file tampering ? digital certificates ? files hash ?

Scarily enough, I'm a pretty paranoid person already and I've never thought to look at that. In that case, the best idea is to run everything in separate Windows virtual machines, and backup/restore/wipe the data every usage.

Or not care.

(Sorry if that sounded sarcastic, but I was serious.)

I usually provide a MD5 sum for my setup packages. Else it works on trust. So far the people that usually release app (Myself, wraithdu, ZachThibeau, JohnTHaller, and man, many many more) haven't gotten in trouble for doing that. We take pride in what we do and providing good clean software for all who whish it.

And by the way, it is a good thing to scan it. Do you use virus total and jotti?

There are risks involved.

I for one would never download a file from a new comer signed/hashed or whatever until he has proven himself over time, unless others who have good security procedures in effect have commented already.

Even with known folks, I scan all downloads thru Virus Total.

The problem with signing is that if the program had malicious content signing would not tell you that, and even if the program were not malicious, if the signer signed it without realizing it was infected with a virus that he did not know he had, it would have a valid signature, but still be infected.

Checksums/hashes only tell you if the download was successfully completed.
Signatures are only as trustworthy as the person who signed them.

If you are truly concerned I would say don't download apps from this site until they are Officially Released and signed.

And all of our Official Releases come from our servers on sourceforge , I would never download a version from MakeShift.com

Tim