Something is emitting a single space, which breaks the download. I don't know what. The files that are most likely to be modified would be includes/configure.php, includes/languages/english.php, and includes/languages/english/download.php. Maybe something in modules? E.g. includes/languages/english/modules/header_tags/
With Download by Redirect set to false in admin > Configuration > Downloads, I would try with a fresh install of 1.0.8.17.
Or you could try the previous code with the die line removed and see if it works that way, although that seems like the long way around. Better to find what is emitting the extraneous space.
I think that that will fix the immediate problem (that the file is corrupted) and log the underlying issue (that content is being produced).
I tested it with redirect both on and off, and it worked for me. I think that redirect is probably not the best way, at least as implemented here. In any case, it is more likely to work without redirect than with.
It's possible that someone could implement redirect at a lower level. An authenticated proxy at the Apache level would be both efficient and secure. Of course, that would require someone capable of writing some kind of mod_authn_php to integrate the PHP code with Apache. That would be nifty (we could also use that instead of basic authentication for admin), but I'm not holding my breath.
After many hours, eventually found the source of the issue and, of course, it was exactly as you said - a space before a <?php in a non-core file.
Convinced testing was on a clean install but discovered that an error was made during FTP. :ashamedFace:
Will test your commit.
Many thanks again for your kind help and attention.