Each release has a manifest listing every file with its size and SHA-256. Downloads links it next to the packages.
Check the SHA-256
On Linux, in the folder with your download:
sha256sum <downloaded-file>In Windows PowerShell:
Get-FileHash -Algorithm SHA256 .\<downloaded-file>Compare the whole value with that file’s entry in the manifest. If it differs, don’t install it. Download it again from the official release.
A checksum catches changed bytes. It can’t help if someone replaced both the file and its checksum, so only use the release linked from this site.
Keep the notices
Computer archives include LICENSE, NOTICE, third-party notices, a CycloneDX SBOM and install instructions. Keep them with the programs.