How do I know an open-sourced app is running the open source code it claims to be running?

You can argue that you can check the checksum of the application's package, but you are then trusting the developer to have compiled the right code and provided the right signature. Is there a way to verify this trustlessly, or is it impossible? Thanks!