fix: bundle README/LICENSE and set explicit file modes in rpm/deb packages and fix files permissions issue.

[zaidshabbir25]

Problem

Two packaging defects found in the released rpm and deb packages.

1. README.md and LICENSE.md not bundled

The packages shipped only the binary, the systemd unit, the config file, and the SBOM:

File	Expected path
README.md	/usr/share/doc/pgedge-control-plane/README.md
LICENSE.md	/usr/share/licenses/pgedge-control-plane/LICENSE.md

Both are already in the release tarballs via archives.files, but the nfpms contents: list had no entries for them.

2. Files installed with 0664 instead of 0644 / 0640

-rw-rw-r--. 1 root root 405 /usr/lib/systemd/system/pgedge-control-plane.service   # want 0644
-rw-rw-r--. 1 root root  79 /etc/pgedge-control-plane/config.json                  # want 0640

When no file_info.mode is given, nfpm packages the mode of the source file as it exists on the builder. CI checks out with umask 002, so git creates the files 0664 and that mode shipped in the packages. Group-writable for a systemd unit and a config file that may hold credentials.

Fix

Both fixes are in the contents: list on the &nfpm_defaults anchor, so all nine per-distro package definitions (el9, el10, jammy, noble, bullseye, bookworm, trixie, resolute) inherit them.

Docs and license. Each file needs two entries. nfpm's doc and license content types are rpm-only — isRelevantForPackager filters entries of those types out of non-rpm packages — so a single typed entry would have fixed the rpm and silently left the deb unchanged. The entries are scoped with packager:: a typed one for rpm, so the spec carries the %doc/%license markers, and a plain one for deb. Both land at the same path.

Modes. file_info.mode is now set explicitly on every entry, so the packaged modes no longer depend on the builder's umask. 0640 for config.json (it may hold credentials, and the unit runs as root so root-only read access is sufficient), 0644 for everything else.

Verification

Built snapshot releases locally with the pinned goreleaser (v2.13.3, per common.mk) and inspected the packages. For the mode fix the sources were first chmod 664'd to reproduce the CI umask.

rpm (el9.x86_64, inspected in a rockylinux:9 container; el10.aarch64 identical):

$ rpm -qlvp pgedge-control-plane-...el9.x86_64.rpm
-rw-r-----  1 root root      79 /etc/pgedge-control-plane/config.json
-rw-r--r--  1 root root     405 /usr/lib/systemd/system/pgedge-control-plane.service
-rwxr-xr-x  1 root root 6436061 /usr/sbin/pgedge-control-plane
-rw-r--r--  1 root root    5291 /usr/share/doc/pgedge-control-plane/README.md
-rw-r--r--  1 root root     958 /usr/share/licenses/pgedge-control-plane/LICENSE.md
-rw-r--r--  1 root root       2 /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json
-rw-r--r--  1 root root       5 /usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc

$ rpm -qdp ...   # %doc
/usr/share/doc/pgedge-control-plane/README.md

$ rpm -qLp ...   # %license
/usr/share/licenses/pgedge-control-plane/LICENSE.md

deb (noble_amd64):

$ ar x ...deb && tar tzvf data.tar.gz
-rw-r-----  0 root root      79 ./etc/pgedge-control-plane/config.json
-rw-r--r--  0 root root     405 ./usr/lib/systemd/system/pgedge-control-plane.service
-rwxr-xr-x  0 root root 6436061 ./usr/sbin/pgedge-control-plane
-rw-r--r--  0 root root    5291 ./usr/share/doc/pgedge-control-plane/README.md
-rw-r--r--  0 root root     958 ./usr/share/licenses/pgedge-control-plane/LICENSE.md
-rw-r--r--  0 root root       2 ./usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json
-rw-r--r--  0 root root       5 ./usr/share/pgedge-control-plane/pgedge-control-plane-sbom.json.asc

README and LICENSE also appear in the deb's md5sums.

Note

For Debian the conventional license path is /usr/share/doc/pgedge-control-plane/copyright, so lintian will still flag no-copyright-file. This PR uses /usr/share/licenses/... for both formats as specified; happy to add the Debian-native path alongside it if we want lintian clean.

🤖 Generated with Claude Code

[coderabbitai]

📝 Walkthrough

Walkthrough

Changes

GoReleaser now sets deterministic modes for packaged files and includes README.md and LICENSE.md in RPM and DEB packages. Two unreleased changelog entries document the packaging fixes.

Package contents

Layer / File(s)	Summary
RPM and DEB content rules .goreleaser.yaml	Package files receive explicit modes, while README and license files are included for both formats at their documentation and license paths.
Packaging fix records changes/unreleased/Fixed-20260728-000000.yaml, changes/unreleased/Fixed-20260729-000000.yaml	Unreleased entries record documentation/license inclusion and deterministic package permissions.

Poem

I’m a rabbit with packages bright,
README and license tucked in right.
RPM hops, DEB joins too,
File modes stand firm in the queue.
Changelog carrots mark the night.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly summarizes the packaging docs and file-mode changes.
Description check	✅ Passed	The description covers the problem, fix, verification, and reviewer notes, with only template heading differences.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/bundle-readme-and-license-in-packages

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codacy-production]

Up to standards ✅

🟢 Issues 0 issues

Results:
0 new issues

View in Codacy

_{NEW Get contextual insights on your PRs based on Codacy's metrics, along with PR and Jira context, without leaving GitHub. Enable AI reviewer
TIP This summary will be updated as you push new changes.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@changes/unreleased/Fixed-20260729-000000.yaml`:
- Line 2: Update the release note body to describe the previous 0664 permissions
as “group-writable” instead of “world-writable-group,” while preserving the
stated deterministic permissions for the systemd service and configuration
files.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: fbab0f76-d1e2-47d5-a039-c00055b60eab

📥 Commits

Reviewing files that changed from the base of the PR and between e435ede and ebfbaba.

📒 Files selected for processing (2)

• .goreleaser.yaml
• changes/unreleased/Fixed-20260729-000000.yaml

[tsivaprasad]

These unreleased comments should be moved to the v0.10.0.md if they're still valid. Otherwise, we can skip them.