The update data is not redistributable, but there is nothing copyrightable in what the "fake update server" returns (30 lines of PHP serving some trivial static XML files).
Ah I see, thanks! I thought the fake update server would be returning the actual data files itself. What a precarious situation to be in though, that's unfortunate.