Are open-source tools truly what they claim to be?

Let's say the browser I want to use is open-source.

I see the code in the public repo, looks good.Then I go to the browser's website to download the installation package.

How can I be sure that it's actually installing whatever is in the public repo? Can't they alter it and package something else that looks similar and claim it's the code in the public repo? (Especially when you're actually downloading an installer.)

browser claim code download good go to installation package privacy public repo tools website