I would also add:

7. Scan installation package using VirusTotal (Ignore ClamAV and Chinese A/V results).