Nevertheless, my answer to your next set of questions goes back to my gold analogy: how do I know that a piece of metal is gold? Should I just believe what I've come to know over the course of my life that gold is yellow, shinny, dense, atomic #79, etc? What if it's not? What if everyone is lying to me?
What if cats are actually dogs and dogs are actually cats!!
Yes, everybody is lying to you.
So, I assume you always build your software yourself AND before that, you look through the code.
But still, how do you verify that hash? Where does it come from initially?