fix(packaging): keep SPDX comments out of Debian control (#3483)

Signed-off-by: Drew Newberry <anewberry@nvidia.com>

Author: drew

deploy/deb/control.in

@@ -1,6 +1,3 @@
-# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
-# SPDX-License-Identifier: Apache-2.0
-
 Package: openshell
 Version: @VERSION@
 Architecture: @ARCH@

deploy/deb/control.in.license

@@ -0,0 +1,2 @@
+SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+SPDX-License-Identifier: Apache-2.0

scripts/update_license_headers.py

@@ -60,9 +60,10 @@
     "scripts/bin/openshell": "#",
 }
 
-# Strict JSON does not support comments. Keep SPDX data in REUSE-compatible
-# sidecars so these files remain valid inputs to their consumers.
+# Some consumer formats do not support comments. Keep SPDX data in
+# REUSE-compatible sidecars so these files remain valid inputs.
 SIDECAR_LICENSE_FILES: set[str] = {
+    "deploy/deb/control.in",
     "scripts/keycloak-realm.json",
     "sdk/conformance/oauth-client-credentials.json",
     "sdk/typescript/biome.json",

tasks/scripts/test-packaging-assets.sh

@@ -38,11 +38,25 @@ assert_file_exists() {
 }
 
 service="${ROOT}/deploy/deb/openshell-gateway.service"
+control="${ROOT}/deploy/deb/control.in"
 spec="${ROOT}/openshell.spec"
 
 assert_file_exists "$service"
+assert_file_exists "$control"
 assert_file_exists "$spec"
 
+# Debian control files are RFC822-style metadata. Older dpkg-deb releases
+# reject comment lines as malformed fields, so keep SPDX metadata in the
+# adjacent .license sidecar instead of emitting it into DEBIAN/control.
+if grep -Eq '^[[:space:]]*#' "$control"; then
+  echo "FAIL: Debian control template contains a comment field" >&2
+  exit 1
+fi
+if [[ $(sed -n '/[^[:space:]]/ { p; q; }' "$control") != "Package: openshell" ]]; then
+  echo "FAIL: Debian control template must begin with the Package field" >&2
+  exit 1
+fi
+
 assert_contains \
   "$service" \
   'Environment=OPENSHELL_LOCAL_TLS_DIR=%h/.local/state/openshell/tls'