Seems, the current proper way to do this is to provide guest access with no URL parameters, so that "?" is not considered as filename character.

e.g. http://buildserver/guestAuth/repository/download/BuildServer_MasterBuild/150640:id/TeamCity-5210.tar.gz
instead of
http://buildserver/repository/download/BuildServer_MasterBuild/150640:id/TeamCity-5210.tar.gz?guest=1

Further feature elaborating can include providing access to artifacts via unique URL (resettable) like:
http://buildserver/AuthToken/70o3pur3Z/repository/download/BuildServer_MasterBuild/150640:id/TeamCity-5210.tar.gz?guest=1

/guestAuth path implemented

Thanks you for adding this feature so quickly.

Just wondering about the details of this implementation:

• Do you have to do anything to implement this change?: i.e. make any local configuration changes.
  
• Will this be available in TeamCity 2.1.1?
  
• Any idea when 2.1.1 will be released?
  
• What exactly is the path necessary to use this when guest users are allowed?

Is it something like this?:
http://myserver.com:8111/guestAuth/repository/download/bt52/2973:id/myrpm-1.0-110.noarch.rpm

1) The change does not require any local configuration modification. It is enough to enable guest user login.
2) Yes it will be available in 2.1.1
3) We will try to release it on the next week
4) The path is like the one you specified, i.e. you just need to add /guestAuth/ prefix, in this case guest=1 parameter is not required.

Excellent. Thanks!