That’s why you sign stuff - to proove the software delivered not only came from the right place/server but contains the code that was packed at buildtime. THIS is the generic update approach.