Start with the official download
Use the download links on this website. No public installer is published here yet, so there is currently no released version, public file size or checksum to compare. A development build is not a public release.
When an installer is published, compare the version and file size for the same platform and exact filename. Avoid copies supplied by unsolicited messages or download mirrors you do not trust.
Compare the SHA-256
A checksum detects whether your file differs from the published file. On macOS, shasum -a 256 can calculate it; on Windows, PowerShell Get-FileHash with SHA256 can do the same. Use the actual path to your downloaded file.
Compare the complete result with the checksum published with that exact installer. Stop if they differ. A matching hash does not prove who published the file if both the download and hash came from an untrusted source.
Let the operating system check the publisher
On macOS, keep Gatekeeper enabled and review its publisher checks. On Windows, inspect the installer’s Digital Signatures properties when a signature is supplied, and review the publisher shown by Windows.
A signature, notarization and a matching checksum are different checks. If a publisher is unexpected or the system cannot verify the installer, stop and contact support. Do not disable security checks or remove quarantine flags to make it open.