For the same app, I have:
- an APK from an app store,
- what is claimed to be the source code for the same version. With a pretty usual Gradle build script and structure.
I want to check whether the APK was really built from that source code or not.
How to check that?
- The APK is not obfuscated.
- I have no reason to trust anyone's signature. I only trust the source code.
- I already built the app for myself, but now I want to know whether the APK was OK or not.
- Preferably with Linux command-line tools, but any tool is OK.