[sean0407]

Summary

/etc/GeoIP.conf
- mode: 0644 (inherited from the source file)
+ mode: 0640

Set an explicit mode for the packaged /etc/GeoIP.conf file. This protects the account ID and license key from unprivileged local reads while retaining root and group access. Fixes #328.

Evidence

• Before: Issue #328 includes RPM output showing /etc/GeoIP.conf installed as 0644; the nFPM entry had no explicit file mode.
• After: the nFPM contents entry for /etc/GeoIP.conf sets file_info.mode to 0o640.
• Checks: goreleaser check passed; go test -race ./... passed; patch_policy.py passed (1 file, no binary changes); git diff --check passed. A full snapshot package build stopped during cross-platform compilation when the local filesystem ran out of space.

Merge Danger

Door: two-way

Blast Radius: package

Summary by CodeRabbit

• Bug Fixes
  • The packaged GeoIP configuration file now has restricted permissions: it is readable by its owner and group, but not by other users. This change affects the packaged file’s access permissions and does not change GeoIP functionality.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

• Configuration used: Organization UI
• Review profile: ASSERTIVE
• Plan: Advanced
• Run ID: d5d7c5e0-710c-407f-b67f-568319272f55

📥 Commits

Reviewing files that changed from the base of the PR and between ed42995 and c66ba46.

📒 Files selected for processing: 1

• .goreleaser.yml

Included review availability: This review used your included allowance. Your plan provides up to 4 included reviews per hour; 3 remain after this review.

📝 Walkthrough

The packaged /etc/GeoIP.conf now has an explicit file mode of 0o640.

Changes: Package Permissions

Layer / File(s)	Summary
Set GeoIP.conf mode .goreleaser.yml	The package entry for /etc/GeoIP.conf now sets the file mode to 0o640.

Priority: ⬆️ High

Estimated code review effort: 1 (Trivial) | ~3 minutes

Change: Bug fix · Severity of issue fixed: Medium

Suggested reviewers: oschwald

Merge Risk: ⚪ Minimal · up to c66ba

The Debian and RPM packages encode /etc/GeoIP.conf as 0640, limiting local reads to the owner and group. No actionable merge-blocking risk is evident.

Pre-merge checks: 5

Passed checks: 5 passed

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		The title clearly and concisely describes the main change: restricting permissions for the GeoIP configuration file.
Linked Issues check		Issue #328 requires packaged /etc/GeoIP.conf to use mode 0640 instead of 0644. The PR summary reports an explicit nFPM file_info.mode value of 0o640. The reported checks also include `gorele…
Out of Scope Changes check		The reported change adds the file mode only for packaged /etc/GeoIP.conf in .goreleaser.yml. This change directly implements issue #328. The summary reports no other functional or unrelated change…
Docstring Coverage		No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…

✨ Finishing Touches: 💡 1

🧪 Generate unit tests (beta)

• Create a new PR

🛠️ Fix failing CI checks: 💡

• Commit to this branch
• Create a new PR

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{A rabbit checks the config with care,
A quieter mode is set there.
Six-four-zero keeps the file,
While carrots wait in a tidy pile.
Hop, hop—the package is prepared!}

_{Comment @coderabbitai help to get the list of available commands.}

[horgh]

Hi, thank you for the PR!

Unfortunately this is likely a breaking change for some use cases. As such, we're not going to accept it for now. We'll want to wait until we do a major release.

[sean0407]

Thanks for explaining the compatibility concern. I understand this permission change should wait for a major release. Since there is no release timing to track here, I’m closing the PR for now rather than leaving it open indefinitely. The change can be revisited when the next major release is planned.