t does appear that the redirect url does contain an encoded space, and that at some point in the apt pipe it gets decoded and not re-encoded back.
see below:
Location: https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161758Z&X-Amz-Expires=300&X-Amz-Signature=9b01bd5373576686821a64246a49f2aa743bd61a8a263344903424b177c58a20&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream
nico@nico-lenovo-ubuntu:~$ curl -vvv http://kxstudio.linuxaudio.org/repo/pool/free/ardour4_4.7.0-1kxstudio1_i386.deb * Trying 198.82.152.114... * Connected to kxstudio.linuxaudio.org (198.82.152.114) port 80 (#0) > GET /repo/pool/free/ardour4_4.7.0-1kxstudio1_i386.deb HTTP/1.1 > Host: kxstudio.linuxaudio.org > User-Agent: curl/7.50.1 > Accept: */* > < HTTP/1.1 301 Moved Permanently < Date: Thu, 22 Dec 2016 16:17:10 GMT < Server: Apache < Location: https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb < Vary: Accept-Encoding < Content-Length: 379 < Content-Type: text/html; charset=iso-8859-1 < <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"> <html><head> <title>301 Moved Permanently</title> </head><body> <h1>Moved Permanently</h1> <p>The document has moved <a href="https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb">here</a>.</p> <hr> <address>Apache Server at kxstudio.linuxaudio.org Port 80</address> </body></html> * Connection #0 to host kxstudio.linuxaudio.org left intact nico@nico-lenovo-ubuntu:~$ curl https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb <html><body>You are being <a href="https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161741Z&X-Amz-Expires=300&X-Amz-Signature=3faf5a0d96bf1e4762cc6ab598a8497c40cf439c33ce7b592705e60b9486d5d1&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream">redirected</a>.</body></html>nico@nico-lenovo-ubuntu:~$ nico@nico-lenovo-ubuntu:~$ curl -vvv https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb * Trying 192.30.253.113... * Connected to github.com (192.30.253.113) port 443 (#0) * found 173 certificates in /etc/ssl/certs/ca-certificates.crt * found 697 certificates in /etc/ssl/certs * ALPN, offering http/1.1 * SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256 * server certificate verification OK * server certificate status verification SKIPPED * common name: github.com (matched) * server certificate expiration date OK * server certificate activation date OK * certificate public key: RSA * certificate version: #3 * subject: * start date: Thu, 10 Mar 2016 00:00:00 GMT * expire date: Thu, 17 May 2018 12:00:00 GMT * issuer: C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 Extended Validation Server CA * compression: NULL * ALPN, server accepted to use http/1.1 > GET /KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb HTTP/1.1 > Host: github.com > User-Agent: curl/7.50.1 > Accept: */* > < HTTP/1.1 302 Found < Server: GitHub.com < Date: Thu, 22 Dec 2016 16:17:58 GMT < Content-Type: text/html; charset=utf-8 < Transfer-Encoding: chunked < Status: 302 Found < Cache-Control: no-cache < Vary: X-PJAX < Location: https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161758Z&X-Amz-Expires=300&X-Amz-Signature=9b01bd5373576686821a64246a49f2aa743bd61a8a263344903424b177c58a20&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream < X-UA-Compatible: IE=Edge,chrome=1 < Set-Cookie: logged_in=no; domain=.github.com; path=/; expires=Mon, 22 Dec 2036 16:17:58 -0000; secure; HttpOnly < Set-Cookie: _gh_sess=eyJzZXNzaW9uX2lkIjoiZjhiMDhlZjFmOTkwYzc0ZWUwYjc0YWM3OWVhZDIwMjEiLCJzcHlfcmVwbyI6IktYU3R1ZGlvL1JlcG9zaXRvcnkiLCJzcHlfcmVwb19hdCI6MTQ4MjQyMzQ3OH0%3D--be3aea95afb365d48e55f3ae42fc52eb44274544; path=/; secure; HttpOnly < X-Request-Id: bce17c907cbaaed87965126b46e9c683 < X-Runtime: 0.022282 < Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src render.githubusercontent.com; connect-src 'self' uploads.github.com status.github.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com wss://live.github.com; font-src assets-cdn.github.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: assets-cdn.github.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; media-src 'none'; script-src assets-cdn.github.com; style-src 'unsafe-inline' assets-cdn.github.com < Strict-Transport-Security: max-age=31536000; includeSubdomains; preload < Public-Key-Pins: max-age=5184000; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho="; pin-sha256="k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws="; pin-sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q="; pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; pin-sha256="iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0="; pin-sha256="LvRiGEjRqfzurezaWuj8Wie2gyHMrW5Q06LspMnox7A="; includeSubDomains < X-Content-Type-Options: nosniff < X-Frame-Options: deny < X-XSS-Protection: 1; mode=block < Vary: Accept-Encoding < X-Served-By: 7d2a2d05162492046d9960cdbc326796 < X-GitHub-Request-Id: 4D62FBED:5067:C82969A:585BFCB6 < * Connection #0 to host github.com left intact <html><body>You are being <a href="https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161758Z&X-Amz-Expires=300&X-Amz-Signature=9b01bd5373576686821a64246a49f2aa743bd61a8a263344903424b177c58a20&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream">redirected</a>.</body></html>
t does appear that the redirect url does contain an encoded space, and that at some point in the apt pipe it gets decoded and not re-encoded back.
see below:
Location: https:/ /github- cloud.s3. amazonaws. com/releases/ 39372848/ 4074c29a- d734-11e5- 8632-2259aafc2c 91.deb? X-Amz-Algorithm =AWS4-HMAC- SHA256& X-Amz-Credentia l=AKIAISTNZFOVB IJMK3TQ% 2F20161222% 2Fus-east- 1%2Fs3% 2Faws4_ request& X-Amz-Date= 20161222T161758 Z&X-Amz- Expires= 300&X-Amz- Signature= 9b01bd537357668 6821a64246a49f2 aa743bd61a8a263 344903424b177c5 8a20&X- Amz-SignedHeade rs=host& actor_id= 0&response- content- disposition= attachment% 3B%20filename% 3Dardour4_ 4.7.0-1kxstudio 1_i386. deb&response- content- type=applicatio n%2Foctet- stream
nico@nico- lenovo- ubuntu: ~$ curl -vvv http:// kxstudio. linuxaudio. org/repo/ pool/free/ ardour4_ 4.7.0-1kxstudio 1_i386. deb linuxaudio. org (198.82.152.114) port 80 (#0) free/ardour4_ 4.7.0-1kxstudio 1_i386. deb HTTP/1.1 linuxaudio. org /github. com/KXStudio/ Repository/ releases/ download/ initial/ ardour4_ 4.7.0-1kxstudio 1_i386. deb /github. com/KXStudio/ Repository/ releases/ download/ initial/ ardour4_ 4.7.0-1kxstudio 1_i386. deb">here</a>.</p> linuxaudio. org Port 80</address> linuxaudio. org left intact lenovo- ubuntu: ~$ curl https:/ /github. com/KXStudio/ Repository/ releases/ download/ initial/ ardour4_ 4.7.0-1kxstudio 1_i386. deb /github- cloud.s3. amazonaws. com/releases/ 39372848/ 4074c29a- d734-11e5- 8632-2259aafc2c 91.deb? X-Amz-Algorithm =AWS4-HMAC- SHA256& amp;X-Amz- Credential= AKIAISTNZFOVBIJ MK3TQ%2F2016122 2%2Fus- east-1% 2Fs3%2Faws4_ request& amp;X-Amz- Date=20161222T1 61741Z& amp;X-Amz- Expires= 300& X-Amz-Signature =3faf5a0d96bf1e 4762cc6ab598a84 97c40cf439c33ce 7b592705e60b948 6d5d1& X-Amz-SignedHea ders=host& amp;actor_ id=0& response- content- disposition= attachment% 3B%20filename% 3Dardour4_ 4.7.0-1kxstudio 1_i386. deb& response- content- type=applicatio n%2Foctet- stream">redirected< /a>.</body> </html> nico@nico- lenovo- ubuntu: ~$ lenovo- ubuntu: ~$ curl -vvv https:/ /github. com/KXStudio/ Repository/ releases/ download/ initial/ ardour4_ 4.7.0-1kxstudio 1_i386. deb certs/ca- certificates. crt AES_128_ GCM_SHA256 www.digicert. com,CN= DigiCert SHA2 Extended Validation Server CA Repository/ releases/ download/ initial/ ardour4_ 4.7.0-1kxstudio 1_i386. deb HTTP/1.1 /github- cloud.s3. amazonaws. com/releases/ 39372848/ 4074c29a- d734-11e5- 8632-2259aafc2c 91.deb? X-Amz-Algorithm =AWS4-HMAC- SHA256& X-Amz-Credentia l=AKIAISTNZFOVB IJMK3TQ% 2F20161222% 2Fus-east- 1%2Fs3% 2Faws4_ request& X-Amz-Date= 20161222T161758 Z&X-Amz- Expires= 300&X-Amz- Signature= 9b01bd537357668 6821a64246a49f2 aa743bd61a8a263 344903424b177c5 8a20&X- Amz-SignedHeade rs=host& actor_id= 0&response- content- disposition= attachment% 3B%20filename% 3Dardour4_ 4.7.0-1kxstudio 1_i386. deb&response- content- type=applicatio n%2Foctet- stream eyJzZXNzaW9uX2l kIjoiZjhiMDhlZj FmOTkwYzc0ZWUwY jc0YWM3OWVhZDIw MjEiLCJzcHlfcmV wbyI6IktYU3R1ZG lvL1JlcG9zaXRvc nkiLCJzcHlfcmVw b19hdCI6MTQ4MjQ yMzQ3OH0% 3D--be3aea95afb 365d48e55f3ae42 fc52eb44274544; path=/; secure; HttpOnly 87965126b46e9c6 83 Security- Policy: default-src 'none'; base-uri 'self'; block-all- mixed-content; child-src render. githubuserconte nt.com; connect-src 'self' uploads.github.com status.github.com collector. githubapp. com api.github.com www.google- analytics. com github- cloud.s3. amazonaws. com wss://live. github. com; font-src assets- cdn.github. com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render. githubuserconte nt.com; img-src 'self' data: assets- cdn.github. com identicons. github. com collector. githubapp. com github- cloud.s3. amazonaws. com *.githubusercon tent.com; media-src 'none'; script-src assets- cdn.github. com; style-src 'unsafe-inline' assets- cdn.github. com Transport- Security: max-age=31536000; includeSubdomains; preload "WoiWRyIOVNa9ih aBciRSC7XHjliYS 9VwUGOIud4PB18= "; pin-sha256= "RRM1dGqnDFsCJX BTHky16vi1obOlC gFFn/yOhI/ y+ho="; pin-sha256= "k2v657xBsOVe1P QRwOsHsw3bsGT2V zIqz5K+ 59sNQws= "; pin-sha256= "K87oWBWM9UZfyd dvDfoxL+ 8lpNyoUB2ptGtn0 fv6G2Q= "; pin-sha256= "IQBnNBEiFuhj+ 8x6X8XLgh01V9Ic 5/V3IRQLNFFc7v4 ="; pin-sha256= "iie1VXtL7HzAMF +/PVPR9xzT80kQx dZeJ+zduCB3uj0= "; pin-sha256= "LvRiGEjRqfzure zaWuj8Wie2gyHMr W5Q06LspMnox7A= "; includeSubDomains Type-Options: nosniff 46d9960cdbc3267 96 Request- Id: 4D62FBED: 5067:C82969A: 585BFCB6 /github- cloud.s3. amazonaws. com/releases/ 39372848/ 4074c29a- d734-11e5- 8632-2259aafc2c 91.deb? X-Amz-Algorithm =AWS4-HMAC- SHA256& amp;X-Amz- Credential= AKIAISTNZFOVBIJ MK3TQ%2F2016122 2%2Fus- east-1% 2Fs3%2Faws4_ request& amp;X-Amz- Date=20161222T1 61758Z& amp;X-Amz- Expires= 300& X-Amz-Signature =9b01bd53735766 86821a64246a49f 2aa743bd61a8a26 3344903424b177c 58a20& X-Amz-SignedHea ders=host& amp;actor_ id=0& response- content- disposition= attachment% 3B%20filename% 3Dardour4_ 4.7.0-1kxstudio 1_i386. deb& response- content- type=applicatio n%2Foctet- stream">redirected< /a>.</body> </html>
* Trying 198.82.152.114...
* Connected to kxstudio.
> GET /repo/pool/
> Host: kxstudio.
> User-Agent: curl/7.50.1
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Dec 2016 16:17:10 GMT
< Server: Apache
< Location: https:/
< Vary: Accept-Encoding
< Content-Length: 379
< Content-Type: text/html; charset=iso-8859-1
<
<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">
<html><head>
<title>301 Moved Permanently</title>
</head><body>
<h1>Moved Permanently</h1>
<p>The document has moved <a href="https:/
<hr>
<address>Apache Server at kxstudio.
</body></html>
* Connection #0 to host kxstudio.
nico@nico-
<html><body>You are being <a href="https:/
nico@nico-
* Trying 192.30.253.113...
* Connected to github.com (192.30.253.113) port 443 (#0)
* found 173 certificates in /etc/ssl/
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: github.com (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject:
* start date: Thu, 10 Mar 2016 00:00:00 GMT
* expire date: Thu, 17 May 2018 12:00:00 GMT
* issuer: C=US,O=DigiCert Inc,OU=
* compression: NULL
* ALPN, server accepted to use http/1.1
> GET /KXStudio/
> Host: github.com
> User-Agent: curl/7.50.1
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: GitHub.com
< Date: Thu, 22 Dec 2016 16:17:58 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Status: 302 Found
< Cache-Control: no-cache
< Vary: X-PJAX
< Location: https:/
< X-UA-Compatible: IE=Edge,chrome=1
< Set-Cookie: logged_in=no; domain=.github.com; path=/; expires=Mon, 22 Dec 2036 16:17:58 -0000; secure; HttpOnly
< Set-Cookie: _gh_sess=
< X-Request-Id: bce17c907cbaaed
< X-Runtime: 0.022282
< Content-
< Strict-
< Public-Key-Pins: max-age=5184000; pin-sha256=
< X-Content-
< X-Frame-Options: deny
< X-XSS-Protection: 1; mode=block
< Vary: Accept-Encoding
< X-Served-By: 7d2a2d051624920
< X-GitHub-
<
* Connection #0 to host github.com left intact
<html><body>You are being <a href="https:/