I know the whitelabel EU app is open source but are the derivatives going to be? As far as I understand it, every EU country will release its own version of the app.
And it's actually a good thing and not bad. EU version explicitly requests Google or Apple attestation, which at least on Android is astonishing overreach, since theres Hardware Attestation API that can confirm the platform integrity better (instead of confirming old, unpatched handsets with leaked keys are secure, LOL).
Hopefully some countries will do it the correct way.