TJ was unable to run the 'guardutil archive-clone ...' command due to permission issues.  We looked at it, and the relevant error message was:

fatal: failed to copy file to 'IMC_LOCK/.git/objects/2f/826f205c25a6189503d831106e2dd97d7a39dc': Permission denied'

Tracing through paths, this was in /guardian/archive/IMC_LOCK/.git/....

The permissions + ownership of that file where 0600 (rw for the user), everything else was 0444 (r only for everyone) and owned by guardian:controls.  Changing the permissions to 0444 fixed things.

We did a search from the guardian machine for other files with that problem and found 24 files under /srv/guardian/archive, so we reset the permissions to clear up future problems.

Find command for searching: find . -type f -perm 600
Command for updating: find . -type f -perm 600 | xargs chmod 0444

I suspect this is a umask issue that someone had a umask of 077 set when they did an archive request.