If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?
1 Answer
If you look at tagged commits on github, you'll notice they are also signed by the core maintainers keys, notice the "Verified" button, see bitcoin/tags and Github GPG Signature Verification.
You can verify the commits yourself if you've imported the signer's public key, see Verifying Tags:
$ git tag -v v0.17.0
object e1ed37edaedc85b8c3468bd9a726046344036243
type commit
tag v0.17.0
tagger Wladimir J. van der Laan <[email protected]> 1538390952 +0200
Bitcoin Core 0.17.0 final
gpg: Signature made Mon Oct 1 04:49:17 2018 MDT
gpg: using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D
gpg: Good signature from "Wladimir J. van der Laan <[email protected]>" [unknown]
gpg: aka "Wladimir J. van der Laan <[email protected]>" [unknown]
gpg: aka "Wladimir J. van der Laan <[email protected]>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg: There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71A3 B167 3540 5025 D447 E8F2 7481 0B01 2346 C9A6
Subkey fingerprint: 9DEA E0DC 7063 249F B054 7468 1E4A ED62 986C D25D
Is it preferable to use signed binaries or compile from source?
It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.
