MacOS X 10.5.8 update integrity

I want to update an iBook G4 to latest supported MacOS X, which is 10.5.8.

There is a security advisory about the update here: https://lists.apple.com/archives/security-announce/2009/Aug/msg00001.html, it tells us the update image MacOSXUpdCombo10.5.8.dmg sha1 sum should be 6a3a744626503a807dd0158c41d0350aa37fe6c7.

Problem is: the file downloaded from Apple website features a different sha1 sum. I tried downloading multiple times and I still get the same unexpected sha1 sum. Since it is impossible to download the file through https://, it casts some doubts on file integrity. How can I trust this updater?

While there, same question for Xcode 3.1.1, which is the last Xcode for this machine. The download cannot be done through https:// and I cannot even find an Apple published sha1 sum for the file (xcode311_9m2517_developerdvd.dmg). How can I check integrity?