I uploaded the packages to S3, hashes are in the osquery-site PR; and I rebuilt my macOS signing VM with new certs so we can continue to sign the 4.x releases :P