add python-dev
fix umask to keep hardening happy