What you have described is pretty much an opposite of how F-droid works. One can&#x27;t just take binary (whether official or compromised) and upload it there. [1]<p>Instead, to publish an app there, you need to provide source code repository [2], and their build farm would build it, sort-of [3] providing guarantee that source code you can inspect is the same one you got running on your phone.<p>[1] There are exceptions, i.e. apps uploaded as binary-only (for example Firefox), but those come with big red warning that user sees before installing them.<p>[2] <a href="https:&#x2F;&#x2F;f-droid.org&#x2F;wiki&#x2F;page&#x2F;FAQ_-_App_Developers#Will_my_app_be_built_from_source.3F" rel="nofollow">https:&#x2F;&#x2F;f-droid.org&#x2F;wiki&#x2F;page&#x2F;FAQ_-_App_Developers#Will_my_a...</a><p>[3] Sort-of because reproducible builds for Android not here yet, so you can&#x27;t just rebuilt it yourself and compare sha256, unfortunately.