fix: endpoint with tamper protection deb upgrade (#9462)

* fix: stop elastic-agent service if we need to stop endpoint

* fix: re-enable same version over the installed agent endpoint test

* chore: add changelog fragment

* fix: stop elastic-agent unconditionally in preinstall.sh.tmpl

Author: pkoutsovasilis

changelog/fragments/1755601979-deb-upgrade-stop-agent-service.yaml

@@ -0,0 +1,4 @@
+kind: bug-fix
+summary: Fix deb upgrade by stopping elastic-agent service before stopping endpoint
+component: elastic-agent
+pr: https://github.com/elastic/elastic-agent/pull/9462

dev-tools/packaging/templates/linux/preinstall.sh.tmpl

@@ -2,6 +2,14 @@
 
 set -e
 
+# we need to stop the agent to have all components stopped as well
+if systemctl --quiet is-active elastic-agent; then
+  echo "elastic-agent is running, stopping it"
+  systemctl --quiet stop elastic-agent
+else
+  echo "elastic-agent is not running"
+fi
+
 SERVICE_NAME="ElasticEndpoint"
 
 # Check if the endpoint service is installed

testing/integration/ess/endpoint_security_test.go

@@ -82,7 +82,6 @@ func TestUpgradeAgentWithTamperProtectedEndpoint_DEB(t *testing.T) {
 	})
 
 	t.Run("Install same version over the installed agent", func(t *testing.T) {
-		t.Skip("This constantly fails, so skipping until further investigation is done and a fix is implemented")
 		testTamperProtectedInstallUpgrade(t, info, "deb", define.Version(), false, false)
 	})