The reason behind the PUBLIC was to make it so that the distributed cache would share instances of the .zip file between different users and storm clusters on the same box.  The issue is that if it is not world readable it cannot be public.  We should add in a piece of code to automatically check to see if the zip file and all of the parent directories all the way up are world readable too. If so we mark it as public if not we fall back to PRIVATE.  This should probably be part of Util.newYarnAppResource.  We may want to do it as a separate issue/pull request unless you can do it fast.