What factors do you consider important when downloading a piece of software?

For extra peace of mind, using Android as example. Once I have downloaded an apk from Github, I check it’s SHA-256 to make sure it matches. Then I submit the apk file through to VirusTotal to scan, to see if it flags up any know malicious code. Obviously this isn’t bulletproof, but something you could do if you need extra reassurance.