cuckflared
At the same time, as a long time Debian user, I've always felt more secure by using packages built and signed by a "reputable" entity. I know Debian is not ideal, but at least there is some hope that the machines an OSes used to build packages are clean and not infected with malware. Of course I understand that infecting such central entity could have devastating effects.
There are a huge number of Debian packagers and many have a history of untrustworthy behavior. You're trusting an enormous group of people able to add vulnerabilities intentionally or unintentionally. Aside from that, you're only getting a subset of backported patches for vulnerabilities with CVEs which are a subset of overall vulnerabilities. Debian also has a history of introducing many vulnerabilities with downstream changes including some quite famous ones such as the Debian SSH weak key issue, but it's far from the only one. F-Droid has a similar history of doing this through using an outdated build environment and dependencies including downgrading app dependencies to ones with vulnerabilities.
But if, on the other hand, I use packages built by the developers, I have to trust that their personal computers are free from malware e.g. from pirated software or porn sites:D How many developers build their apps in secure environments?
F-Droid automatically downloads and build the code. There's no review or auditing process. They build and ship what's released. As an example, WireGuard included a self-updater in plain sight and F-Droid never noticed it even after WireGuard began using it. They found out about it from the developer talking about it.
Maybe reproducible builds and an easy way to compare the results could help solve this problem. If I understand correctly App Verifer only checks signatures but doesn't verify if binary form matches the source code.
Open source software doesn't provide the privacy, security or trust assurances you believe it does. The Linux kernel has hundreds of serious vulnerabilities found each month. A portion of those have existed for years or even decades. How would open source protect against a subtle backdoor when tons of serious vulnerabilities can survive for so long with no one making an attempt to hide them? Someone could create a similar vulnerability on purpose but hide it. How would it protect against that?