If you are looking for an alternative I've been using KSoftware for years, they are cheap and good.

When I looked into this originally, before choosing StartCom, the KSoftware process was really non-optimal.

Just to get a signing certificate I'd need to get my personal id docs signed by a public notary, get those docs to the KSoftware people, and THEN they'd be ok to issue the cert.

Whilst not impossible, that's like the process was back in the Stone Age ;) for getting normal https website certs.

Obviously went with the StartCom approach instead, which may need to be looked at again if we need to sign packages in the near future. :/

I second this recommendation. I've been using them for years too.

CERTUM provides AuthentiCode-compliant certificates from about 30 euros (for open-source usage).

Interesting. I looked at the Certum website a while ago, before choosing StartCom.

The page on the Certum website about certs-for-open-source-signing didn't mention AuthentiCode at all. The AuthentiCode compliant certs seem like a different product.

If their certs for Open Source projects really are Authenticode compliant, I'd expect that to be front and center on the page about it. It's the one main feature of importance. :)

Seriously, this has been a problem for the longest time. At one point you could get free ones for open source projects I think, from comodo perhaps? But no longer the case, which is tremendously frustrating.

StartCom is even part of the KMCS cross-cert list.

There's always GPG signing.

Does that provide the same integration into Windows that Authenticode does? Plus timestamp, dualsign, and cross-sign?

>Does that provide the same integration into Windows that Authenticode does?

Nope

Doesn't solve the Windows scary warnings issue.

Technically correct, but it solves a different problem. The StartCom signing cert is a solution solving the "big scary warning" problem on Windows for untrusted binaries.

GPG signing is suitable for a different group of users. :)