This problem was not found during development because I used a local checkout
of slapos cookbook and these files were not downloaded but directly copied
from the disk.

In zc.buildout, the Download class should be changed to use something that
respects umask, instead of 'tempfile.mkstemp'.