https downloads

A lot of link/downloads in the source do use http for download while a secure https is available instead.
Those files can be found for example via github:
https://github.com/arduino/Arduino/search?utf8=%E2%9C%93&q=http%3A%2F%2F

Most important are the sources in build.xml:
https://github.com/arduino/Arduino/blob/master/build/build.xml

And also the avr cores:
https://github.com/arduino/Arduino/blob/master/hardware/package_index_bundled.json

Since arduino has https encryption you could possibly replace verything starting with `http://www.arduino.cc` with https. That would cover most links and would not break anything.

Search the URLs in build/build.xml and hardware/package_index_bundled.json for http:// references, starting with the Arduino links identified in the issue. Check which links have https available and update only those; done means the relevant downloadable sources use secure URLs without breaking the listed files.

Written by the indexing model from the issue text.