This question already has an answer here:
I am downloading an inbetween version of MacOS necessary to update to High Sierra from an older version of El Capitan from here.
Funny thing is, when I right click and get the download link from Chrome, it gives me an HTTP, not HTTPS. So, I attempted to get it with a browser and using
wget and no matter how I try to get it, I get a
302 moved temporarily redirect to an insecure connection.
That link will redirect to the non-secure version of itself. There is no way to know that the dmg file you get has been altered.