Thomas, I've noticed the Xenial basefile you host has the bad acls on the files in it: http://fai-project.org/download/basefiles/XENIAL64.tar.xz I verified that I can generate a Xenial basefile myself on Stretch that works and does not have them. I suggest fixing it. I haven't checked any of the other basefiles hosted there.