Signatures?

[MajorGeneralHammond]

I'm installing electrs on mac os, (building from source I guess since I'm using [https://github.com/ArmanTheParman/Parmanode] but I haven't validated any signatures for electrs like I would if I were using pre-compiled binaries. How do I verify the code is legit without signature verification? I realize this is probably a dumb question. I'm sort of just a normie. Thank you.

[romanz]

You can use GPG to verify electrs tags, when building from source:

$ git tag --verify v0.10.1 
object 7868c4813c96b9932fa1398e8c9bb3c505b4451f
type commit
tag v0.10.1
tagger Roman Zeyde <me@romanzey.de> 1698868945 +0200

v0.10.1
gpg: Signature made Wed 01 Nov 2023 22:02:25 IST
gpg:                using ECDSA key 15C8C3574AE4F1E25F3F35C587CAE5FA46917CBB
gpg:                issuer "me@romanzey.de"
gpg: Good signature from "Roman Zeyde <me@romanzey.de>" [ultimate]
gpg:                 aka "Roman Zeyde <roman.zeyde@gmail.com>" [ultimate]

See https://romanzey.de/pgp.txt (or https://github.com/romanz.gpg) for my GPG public key.

[romanz]

See also https://raspibolt.org/guide/bitcoin/electrum-server.html#electrs.