[somepig]

You might consider reading up on reproducible builds. The majority of Debian packages can now be bit-for-bit rebuilt to verify the maintainer actually ships what they say they are.