You can study the source code and build this client yourself. To do this, just install a free version of the development environment and install a couple of free packages from the package manager.
P.S. And you shouldn’t think that everyone is telling you the absolute truth. With the same success, it could be a purely American repository owned by an attacker. And the fact that I’m Russian doesn’t bother me. I don't agree with what my government is doing, but it doesn't matter.
And one more interesting fact. If you place an application in Program Files, then upon startup there will be no notifications about an unsigned application. Most software in the world does not have a signature (including mine)