I’m note a programmer. I Don’t Understand Codes. How do I Know If An Open Source Application is not Stealing My Data Or Passwords? Google play store is scanning apps. It says it blocks spyware. Unfortunately, we know that it was not very successful. So, can we trust open source software? Can’t someone integrate their own virus just because the code is open?
Yes you can tamper the executables if it’s you on your pc compiling the code and upload it to the release page…
BUT if you use ci/cd pipelines, you can almost be sure it’s not a human who is in charge of compiling. It’s a robot who automatically clones the repo, launch the build and upload the artifact to release. It’s much more transparent this way