You should modify the files before installation, that way they are
copied with the right permissions. This is mostly important for managed
files (e.g. config files or files installed with install_config_file),
since one file would be copied to the stage (if using castfs) or to
a $(file).$(date) file, while the currently installed file would have
it's perms changed (and would now be marked as unmodified for this
install of the spell).