If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?
You can verify the commits yourself if you've imported the signer's public key, see Verifying Tags:
$ git tag -v v0.17.0 object e1ed37edaedc85b8c3468bd9a726046344036243 type commit tag v0.17.0 tagger Wladimir J. van der Laan <firstname.lastname@example.org> 1538390952 +0200 Bitcoin Core 0.17.0 final gpg: Signature made Mon Oct 1 04:49:17 2018 MDT gpg: using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D gpg: Good signature from "Wladimir J. van der Laan <email@example.com>" [unknown] gpg: aka "Wladimir J. van der Laan <firstname.lastname@example.org>" [unknown] gpg: aka "Wladimir J. van der Laan <email@example.com>" [unknown] gpg: WARNING: This key is not certified with a trusted signature! gpg: There is no indication that the signature belongs to the owner. Primary key fingerprint: 71A3 B167 3540 5025 D447 E8F2 7481 0B01 2346 C9A6 Subkey fingerprint: 9DEA E0DC 7063 249F B054 7468 1E4A ED62 986C D25D
Is it preferable to use signed binaries or compile from source?
It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.