That umask is 0002. This is a bare-metal machine. Focusing on the weird fact: when I used a mktemp-created dir under some arbitrary dir, curl succeeded; but curls in setup's dir under ~/.cache failed: I tried cd-ing up the directory tree and doing a curl each time. It failed in ~/.cache and in its subdirs; succeeded above in my homedir.