when I'm trying to archive-restore a tarball of my drupal site I'm getting a settings.php without a <?php delimiter at the beginning of the file. So the settings.php is readable by everyone. I have previously excluded the settings.php while creating the archive dump.
drush archive-dump --uri=SITE --destination=SITE.tar --tar-options="--exclude=sites/SITE/settings.php" --overwrite
drush archive-restore SITE.tar --destination=TARGET_FOLDER --db-url=mysql://USER:PASS@localhost:PORT/DBNAME