It happens when sdist tarball is generated with a restrictive umask or when files were created without others/nobody read/execute permissions.
A simple workaround is to broak the umask bits and chmod files before tar'ing
umask 0022 && chmod -R a+rX . && python setup.py sdist upload