[arch-general] PKGBUILD - clamav 0.103.4 - source .tar.gz downloads fine, .tar.gz.sig is 403? (same with Arch package)

[David C. Rankin]

I'm toying with a clamav-lts for the extended support of 0.104 and I have a
strange problem downloading the signature file that results in a 403
permission issue from curl, but downloading directly from the clamav directory
(with the same link) works?

Short version:

pkgname=clamav-lts
pkgver=0.103.4
...
source=(https://www.clamav.net/downloads/production/${pkgname%-lts}-${pkgver}.tar.gz{,.sig}
        ...

taken directly from the 0.103.3 PKGBUILD.

>From the command line both curl and wget fail with the same issue.

The official Arch clamav for 0.104.1 retrieved tonight with asp export shows
the same behavior when trying to build the package.

Am I missing a key or signature. I thought that any user should be able to asp
export clamav and then 'makepkg -g' and retrieve the source files?

-- 
David C. Rankin, J.D.,P.E.