I'll see what i can do with reproducing it from walnascar package but i'm not a strong user of bitbake and yocto. I mostly work on recipes from an existing build structure.
 
The permissions changes on the source files normally isn't a problem, however, we have some source that have the exec bit set on them in the repo we are pulling from. One of the checks we perform involves checking with mercurial if anything in the source clone has changed from the version checked out and capturing that as part of the binary. It is probably not the "right" way to do it but it is what i'm working with for now. Changed permissions are seen by mercurial as a delta from the source clone.
 
Thanks for the headsup on the hard links. It looks like they are hardlinks from the source in WORKDIR/package to S. I don't need that source package for my use case and it is missing key files we need to be a real source rpm anyway. Can I disable the creation of it?