You trust the developer on this.

A planned feature is the reproducible builds DVM, where different vendors can vouch for a specific hash when building from source. It would appear like checks or badges in the UI.