Technically, you don't. The beauty of FOSS software is that you don't need to trust the author. I know that auditing the source code of something as large as a Linux Distro may be prohibitively difficult for one person to do alone. Groups of people do audit them though, and they have found nefarious things in the past, in the case of Google.