NB arguably we "should" be doing this via debian/rules and
calling dh_fixperms. Doing that is left as an exercise for
whoever volunteers to refactor the way we build all of our
local debs!