Or you build it yourself and verify you got the same checksum.

https://reproducible-builds.org/