Comment 24 for bug 1824000

If your umask is 027 rather than 022, the files end up only readable by root:root. I've modified /etc/apt/apt.conf.d/50command-not-found as follows:

# Refresh AppStream cache when APT's cache is updated (i.e. apt update)
APT::Update::Post-Invoke-Success {
    "if /usr/bin/test -w /var/lib/command-not-found/ -a -e /usr/lib/cnf-update-db; then umask 022 && /usr/lib/cnf-update-db > /dev/null; fi";
};

Note the addition of the `umask 022 &&`. This ensures the database update gets the 022 umask, allowing for it to be world-readable.