<p>If you look at tagged commits on github, you'll notice they are also signed by the core maintainers keys, notice the "Verified" button, see <a href="https://github.com/bitcoin/bitcoin/tags" rel="nofollow noreferrer">bitcoin/tags</a> and <a href="https://blog.github.com/2016-04-05-gpg-signature-verification/" rel="nofollow noreferrer">Github GPG Signature Verification</a>.</p>

<p><a href="https://i.sstatic.net/SZdBl.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/SZdBl.png" alt="verified tag"></a></p>

<p>You can verify the commits yourself if you've imported the signer's public key, see <a href="https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work" rel="nofollow noreferrer">Verifying Tags</a>:</p>

<pre><code>$ git tag -v v0.17.0
object e1ed37edaedc85b8c3468bd9a726046344036243
type commit
tag v0.17.0
tagger Wladimir J. van der Laan &lt;laanwj@gmail.com&gt; 1538390952 +0200

Bitcoin Core 0.17.0 final
gpg: Signature made Mon Oct  1 04:49:17 2018 MDT
gpg:                using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D
gpg: Good signature from "Wladimir J. van der Laan &lt;laanwj@protonmail.com&gt;" [unknown]
gpg:                 aka "Wladimir J. van der Laan &lt;laanwj@gmail.com&gt;" [unknown]
gpg:                 aka "Wladimir J. van der Laan &lt;laanwj@visucore.com&gt;" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71A3 B167 3540 5025 D447  E8F2 7481 0B01 2346 C9A6
     Subkey fingerprint: 9DEA E0DC 7063 249F B054  7468 1E4A ED62 986C D25D
</code></pre>

<blockquote>
  <p>Is it preferable to use signed binaries or compile from source?</p>
</blockquote>

<p>It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.</p>

CC BY-SA 4.0
2018-10-08T18:19:05.987Z
2018-10-08T18:30:02.027Z
2018-10-08T18:30:02.027Z
JBaczuk
<p>If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?</p>

<bitcoin-core><security><compiling>
Can I, and should I, verify bitcoin core source code before compiling it?
erols
# Can I, and should I, verify bitcoin core source code before compiling it?

(Asked by: username_0 on 2018-10-07)

If I use bitcoin core binary release I can verify them with the gpg keys of the core developers. Is there a similar process for the source code? A follow-up question: Is it preferable to use signed binaries or compile from source?

**Tags:** bitcoin-core, security, compiling


---

## 1 answers

### Answer by username_1 on 2018-10-08. Score: 1 | Accepted answer

If you look at tagged commits on github, you'll notice they are also signed by the core maintainers keys, notice the "Verified" button, see [bitcoin/tags](https://github.com/bitcoin/bitcoin/tags) and [Github GPG Signature Verification](https://blog.github.com/2016-04-05-gpg-signature-verification/).

[![verified tag](https://i.sstatic.net/SZdBl.png)](https://i.sstatic.net/SZdBl.png)

You can verify the commits yourself if you've imported the signer's public key, see [Verifying Tags](https://git-scm.com/book/en/v2/Git-Tools-Signing-Your-Work):

```
$ git tag -v v0.17.0
object e1ed37edaedc85b8c3468bd9a726046344036243
type commit
tag v0.17.0
tagger Wladimir J. van der Laan <laanwj@gmail.com> 1538390952 +0200

Bitcoin Core 0.17.0 final
gpg: Signature made Mon Oct  1 04:49:17 2018 MDT
gpg:                using RSA key 9DEAE0DC7063249FB05474681E4AED62986CD25D
gpg: Good signature from "Wladimir J. van der Laan <laanwj@protonmail.com>" [unknown]
gpg:                 aka "Wladimir J. van der Laan <laanwj@gmail.com>" [unknown]
gpg:                 aka "Wladimir J. van der Laan <laanwj@visucore.com>" [unknown]
gpg: WARNING: This key is not certified with a trusted signature!
gpg:          There is no indication that the signature belongs to the owner.
Primary key fingerprint: 71A3 B167 3540 5025 D447  E8F2 7481 0B01 2346 C9A6
     Subkey fingerprint: 9DEA E0DC 7063 249F B054  7468 1E4A ED62 986C D25D

```

> Is it preferable to use signed binaries or compile from source?

It depends on your situation, but most likely it will be easier to just use the compiled binary. If the binary doesn't work on your system, if for some reason your system is different enough, then compiling from source might be better. As long as you verify the signatures it shouldn't matter whether you run the binary or compile from source, the binaries are just provided for convenience.


---

