Feature Request: Verify dmg downloads with associated chunklist

[jspraul]

gibMacOS downloads a number of files over unencrypted http, right? The links I saw within the catalog do not use https and I didn't see it inserted anywhere, even though it is supported on the server-side. I did see some reference to certs though so I could be way off base here (the catalog itself is via https for sure).

Recently zhangyoufu shared a chunklist verification implementation in Python, if you want to incorporate it. Forcing all the downloads to https would be great but digital signature verification is even better! It looks like it would need to be incorporated around line 300 but not sure how to fit it into this larger project.

original source from zhangyoufu
→ incorporated into a python tool for grabbing the images, with AFAIK only stdlib dependencies for Python2/3