Other than having someone manually reading all of the code, how can you demonstrate an open-source project's reputability? i.e. it is not a virus/malware/whatever.I'm not concerned with the efficiency of the program.  I just need to be able to demonstrate that the program is exactly what it says it is and is thus not a security risk to install.
How to give evidence that an open-source project is reputable?
software;security