Verify that an APK has been built from given source code For the same app, I have:


an APK from an app store,
what is claimed to be the source code for the same version. With a pretty usual Gradle build script and structure.


I want to check whether the APK was really built from that source code or not.
How to check that?

Notes:


The APK is not obfuscated.
I have no reason to trust anyone's signature. I only trust the source code.
I already built the app for myself, but now I want to know whether the APK was OK or not.
Preferably with Linux command-line tools, but any tool is OK.
You can only do this with 
reproducible builds: 


  "A build is reproducible if given the same source code, build environment and build instructions, any party can recreate bit-by-bit identical copies of all specified artifacts."


So the app developer or the app store needs to be on board in order for it to work.
Otherwise your only option is to build it yourself.

One example of a developer who currently does this is Open Whisper Systems:
https://github.com/WhisperSystems/Signal-Android/wiki/Reproducible-Builds