t does appear that the redirect url does contain an encoded space, and that at some point in the apt pipe it gets decoded and not re-encoded back.
see below:
Location: https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161758Z&X-Amz-Expires=300&X-Amz-Signature=9b01bd5373576686821a64246a49f2aa743bd61a8a263344903424b177c58a20&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream
nico@nico-lenovo-ubuntu:~$ curl -vvv http://kxstudio.linuxaudio.org/repo/pool/free/ardour4_4.7.0-1kxstudio1_i386.deb
* Trying 198.82.152.114...
* Connected to kxstudio.linuxaudio.org (198.82.152.114) port 80 (#0)
> GET /repo/pool/free/ardour4_4.7.0-1kxstudio1_i386.deb HTTP/1.1
> Host: kxstudio.linuxaudio.org
> User-Agent: curl/7.50.1
> Accept: */*
>
< HTTP/1.1 301 Moved Permanently
< Date: Thu, 22 Dec 2016 16:17:10 GMT
< Server: Apache
< Location: https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb
< Vary: Accept-Encoding
< Content-Length: 379
< Content-Type: text/html; charset=iso-8859-1
<
301 Moved Permanently
Moved Permanently
The document has moved here.
Apache Server at kxstudio.linuxaudio.org Port 80
* Connection #0 to host kxstudio.linuxaudio.org left intact
nico@nico-lenovo-ubuntu:~$ curl https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb
You are being redirected.nico@nico-lenovo-ubuntu:~$
nico@nico-lenovo-ubuntu:~$ curl -vvv https://github.com/KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb
* Trying 192.30.253.113...
* Connected to github.com (192.30.253.113) port 443 (#0)
* found 173 certificates in /etc/ssl/certs/ca-certificates.crt
* found 697 certificates in /etc/ssl/certs
* ALPN, offering http/1.1
* SSL connection using TLS1.2 / ECDHE_RSA_AES_128_GCM_SHA256
* server certificate verification OK
* server certificate status verification SKIPPED
* common name: github.com (matched)
* server certificate expiration date OK
* server certificate activation date OK
* certificate public key: RSA
* certificate version: #3
* subject:
* start date: Thu, 10 Mar 2016 00:00:00 GMT
* expire date: Thu, 17 May 2018 12:00:00 GMT
* issuer: C=US,O=DigiCert Inc,OU=www.digicert.com,CN=DigiCert SHA2 Extended Validation Server CA
* compression: NULL
* ALPN, server accepted to use http/1.1
> GET /KXStudio/Repository/releases/download/initial/ardour4_4.7.0-1kxstudio1_i386.deb HTTP/1.1
> Host: github.com
> User-Agent: curl/7.50.1
> Accept: */*
>
< HTTP/1.1 302 Found
< Server: GitHub.com
< Date: Thu, 22 Dec 2016 16:17:58 GMT
< Content-Type: text/html; charset=utf-8
< Transfer-Encoding: chunked
< Status: 302 Found
< Cache-Control: no-cache
< Vary: X-PJAX
< Location: https://github-cloud.s3.amazonaws.com/releases/39372848/4074c29a-d734-11e5-8632-2259aafc2c91.deb?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=AKIAISTNZFOVBIJMK3TQ%2F20161222%2Fus-east-1%2Fs3%2Faws4_request&X-Amz-Date=20161222T161758Z&X-Amz-Expires=300&X-Amz-Signature=9b01bd5373576686821a64246a49f2aa743bd61a8a263344903424b177c58a20&X-Amz-SignedHeaders=host&actor_id=0&response-content-disposition=attachment%3B%20filename%3Dardour4_4.7.0-1kxstudio1_i386.deb&response-content-type=application%2Foctet-stream
< X-UA-Compatible: IE=Edge,chrome=1
< Set-Cookie: logged_in=no; domain=.github.com; path=/; expires=Mon, 22 Dec 2036 16:17:58 -0000; secure; HttpOnly
< Set-Cookie: _gh_sess=eyJzZXNzaW9uX2lkIjoiZjhiMDhlZjFmOTkwYzc0ZWUwYjc0YWM3OWVhZDIwMjEiLCJzcHlfcmVwbyI6IktYU3R1ZGlvL1JlcG9zaXRvcnkiLCJzcHlfcmVwb19hdCI6MTQ4MjQyMzQ3OH0%3D--be3aea95afb365d48e55f3ae42fc52eb44274544; path=/; secure; HttpOnly
< X-Request-Id: bce17c907cbaaed87965126b46e9c683
< X-Runtime: 0.022282
< Content-Security-Policy: default-src 'none'; base-uri 'self'; block-all-mixed-content; child-src render.githubusercontent.com; connect-src 'self' uploads.github.com status.github.com collector.githubapp.com api.github.com www.google-analytics.com github-cloud.s3.amazonaws.com wss://live.github.com; font-src assets-cdn.github.com; form-action 'self' github.com gist.github.com; frame-ancestors 'none'; frame-src render.githubusercontent.com; img-src 'self' data: assets-cdn.github.com identicons.github.com collector.githubapp.com github-cloud.s3.amazonaws.com *.githubusercontent.com; media-src 'none'; script-src assets-cdn.github.com; style-src 'unsafe-inline' assets-cdn.github.com
< Strict-Transport-Security: max-age=31536000; includeSubdomains; preload
< Public-Key-Pins: max-age=5184000; pin-sha256="WoiWRyIOVNa9ihaBciRSC7XHjliYS9VwUGOIud4PB18="; pin-sha256="RRM1dGqnDFsCJXBTHky16vi1obOlCgFFn/yOhI/y+ho="; pin-sha256="k2v657xBsOVe1PQRwOsHsw3bsGT2VzIqz5K+59sNQws="; pin-sha256="K87oWBWM9UZfyddvDfoxL+8lpNyoUB2ptGtn0fv6G2Q="; pin-sha256="IQBnNBEiFuhj+8x6X8XLgh01V9Ic5/V3IRQLNFFc7v4="; pin-sha256="iie1VXtL7HzAMF+/PVPR9xzT80kQxdZeJ+zduCB3uj0="; pin-sha256="LvRiGEjRqfzurezaWuj8Wie2gyHMrW5Q06LspMnox7A="; includeSubDomains
< X-Content-Type-Options: nosniff
< X-Frame-Options: deny
< X-XSS-Protection: 1; mode=block
< Vary: Accept-Encoding
< X-Served-By: 7d2a2d05162492046d9960cdbc326796
< X-GitHub-Request-Id: 4D62FBED:5067:C82969A:585BFCB6
<
* Connection #0 to host github.com left intact
You are being redirected.