/null || true
+        deb-systemd-invoke $_dh_action "${@}" >/dev/null || true
     fi
 }
 
 case "$1" in
     configure)
+        # shellcheck disable=SC2086
         systemd_enable_and_restart ${_ST2_SERVICES}
         ;;
     abort-upgrade | abort-remove | abort-deconfigure)
         # dh_systemd_* runs this for all actions, not just configure
+        # shellcheck disable=SC2086
         systemd_enable_and_restart ${_ST2_SERVICES}
         ;;
     *)
diff --git a/packaging/deb/scripts/post-remove.sh b/packaging/deb/scripts/post-remove.sh
index 45715929a9..53b1ca695a 100644
--- a/packaging/deb/scripts/post-remove.sh
+++ b/packaging/deb/scripts/post-remove.sh
@@ -48,14 +48,14 @@ st2workflowengine.service
 
 systemd_remove() {
     if [ -x "/usr/bin/deb-systemd-helper" ]; then
-        deb-systemd-helper mask ${@} >/dev/null || true
+        deb-systemd-helper mask "${@}" >/dev/null || true
     fi
 }
 
 systemd_purge() {
     if [ -x "/usr/bin/deb-systemd-helper" ]; then
-        deb-systemd-helper purge ${@} >/dev/null || true
-        deb-systemd-helper unmask ${@} >/dev/null || true
+        deb-systemd-helper purge "${@}" >/dev/null || true
+        deb-systemd-helper unmask "${@}" >/dev/null || true
     fi
 }
 
@@ -78,10 +78,12 @@ purge_files() {
 
 case "$1" in
     remove)
+        # shellcheck disable=SC2086
         systemd_remove ${_ST2_SERVICES}
         systemd_reload
         ;;
     purge)
+        # shellcheck disable=SC2086
         systemd_purge ${_ST2_SERVICES}
         systemd_reload
         purge_files
diff --git a/packaging/deb/scripts/pre-remove.sh b/packaging/deb/scripts/pre-remove.sh
index 41c7daf8f1..6ddef75a52 100644
--- a/packaging/deb/scripts/pre-remove.sh
+++ b/packaging/deb/scripts/pre-remove.sh
@@ -40,12 +40,13 @@ st2workflowengine.service
 
 systemd_stop() {
     if [ -d "/run/systemd/system" ]; then
-        deb-systemd-invoke stop ${@} >/dev/null || true
+        deb-systemd-invoke stop "${@}" >/dev/null || true
     fi
 }
 
 case "$1" in
     remove)
+        # shellcheck disable=SC2086
         systemd_stop ${_ST2_SERVICES}
         ;;
     upgrade | deconfigure | failed-upgrade) ;;
diff --git a/packaging/rpm/scripts/BUILD b/packaging/rpm/scripts/BUILD
index 31c2d6bc4c..6c95f66377 100644
--- a/packaging/rpm/scripts/BUILD
+++ b/packaging/rpm/scripts/BUILD
@@ -1 +1 @@
-shell_sources(skip_shellcheck=True)
+shell_sources()
diff --git a/packaging/rpm/scripts/post-install.sh b/packaging/rpm/scripts/post-install.sh
index b65e01607c..264dd0616f 100644
--- a/packaging/rpm/scripts/post-install.sh
+++ b/packaging/rpm/scripts/post-install.sh
@@ -27,15 +27,18 @@ st2workflowengine
 #   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
 #   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
 
-if [ $1 -eq 1 ]; then
+if [ "$1" -eq 1 ]; then
     # Initial installation
     if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        # shellcheck disable=SC2086
         /usr/lib/systemd/systemd-update-helper install-system-units ${_ST2_SERVICES} || :
     else # EL 8
+        # shellcheck disable=SC2086
         systemctl --no-reload preset ${_ST2_SERVICES} &>/dev/null || :
     fi
 fi
 
+# shellcheck disable=SC2086
 # TODO: Maybe remove this as 'preset' (on install above) enables units by default
 systemctl --no-reload enable ${_ST2_SERVICES} &>/dev/null || :
 
diff --git a/packaging/rpm/scripts/post-remove.sh b/packaging/rpm/scripts/post-remove.sh
index a9f67a5f5b..cc22a069c7 100644
--- a/packaging/rpm/scripts/post-remove.sh
+++ b/packaging/rpm/scripts/post-remove.sh
@@ -28,16 +28,18 @@ st2workflowengine
 #   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
 #   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
 
-if [ $1 -ge 1 ]; then
+if [ "$1" -ge 1 ]; then
     # Package upgrade, not uninstall
     if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        # shellcheck disable=SC2086
         /usr/lib/systemd/systemd-update-helper mark-restart-system-units ${_ST2_SERVICES} || :
     else # EL 8
+        # shellcheck disable=SC2086
         systemctl try-restart ${_ST2_SERVICES} &>/dev/null || :
     fi
 fi
 
 # Remove st2 logrotate config, since there's no analog of apt-get purge available
-if [ $1 -eq 0 ]; then
+if [ "$1" -eq 0 ]; then
     rm -f /etc/logrotate.d/st2
 fi
diff --git a/packaging/rpm/scripts/pre-remove.sh b/packaging/rpm/scripts/pre-remove.sh
index af924e2a60..a01900762b 100644
--- a/packaging/rpm/scripts/pre-remove.sh
+++ b/packaging/rpm/scripts/pre-remove.sh
@@ -28,11 +28,13 @@ st2workflowengine
 #   EL8: https://github.com/systemd/systemd/blob/v239/src/core/macros.systemd.in
 #   EL9: https://github.com/systemd/systemd/blob/v252/src/rpm/macros.systemd.in
 
-if [ $1 -eq 0 ]; then
+if [ "$1" -eq 0 ]; then
     # Package removal, not upgrade
     if [ -x "/usr/lib/systemd/systemd-update-helper" ]; then # EL 9
+        # shellcheck disable=SC2086
         /usr/lib/systemd/systemd-update-helper remove-system-units ${_ST2_SERVICES} || :
     else # EL 8
+        # shellcheck disable=SC2086
         systemctl --no-reload disable --now ${_ST2_SERVICES} &>/dev/null || :
     fi
 fi