Permission issues in the release tarball

[samiraguiar]

Describe the bug
The compressed tarball for this package in the Yarn registry has some permission issues preventing it from being correctly extracted.

To Reproduce
Steps to reproduce the behavior:

1. With an unprivileged user initialize a package.json file:
   yarn init -y
2. Add this project as a dependency:
   yarn add matrix-widget-api
3. Get the URL in the Yarn registry and download the tarball:

$ pkg_url=$(cat yarn.lock | grep ".com/matrix-widget-api" | awk -F'"' '{ print $2 }')
$ wget "${pkg_url}"

4. Extract the archive:

$ mkdir extracted
$ tar zxvf matrix-widget-api-*.tgz -C extracted/

5. Lots of errors will appear:

package/src/models/validation/utils.ts
tar: package/src/models/validation/utils.ts: Cannot open: Permission denied
tar: Exiting with failure status due to previous errors

6. If you retry the extract command with the --delay-directory-restore flag, it works at first, but a few directories will miss the execute attribute:

$ tar zxvf matrix-widget-api-*.tgz --delay-directory-restore -C extracted/
$ rm -rf extracted/
rm: cannot remove 'extracted/package/src': Permission denied
rm: cannot remove 'extracted/package/LICENSE': Permission denied
rm: cannot remove 'extracted/package/lib': Permission denied
rm: cannot remove 'extracted/package/README.md': Permission denied
rm: cannot remove 'extracted/package/dist': Permission denied
rm: cannot remove 'extracted/package/CONTRIBUTING.rst': Permission denied
rm: cannot remove 'extracted/package/package.json': Permission denied

7. It's possible to fix the errors from (6) by adjusting the attributes:

$ find extracted/ -type d -exec chmod a+x {} \;
$ rm -rf extracted/
# works now

Expected behavior
Extraction was expected to work correctly without the need for extra flags and operations, similarly to other projects. For example, matrix-js-sdk:

$ yarn add matrix-js-sdk
$ pkg_url=$(cat yarn.lock | grep ".com/matrix-js-sdk" | awk -F'"' '{ print $2 }')
$ wget "${pkg_url}"

$ mkdir extracted
$ tar zxvf matrix-js-sdk-*.tgz -C extracted/
$ rm -rf extracted
# works right away

Desktop (please complete the following information):

• OS: Linux Mint 19.3 Tricia
• Yarn: 1.7.0
• tar: GNU tar 1.29