Comment # 11 on bug 1141376 from Fabian Vogt

The cause seems to be appstream-util.

Removing the xml files and just running appstream-util install-origin like
libzypp-plugin-appdata does:

appstream-util install-origin repo-non-oss
/var/cache/zypp/raw/repo-non-oss/repodata/28f627487f32bcfad8c61f540aa603dd56ec5900052248eb67f0fbff8fb29d79-appdata.xml.gz
/var/cache/zypp/raw/repo-non-oss/repodata/32fa8d1af44375db895c8794881e97ee971318e074e6b6b82cea11410ee7697e-appdata-icons.tar.gz

recreates the files with the wrong permission.

Adding maintainers to CC.