Comment by ecmendenhall

This bug was pretty serious. I'd better be extra careful and install and verify this myself.

Oh, good: there's a standalone installer available (http://support.apple.com/kb/DL1726). But the download is served over HTTP. Maybe I can just try the same URL with HTTPS:

  $ curl --head https://support.apple.com/downloads/DL1726/en_US/OSXUpdCombo10.9.2.dmg
  HTTP/1.1 302 Moved Temporarily
  Server: Apache/2.2.24 (Unix)
  Location: http://download.info.apple.com/Mac_OS_X/031-3279.20140225.Zzasf/OSXUpdCombo10.9.2.dmg

Nope. Well, at least I can verify the SHA1 sum displayed on the download page. Wait, no, that was served over HTTP, too.

Okay, I'll follow Apple's instructions for checking the certificate fingerprint in the installer (http://support.apple.com/kb/ht5044). But that page (Last modified November 2011) displays a different fingerprint (9C864771 vs FA02790F)...and that fingerprint was also served over HTTP.

Gives up and opens the App Store.