You can trust the software in your distro’s repositories (if you run a distro with well-maintained repositories). This is because, generally only well-known software gets packaged, the packager should be familiar with both the project and the code, and everything is rebuilt on the distro’s own infrastructure, to ensure that a given binary actually corresponds to the source.

It might still be possible for things to slip through, but it’s certainly much safer than random programs from online.