Probably worth mentioning:
At a minimum yo ushould verify the link that you are clicking to download comes from the correct site, the chirp web site.
When you are hovering over the link for the actual download it should come from chirp.danplanet.com, or trac.chirp.danplanet.com.
There are lots of malicious sites and banner ads that will try to get you to download other software or your intended software with an infected installer.
Additionally, you can verify that the checksum of the file you downloaded matches the one published on the CHIRP web site in the same folder in a file named SHA1SUMS. You need the utility sha1sum, or an equivalent that can compute a SHA-1 checksum.
http://chirp.danplanet.com/download/0.4.1/SHA1SUMS http://trac.chirp.danplanet.com/chirp_daily/LATEST/SHA1SUM
Hope this helps, --Rob