You mean if you build it yourself? I guess that is something, but it is still conceivable to sneak stuff in. Look at that xzlib backdoor from a few weeks ago.

Is there any way to verify that the product in deployment is built from the same source? I'm guessing hash values but I still think it can be faked.