ocenaudio: `brew install` fails with 403 — download redirect is a HEAD-signed presigned URL, Homebrew then GETs it

Verification

• I understand that if I ignore these instructions, my issue may be closed without review.
• I have retried my command with --force.
• I ran brew update-reset && brew update and retried my command.
• I ran brew doctor, fixed as many issues as possible and retried my command.
• I have checked the instructions for reporting bugs.
• I made doubly sure this is not a checksum does not match / SHA256 mismatch error (do not open an issue before trying to open a PR to fix first).
• I did not use AI/LLM to create this issue, or I disclosed the tool and model used; I will answer maintainer questions myself without AI/LLM.

Description of issue

Summary

brew install --cask ocenaudio fails with curl: (22) The requested URL returned error: 403. The cask URL itself is fine — a plain curl -L downloads the DMG. The failure is an interaction between Homebrew's downloader and ocenaudio's hosting: https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg now 302-redirects to a presigned Cloudflare R2 URL (X-Amz-Algorithm=AWS4-HMAC-SHA256, X-Amz-Expires=1800). Homebrew resolves the redirect with a HEAD request and then issues a GET against the resolved URL. AWS SigV4 presigned URLs include the HTTP method in the signature, so a URL generated for HEAD is invalid for GET, and R2 returns 403 SignatureDoesNotMatch.

Separately, the cask is stale: it says 3.21.0 but the server currently serves installer_universal.dmg from v3.21.3, so even a successful download would fail the sha256 check.

Environment

• Homebrew 6.0.22, macOS 15.7.4 (arm64), curl 8.7.1
• Cask ocenaudio 3.21.0 (brew update run; still 3.21.0)

Verbose fetch

HOMEBREW_CURL_VERBOSE=1 brew fetch --cask ocenaudio 2>&1 | grep -E "^[<>] |^\* "

> GET /ocenaudio-dist/v3.21.3/installer_universal.dmg?X-Amz-Algorithm=AWS4-HMAC-SHA256&X-Amz-Credential=…%2F20260911%2Fauto%2Fs3%2Faws4_request&X-Amz-Date=20260911T094714Z&X-Amz-Expires=1800&X-Amz-SignedHeaders=host&response-content-disposition=attachment%3B%20filename%3D%22ocenaudio_universal_3.21.3.dmg%22&X-Amz-Signature=… HTTP/1.1
> Host: 3c80cb58ada14a02e3df326d2a3095cf.r2.cloudflarestorage.com
> User-Agent: Homebrew/6.0.22 (Macintosh; arm64 Mac OS X 15.7.4) curl/8.7.1
> Accept: */*
> Accept-Language: en
>
< HTTP/1.1 403 Forbidden
< Content-Type: application/xml
< Content-Length: 2710
< Server: cloudflare

The X-Amz-Date matches the request time, so the URL is not expired.

Reproduction outside Homebrew

Resolve the redirect with HEAD, then GET the resolved URL → 403:

curl -s -o /dev/null -w "%{http_code}\n" "$(curl -sI https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg | grep -i '^location:' | cut -d' ' -f2- | tr -d '\r')"
403

Resolve the redirect with GET, then GET the resolved URL → 200:

curl -s -o /dev/null -w "%{http_code}\n" "$(curl -s -o /dev/null -D - https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg | grep -i '^location:' | cut -d' ' -f2- | tr -d '\r')"
200

A plain curl -sL -o /dev/null -w "%{http_code}\n" https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg also returns 200. It is not user-agent related: the Homebrew UA gets the same 302 as curl's default UA on the first hop.

Notes

• https://www.ocenaudio.com/start_download/ocenaudio_universal.dmg (the link on the download page) returns an HTML interstitial, not the DMG, so it isn't a usable alternative URL.
• ocenaudio's own site doesn't appear to offer a stable unsigned download URL, so I don't think this is fixable purely in the cask. The root cause is likely in Homebrew/brew's CurlDownloadStrategy (using a HEAD-resolved URL for the GET), and will affect any host that redirects to method-signed presigned URLs. Happy to open a corresponding issue there if that's the right place.
• The cask also needs bumping to 3.21.3 once the download works.

AI disclaimer

Diagnosis and write-up were done with help from Claude Fable 5.1 (Anthropic); all commands and outputs above are from my own machine.

Command that failed

brew fetch --cask ocenaudio

Output of command with --verbose --debug

==> Fetching ocenaudio from homebrew/cask
/usr/bin/env /opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/6.0.22\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 15.7.4\)\ curl/8.7.1 --header Accept-Language:\ en --retry 3 -V
/usr/bin/env /opt/homebrew/Library/Homebrew/shims/shared/curl --disable --cookie /dev/null --globoff --show-error --user-agent Homebrew/6.0.22\ \(Macintosh\;\ arm64\ Mac\ OS\ X\ 15.7.4\)\ curl/8.7.1 --header Accept-Language:\ en --retry 3 --fail --location --silent --head https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg
✘ Cask ocenaudio (3.21.0)
Error: Download failed on Cask 'ocenaudio' with message: Download failed: https://www.ocenaudio.com/downloads/index.php/ocenaudio_universal.dmg
% Total    % Received % Xferd  Average Speed   Time    Time     Time  Current
                                 Dload  Upload   Total   Spent    Left  Speed
  0  2710    0     0    0     0      0      0 --:--:-- --:--:-- --:--:--     0
curl: (22) The requested URL returned error: 403

Output of brew doctor and brew config

brew doctor
Your system is ready to brew.

brew config
HOMEBREW_VERSION: 6.0.22
ORIGIN: https://github.com/Homebrew/brew
HEAD: 08e85c4e42f5d8f1ea17c36cb59cf61c2ccb26c3
Last commit: 6 days ago
Branch: stable
Core tap: N/A
Core cask tap: N/A
HOMEBREW_PREFIX: /opt/homebrew
Homebrew Ruby: 4.0.6 => /opt/homebrew/Library/Homebrew/vendor/portable-ruby/4.0.6/bin/ruby
CPU: deca-core 64-bit arm_donan
Clang: 17.0.0 build 1700
Git: 2.52.0 => /opt/homebrew/bin/git
Curl: 8.7.1 => /usr/bin/curl
macOS: 15.7.4-arm64
CLT: 26.3.0.0.1.1771626560
Xcode: 26.3
Metal Toolchain: N/A
Rosetta 2: false

Output of brew tap

brew tap
antiwork/cli
stripe/stripe-cli