You could always examine the code and compile from source as seen.

You could also use a hash to verify the content of the code does not differ from the source.

Using precompiled binaries should be able to use a hash to verify as well.

You can also run a scan on the app/code.