After a push and some updating of things in Fedora's infrastructure, the file list generator will ignore all unreadable content and will mark content that is only group-readable by appending '-' to the file type. (So we'll have 'd-' on the content that's being staged to tier-1 mirrors.)

The client needs to deal with this. First add a "PREBITFLIP" setting which tier-1 mirrors should set.

When generating the file lists, there are two paths;

PREBITFLIP clients should simply include 'd-' and 'f-' when processing the file lists wherever they look for 'd' and 'f'.

Other clients won't be able to read these things and should filter them out. Ignoring 'f-' is easy and actually requires no changes. However, a 'd-' directory will protect everything below it even if those files have regular permissions. So simply grep each of those restricted directories out of the file lists.