Instead of leaving a snarky comment you could have simply pointed to the right resource: http://support.apple.com/kb/ht5044 http://support.apple.com/kb/ht5044

Instead of leaving a snarky comment you could have simply pointed to the right resource: http://support.apple.com/kb/ht5044 http://support.apple.com/kb/ht5044 [edit] Even said resource which provides the SHA1 for apples packages does not have SSL encryption, so now I have to hunt down a page that IS encrypted and provides the SHA1. This is far from good practice.