I think this is a simple umask issue. Making the test check for just the bits worked for me:

diff --git a/tests/publish.scm b/tests/publish.scm
index 52101876b5..3e67c435ac 100644
--- a/tests/publish.scm
+++ b/tests/publish.scm
@@ -452,8 +452,8 @@ References: ~%"
               (wait-for-file cached)

               ;; Both the narinfo and nar should be world-readable.
-              (= #o644 (stat:perms (lstat cached)))
-              (= #o644 (stat:perms (lstat nar)))
+              (= #o444 (logand #o444 (stat:perms (lstat cached))))
+              (= #o444 (logand #o444 (stat:perms (lstat nar))))

               (let* ((body         (http-get-port url))
                      (compressed   (http-get nar-url))