updates not downloaded via HTTPS?

[hehe299792458]

I've been downloading the disk images of updates for both macOS and iOS more and more, because it's faster to update multiple devices that way. However, I noticed that it downloads these files over HTTP and doesn't seem to use any form of encryption.

is that normal, or am I just using the wrong links to get these files?

 

[CreatorCode]

Yes, Apple's download server for updates doesn't support TLS.

Apple provides the instructions that follow for manually verifying the integrity of downloaded updates:
https://support.apple.com/en-us/HT202369

EDIT: Apple does have a TLS-enabled server, but it's not the one they link to.
The regular one is http://appldnld.apple.com ; the TLS one is https://secure-appldnld.apple.com