As a practical approach on Windows, for well-known software, I go to Wikipedia, look up the project there and then get the link, obviously that's not guaranteed

As a practical approach on Windows, for well-known software, I go to Wikipedia, look up the project there and then get the link, obviously that's not guaranteed to be correct, but for well-known projects bad links usually get corrected relatively fast, so it's probably correct For lesser known projects I just cross my fingers, but typically lesser known projects are less likely to have malware posing as them