Why download links expire

When a site checks for updates the hub hands back a signed download URL valid for fifteen minutes. WordPress core fetches that URL itself, without the site token, which is why it has to authenticate on its own.

A link copied out of a log will therefore stop working shortly afterwards. That is intended.