Fdroid is not a virus scanner you can trust blindly. You have to trust both, app devs and fdroid. I fully agree with what you write. Most devs do not yet publish reproducible builds. Maybe Fdroid should’ve created a separate repo just for them and depreciating the old repo over time. There’s no way for the user to know if it is a reproducible build or not right now. I prefer fdroid with reproducible builds over obtainium but in it’s current state it’s ambiguous which method you should use. I lean towards obtainium. In hindsight I should’nt have stated it that confident