I come from Debian GNU/Linux which has a rich set of repositories. So I barely need to use third party repos.
What bothers me in Fedora is the need for some hard to compile packages (In terms of time and dependency chain) which makes it more reasonable to install them using a third party repository like RPM Fusion.
What I'm concerned about is that are RPM Fusion packages trustworthy and safe to install?
By trustworthy, what I mean is in term of security and privacy not tampered with to include malicious code or behavior. Or does anybody checks the upstream code to make sure it's safe?
I'm used to work with repositories like SlackBuilds and AUR which you can check the build scripts and see what is happening (being downloaded, etc).
Is it possible to prove that RPM Fusion packages have been built without being manipulated? for example: there is a build script and a CI CD taking care of building the packages which can be trusted.
There is also another (kinda) similar unanswered question: Security of Fedora third party repo RPMFusion