[rosswilson]

I think they've always done this redirect. Release artifacts are uploaded to S3 and then their Rails app generates a presigned S3 URL that gives short-term access. This is because the artifacts could belong to a private repo, so access control is required.