Because of the current debate about tracking and privacy regarding the new Corona apps, I'd like to know in general, if an app or software really uses solely the code that it claims to be build on if it is open source. So how can I be sure, an app that I download from an app repository (like Googles Play Store) is truely using exactly this code? Is it possible at all?
I know that there might be other vulnerabilities (e.g. the app uses system libraries too which I have to trust). But let us consider only the app/software itself, in order to make it not to complicated.
I've got the impression that it is not truely possible. Or only with much efforts that a normal user cannot perform. Can one only trust and hope? Or how can I authenticate an app easily?
Open Source is fine (actually one of the greatest things ever!), but if I don't know whether I get what I should get, it is really bad.