Permission problem with GPG apt key when Debian umask is 027

[mig5]

When Debian has a umask of 027 (stricter than 022), the installation fails because the GPG apt key can't be read:

Add PGDG APT repository...
[ERROR]: Task failed: Module failed: Failed to update apt cache after 5 retries: W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed.
Origin: /home/user/git/infrastructure/roles-external/ANXS.postgresql/tasks/install_apt.yml:53:3

51 # --- Add the PGDG APT repository (HTTPS + signed-by) ---
52 # We explicitly build the repo line to ensure the correct suite and signed-by usage.
53 - name: Add PGDG APT repository
     ^ column 3

[WARNING]: Failed to update cache after 1 due to W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed. retry, retrying
[WARNING]: Sleeping for 2 seconds, before attempting to update the cache again
[WARNING]: Failed to update cache after 2 due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed. retry, retrying
[WARNING]: Sleeping for 3 seconds, before attempting to update the cache again
[WARNING]: Failed to update cache after 3 due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed. retry, retrying
[WARNING]: Sleeping for 5 seconds, before attempting to update the cache again
[WARNING]: Failed to update cache after 4 due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed. retry, retrying
[WARNING]: Sleeping for 9 seconds, before attempting to update the cache again
[WARNING]: Failed to update cache after 5 due to W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed. retry, retrying
[WARNING]: Sleeping for 13 seconds, before attempting to update the cache again
  localhost failed | msg: Failed to update apt cache after 5 retries: W:Updating from such a repository can't be done securely, and is therefore disabled by default., W:See apt-secure(8) manpage for repository creation and user configuration details., W:OpenPGP signature verification failed: https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease: Sub-process /usr/bin/sqv returned an error code (1), error message is: Error: Failed to parse keyring "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg"  Caused by:     0: Reading "/usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg": Permission denied (os error 13)     1: Permission denied (os error 13), E:The repository 'https://apt.postgresql.org/pub/repos/apt trixie-pgdg InRelease' is not signed.

This is easily fixable with a quick chmod 644 /usr/share/postgresql-common/pgdg/apt.postgresql.org.gpg.

It might be nice to have a task step that enforces that permission on the gpg file so that the installation can proceed seamlessly.