The aurora client is open source, and you can see it fetches directly from the app store. Am I correct to assume that you have to compile it yourself in order

The aurora client is open source, and you can see it fetches directly from the app store. Am I correct to assume that you have to compile it yourself in order to keep this trust? Otherwise, there's no way to know if the binary being distributed alongside the source fetches from the same place, and we're right back to untrusted apps.