As you may recall from our recent post How Smart Contract Deployment Works, the transaction that deploys a smart contract has a payload that is derived from the compiled source code and any constructor parameters. This process is fully deterministic, so if you compile the same source code with the same compiler and apply the same constructor parameters, you’ll get the exact same payload.
This repeatable process is the key to verifying the correspondence between Solidity source code and a deployed smart contract. When publishing your source code, you need to provide all the necessary information to recreate the deployment payload. In addition to the source code itself, you need to share what compiler settings you used, what version of the compiler you used, and what constructor parameters you applied. Anyone can then generate the corresponding deployment payload, and then they can find the transaction on the blockchain that created the smart contract in question. If the two payloads match, then the provided source code was, in fact, what was used to deploy that smart contract.
This process is a bit cumbersome, so most people choose to delegate this responsibility to a third party.
Specifically, people usually have Etherscan do the work. You can verify any contract on Etherscan, not just ones you deployed. So if the author has provided sufficient information to repeat their compilation process (full source code, compiler version and settings, constructor parameters), then you can use Etherscan's tools to verify that the code is correct.
If they haven't provided that information, you might ask them to do so.