The issue with your question ("How do I know if a certain source code that is located in a certain website is truly the source code of a "known" software") is that there are an infinite number of answers, and none of them are clear-cut going to answer the question.
There are many cases where the package in the repositories links to a now-dead upstream website, when in reality the project name changed and now exists somewhere else. Or, it's just literally a 'dead package' that is unmaintained but upstream developers for that project continue on (this is quite frequently an issue).
Regardless, there's no way to give you an answer that'll clearly answer the question, and it's impossible to define what is 'safe' or not when you start compiling source code yourself (the idea of 'caveat emptor' and 'use at your own risk' both apply in these cases)