**Build scan:**
https://gradle-enterprise.elastic.co/s/o5fyjoyg4nmrk/tests/:qa:os:destructiveDistroTest.default-deb/org.elasticsearch.packaging.test.CertGenCliTests/test10Install

**Reproduction line:**
```
null
```

**Applicable branches:**
main

**Reproduces locally?:**
Didn't try

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.packaging.test.CertGenCliTests&tests.test=test10Install

**Failure excerpt:**
```
java.lang.AssertionError: 
Expected: "file/directory: "<File> with owner "root" with group "root" with posix permissions [<OWNER_READ>,<OWNER_WRITE>,<GROUP_READ>,<OTHERS_READ>]
     but: path </usr/share/elasticsearch/NOTICE.txt>Has permissions [GROUP_WRITE, OWNER_READ, OWNER_WRITE, GROUP_READ, OTHERS_READ]

  at __randomizedtesting.SeedInfo.seed([49D09F0DDE208AB3:A58A93F582B035E9]:0)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:6)
  at org.elasticsearch.packaging.util.Packages.lambda$verifyOssInstallation$12(Packages.java:214)
  at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:1006)
  at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
  at org.elasticsearch.packaging.util.Packages.verifyOssInstallation(Packages.java:214)
  at org.elasticsearch.packaging.util.Packages.verifyPackageInstallation(Packages.java:176)
  at org.elasticsearch.packaging.test.PackagingTestCase.install(PackagingTestCase.java:245)
  at org.elasticsearch.packaging.test.CertGenCliTests.test10Install(CertGenCliTests.java:51)
  at jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
  at java.lang.reflect.Method.invoke(Method.java:578)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:1623)

```
qa/os/src/test/java/org/elasticsearch/packaging/test/CertGenCliTests.java
* 2.0 and the Server Side Public License, v 1; you may not use this file except
 * in compliance with, at your election, the Elastic License 2.0 or the Server
 * Side Public License, v 1.
 */
package org.elasticsearch.packaging.test;
import org.apache.http.client.fluent.Request;
import org.elasticsearch.common.settings.Settings;
import org.elasticsearch.packaging.util.FileUtils;
import org.elasticsearch.packaging.util.Platforms;
import org.elasticsearch.packaging.util.ServerUtils;
import org.elasticsearch.packaging.util.Shell;
import org.junit.Before;
import org.junit.BeforeClass;
import java.nio.file.Files;
import java.nio.file.Path;
import java.util.ArrayList;
import java.util.List;
import java.util.stream.Collectors;
import static com.carrotsearch.randomizedtesting.RandomizedTest.assumeFalse;
import static java.nio.file.StandardOpenOption.APPEND;
import static java.nio.file.StandardOpenOption.CREATE;
import static java.nio.file.StandardOpenOption.TRUNCATE_EXISTING;
import static org.elasticsearch.packaging.util.FileMatcher.Fileness.File;
import static org.elasticsearch.packaging.util.FileMatcher.file;
import static org.elasticsearch.packaging.util.FileMatcher.p600;
import static org.elasticsearch.packaging.util.FileUtils.escapePath;
import static org.hamcrest.CoreMatchers.containsString;
public class CertGenCliTests extends PackagingTestCase {
    private static final Path instancesFile = getRootTempDir().resolve("instances.yml");
    private static final Path certificatesFile = getRootTempDir().resolve("certificates.zip");