2

If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?

1

If you look at tagged commits on github, you'll notice they are also signed by the core maintainers keys, notice the "Verified" button, see bitcoin/tags and Github GPG Signature Verification.

verified tag

You can verify the commits yourself if you've imported the signer's public key, see Verifying Tags:

$ git tag -v v0.17.0
object e1ed37edaedc85b8c3468bd9a726046344036243
type commit
tag v0.17.0
tagger Wladimir J. van der Laan <laanwj@gmail.com> 1538390952 +0200

Bitcoin Core 0.17.0 final
gpg: Signature made Mon Oct  1 04:49:17 2018 MDT
gpg:                using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D
gpg: Good signature from "Wladimir J. van der Laan <laanwj@protonmail.com>" [unknown]
gpg:                 aka "Wladimir J. van der Laan <laanwj@gmail.com>" [unknown]
gpg:                 aka "Wladimir J. van der Laan <laanwj@visucore.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71A3 B167 3540 5025 D447  E8F2 7481 0B01 2346 C9A6
     Subkey fingerprint: 9DEA E0DC 7063 249F B054  7468 1E4A ED62 986C D25D

Is it preferable to use signed binaries or compile from source?

It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.