MichaelJohn Yes, when you use Obtainium you're inherentmy trusting the source (e.g. GitHub) not to be tampered with, which is a Faie assumption to make.
Combine it with an app verifier and reproducible builds.
The offical projects opinions are more favorable to Obtainium than F-droid.
https://nitter.meowing.monster/GrapheneOS/search?f=tweets&q=Obtainium&since=&until=&min_faves=
We recommend using developer releases of apps rather than the F-Droid releases of apps:
Accrescent is one way to get developer releases of apps.
Most users can't be expected to use Obtainium + App Verifier and a better approach than that is needed.
Obtainium is a way to obtain apps directly from the developers. Many people prefer it because they realize F-Droid isn't actually doing actual real auditing/review but rather simply runs apps through near useless antivirus scans, etc. It adds a trusted third party and new issues.
We recommend using Accrescent for the developer builds of apps in it, getting other apps directly from developers (Obtainium + App Verifier are one way) as a fallback and using the sandboxed Google Play Store for apps on the Play Store particularly since many need Google Play.
Obtainium is not recommended against, it is said to be an option for advanced users.
F-Droid is recommended against https://nitter.meowing.monster/GrapheneOS/search?f=tweets&q=f-droid&since=&until=&min_faves=
F-Droid has consistently failed to take serious privacy and security issues with their app, repository and infrastructure seriously. They've repeatedly introduced severe vulnerabilities into apps by downgrading dependencies and making other problematic changes. They don't keep up with crucial security updates for apps. They don't follow security best practices in F-Droid as a whole.
F-Droid can entirely avoid warnings being shown for installing F-Droid and apps from their repository after September. They have multiple people verified and can register apps to avoid warnings. The problem is they've reused upstream package names. Their approach has already negatively impacted users for years especially for people using multiple profiles. They ignored this for years and doubled down on reusing upstream package names. If they had stopped doing it back in 2016 when we first brought it up, the situation would be much better.
F-Droid's core developers have repeatedly made anti-security statements including opposing sandboxing, opposing updating dependencies with important security patches, opposing privacy/security improvements in newer API levels and much more. They've made a mountain of false claims about many of these topics. It's unsurprising that they're now misleading people about this.