When removing umask from git::clone (T338277), most invocations are using the default parameters and there are a few outliers such as Homer using a read-only mode:

# Clone the public data
git::clone { 'operations/homer/public':
    ensure    => 'latest',
    directory => $public_repo,
    owner     => 'root',
    group     => 'ops',
    mode      => '0440',
    umask     => '337',
    require   => File['/srv/homer'],
}

I have send a patch to remove the group/mode with https://gerrit.wikimedia.org/r/c/operations/puppet/+/1056981/ , though that would mean the local files would become writable. I don't think that is an issue, but @elukey mentioned that if the intent is for the files to be read-only, that should be reflected in the files mode.

This task is to change the default mode of git::clone from 0755 to 0644. That would certainly requires several small patches similar to how I have done T338277.