You could also setup a webserver, enable logging and trying to add it into the Synology. That way you might be able to figure out how requests (retrieving packages, download, etc) might look like.
Otherwise SynoCommunity is also reachable via HTTP, so you could easily proxy/sniff in between:
$ tcpdump -i ovs_bond0 -vv ip6 host [SYNO_IP]
[...]
23:43:04.173992 IP6 (flowlabel 0x4139e, hlim 64, next-header TCP (6) payload length: 375) xx > xx.http: Flags [P.], cksum 0x69f4 (incorrect -> 0xf73d), seq 1:356, ack 1, win 225, length 355: HTTP, length: 355
POST / HTTP/1.1
Host: packages.synocommunity.com
User-Agent: synology_apollolake_918+ DSM6.2-24922 Update 5 (package)
Accept: */*
Content-Length: 149
Content-Type: application/x-www-form-urlencoded
package_update_channel=beta&unique=synology_apollolake_918%2B&build=24922&language=enu&major=6µ=2&arch=apollolake&minor=2&timezone=Dublin&nano=5[!http]
Using that kind of information you can actually build a curl command to bypass the “400 - Bad Request” and get the JSON output from SynoCommunity:
$ curl --user-agent "synology_apollolake_918+ DSM6.2-24922 Update 5 (package)" -X POST -H "Content-Type: application/x-www-form-urlencoded" -d "package_update_channel=beta&unique=synology_apollolake_918%2B&build=24922&language=enu&major=6µ=2&arch=apollolake&minor=2&timezone=Dublin&nano=5[!http]" http://packages.synocommunity.com/ | jq
{
"keyrings": [
"-----BEGIN PGP PUBLIC KEY BLOCK-----\nVersion: GnuPG v1\n\n..."
],
"packages": [
{
"conflictpkgs": null,
"deppkgs": null,
"desc": "sslh accepts HTTPS, SSH, OpenVPN, tinc and XMPP connections on the same port. This makes it possible to connect to any of these servers on port 443 (e.g. from inside a corporate firewall, which almost never block port 443) while still serving HTTPS on that port.",
"dname": "sslh",
"download_count": 0,
"link": "http://packages.synocommunity.com/sslh/3/sslh.v3.f4458%5Bapollolake-avoton-braswell-broadwell-broadwellnk-bromolow-cedarview-denverton-grantley-kvmx64-x86-x86_64%5D.spk?arch=apollolake&build=24922",
"maintainer": "SynoCommunity",
"package": "sslh",
"qinst": true,
"qstart": true,
"qupgrade": true,
"recent_download_count": 0,
"thumbnail": [
"http://packages.synocommunity.com/sslh/3/icon_72.png",
"http://packages.synocommunity.com/sslh/3/icon_256.png"
],
"version": "1.19c-3"
},
{
There you might see that they are apparently building the package lists on-demand based on the request sent to their server - to deliver the correct package for the requested arch: notice the ?arch=apollolake&build=24922 at the end of the link.
Edit:
Based on that information I guess they handle it that way:
http://packages.synocommunity.com/$PACKAGE_NAME/$UPDATE_ID/$PACKAGE_NAME.$UPDATE_ID.f4458%5B$SUPPORTED_ARCH_SPLITTED_BY_DASH%5D.spk?arch=$SYNOLOGY_ARCH&build=$SYNOLOGY_BUILD"