Using a non-Microsoft compiler, I have written small application for Windows that I'd like to give away for free or sell for some trivial amount ($5 say). The program doesn't use the registry but I'd like to provide it as an installer executable (e.g. MyAppInstall.exe) created using freely available tools (e.g InnoSetup).
From Signing a Windows EXE file and other sources my understanding is as follows:
If I do not sign the installer, Windows will pop-up a warning dialogue box warning the user that the publisher is unknown and suggesting they should not run the software. This is undesirable.
If I sign the installer with a self certified key, The popup dialogue will at least provide a publisher name instead of "unknown". It will say the publisher could not be verified or the publisher is untrusted. This is probably marginally better than being described as an unknown publisher.
If I pay ~$100 every year to a CA, I can get a code-signing cert that will allow me to give away useful free software that can be easily installed - without scary and off-putting dialogues appearing.
I can use the Windows edition of OpenSSL to create a self-certified key for code signing. This way I don't have to download an install a 590 MB SDK file from MS just to obtain Microsoft's makecert.exe
Catch 22: The only code signing tool I have heard of is signtool.exe which can only be obtained by downloading and installing at least 590 MB of other stuff (the SDK).
Q: Is there an alternative to Microsoft's signtool.exe
There is kSign, and their blog also has an article about how to integrate with Inno Setup.
It is not a complete replacement for signtool (i.e. it won't sign .cat and .sys files involved in signing driver packages) but it will will digitally sign EXE,DLL,COM,CAB and OCX files.