**Build scan:**
https://gradle-enterprise.elastic.co/s/o5fyjoyg4nmrk/tests/:qa:os:destructiveDistroTest.default-deb/org.elasticsearch.packaging.test.CertGenCliTests/test10Install

**Reproduction line:**
```
null
```

**Applicable branches:**
main

**Reproduces locally?:**
Didn't try

**Failure history:**
https://gradle-enterprise.elastic.co/scans/tests?tests.container=org.elasticsearch.packaging.test.CertGenCliTests&tests.test=test10Install

**Failure excerpt:**
```
java.lang.AssertionError: 
Expected: "file/directory: "<File> with owner "root" with group "root" with posix permissions [<OWNER_READ>,<OWNER_WRITE>,<GROUP_READ>,<OTHERS_READ>]
     but: path </usr/share/elasticsearch/NOTICE.txt>Has permissions [GROUP_WRITE, OWNER_READ, OWNER_WRITE, GROUP_READ, OTHERS_READ]

  at __randomizedtesting.SeedInfo.seed([49D09F0DDE208AB3:A58A93F582B035E9]:0)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:18)
  at org.hamcrest.MatcherAssert.assertThat(MatcherAssert.java:6)
  at org.elasticsearch.packaging.util.Packages.lambda$verifyOssInstallation$12(Packages.java:214)
  at java.util.Spliterators$ArraySpliterator.forEachRemaining(Spliterators.java:1006)
  at java.util.stream.ReferencePipeline$Head.forEach(ReferencePipeline.java:762)
  at org.elasticsearch.packaging.util.Packages.verifyOssInstallation(Packages.java:214)
  at org.elasticsearch.packaging.util.Packages.verifyPackageInstallation(Packages.java:176)
  at org.elasticsearch.packaging.test.PackagingTestCase.install(PackagingTestCase.java:245)
  at org.elasticsearch.packaging.test.CertGenCliTests.test10Install(CertGenCliTests.java:51)
  at jdk.internal.reflect.DirectMethodHandleAccessor.invoke(DirectMethodHandleAccessor.java:104)
  at java.lang.reflect.Method.invoke(Method.java:578)
  at com.carrotsearch.randomizedtesting.RandomizedRunner.invoke(RandomizedRunner.java:1758)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$8.evaluate(RandomizedRunner.java:946)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$9.evaluate(RandomizedRunner.java:982)
  at com.carrotsearch.randomizedtesting.RandomizedRunner$10.evaluate(RandomizedRunner.java:996)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at org.junit.rules.TestWatcher$1.evaluate(TestWatcher.java:55)
  at com.carrotsearch.randomizedtesting.rules.StatementAdapter.evaluate(StatementAdapter.java:36)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl$StatementRunner.run(ThreadLeakControl.java:390)
  at com.carrotsearch.randomizedtesting.ThreadLeakControl.lambda$forkTimeoutingTask$0(ThreadLeakControl.java:850)
  at java.lang.Thread.run(Thread.java:1623)

```
qa/os/src/test/java/org/elasticsearch/packaging/test/CertGenCliTests.java
@Before
    public void filterDistros() {
        assumeFalse("no docker", distribution.isDocker());
    }
    @BeforeClass
    public static void cleanupFiles() {
        FileUtils.rm(instancesFile, certificatesFile);
    }
    @AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/99153")
    public void test10Install() throws Exception {
        install();
        
        ServerUtils.disableSecurityAutoConfiguration(installation);
    }
    @AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/99153")
    public void test20Help() {
        Shell.Result result = installation.executables().certgenTool.run("--help");
        assertThat(result.stdout(), containsString("Simplifies certificate creation"));
    }
    @AwaitsFix(bugUrl = "https://github.com/elastic/elasticsearch/issues/99153")
    public void test30Generate() throws Exception {
        final List<String> lines = new ArrayList<>();
        lines.add("instances:");
        lines.add("  - name: \"mynode\"");
        lines.add("    ip:");
        lines.add("      - \"127.0.0.1\"");
        Files.write(instancesFile, lines, CREATE, APPEND);
        installation.executables().certgenTool.run("--in " + instancesFile + " --out " + certificatesFile);
        String owner = installation.getOwner();
        assertThat(certificatesFile, file(File, owner, owner, p600));