When candidate is un-archived, permissions retain whatever they were locally
After extracting the candidate tarball, permissions should be set to the server user and the Apache web group. Currently, however, permissions keep the user and group from the local computer.