For a while now, we have been talking how we get our OpenTTD binaries signed, and how we would get published on Steam. There are many aspects to this, and I am trying to put all that in a single place.
None of the current developers really has experience with this. So most of this information is collected from googling, asking on reddit, asking on twitter, etc. Please, if you have any experience with this and read here things that are wrong or could be done cheaper, let us know!
Depending on the platform, there are different needs for signing binaries. What they all have in common: you need a Code Signing Certificate. They come in two flavours: OV and EV (Extended Validation). For example, on Microsoft platform, an EV bypasses their SmartScreen (the nag-screen you get when you downloaded and application and start it for the first time). An OV still shows it, and over time, as you gather trust, it will fade away. With an OV it does allow you to run it without going through hoops. [1] [2] [3]
The price of such certificate heavily depends on which authority you use.
- Comodo / sectigo charges $166 for OV and $299 for EV, per year.
- GlobalSign charges $289 for OV and $410 for EV, per year.
- SSL.com charges $129 for OV and $349 for EV, per year. They do give heavy discounts if we order multiple year in advance.
- GoDaddy charges $199 for OV, per year. GoDaddy does not seem to offer an EV. (Mind you, their Driver Signing Certificate is a very old product; you can't even sign Drivers for Windows 10 with it, which require an EV.)
- DigiCert charges $499 for OV and $699 for EV, per year.
- Certum charges $129 for OV and $359 for EV, per year. Certum has one other offer, an Open Source one, for $25. But, there is a but. That only works if you request the certificate from a personal name. This will also be stated on the name on the certificate, "Developer ....".
- ksoftware charges $84 for OV and $349 for EV, per year.
In all cases, we need a legal entity to request the certificate.
Next to these costs, from what we understand, for Mac you also need an Apple developer account. This costs $99 dollar per year.
We need a legal entity to request an account.
To signup for Steam (via Steamworks), you need a legal entity, with a valid banking accountnumber. You need to proof your identity. After this, you can create an account.
Depending of the country the company is created, there will be some money involved in getting a bankaccount on the company.
We are on the Microsoft Store.
As you might have read, everything needs at least a legal entity before we can do anything. This comes in three forms:
- put it on the personal name of one of the developers
- find a "shell" company that hosts open source projects (Apache, ..)
- create a limited liability legal entity in some country
Although this is fully plausible, and even the cheapest solution, there are some questions that needs answering:
- what if that person leaves the community or becomes unreachable?
- are users going to trust a random name they see on their binaries?
- what happens if such person is held liable in what-ever form, in regards to OpenTTD?
- are we financially supporting this person for the costs he makes during all this?
They can all get their answers. For example, if we minimize what we do under such entity, 1) can simply mean someone else goes through the hoop the year after. 2) will always be a pain, but maybe people don't notice. 3) we can say "that is not going to happen". 4) seems like the most sane thing to do.
Nevertheless, these questions need answering, and someone needs to be willing to do so.
There are several companies that accept Open Source projects, allowing to use them as a legal entity. They mostly even help with all kinds of things. Apache Foundation is of course one of them, or Software Freedom Conservancy. There is also an Europe based on, techcultivation, but this doesn't seem to be anything just yet. We can only find a whitepaper about it, and that is about it for now.
There are a few things to keep in mind with these companies:
- it is unknown to us what the impact is of moving OpenTTD under their umbrella. It is clear that you put all your assets in there. For example, SFC keeps 10% of the donations (which is fair, I guess). These things have to be investigated and worked out.
- most of them are US-based. The EU was busy with these kind of things, but to our knowledge, there is none yet. Most (all?) of the OpenTTD developers are EU-based. To us the legal impact of moving everything to US is unknown.
- it is unclear of a Foundation like Apache would accept a game like OpenTTD.
For this, I (TrueBrain) looked into how to do this in The Netherlands. I cannot speak for any other country, as I live in The Netherlands. In The Netherlands we have a concept called "Stichting", which is a legal entity where there is a board in charge. The board can be anyone, as long as they have proven their identity at the notary. We can change who is in the board at any time. It is strongly suggested there are always 3 members in the board.
Such "Stichting", in the way we would set it up for OpenTTD, cannot pay people. It would only accept donations and spend it on infrastructure, certificates, etc. It (most likely) won't have to pay VAT.
By law, this "Stichting" is liable, unless the board was negligence; this is unlikely in our case.
There are costs involved to set this up: ~300 euro one-time fee, and a fee for mutations.
There are two drawbacks:
- a "Stichting" need a Dutch home address at all times. It doesn't matter who is in the board, as long as the address is a real address in The Netherlands.
- the name of the "Stiching" needs to contain the word "Stichting"; so "OpenTTD Stichting" would be the name. This name will be shown on certificates too.
Most likely similar solutions exists in other countries (in Europe).
orudge, see below in comments, gave some input on this. In the UK you can launch a company for 15 pound (a year it seems). It would have one (or possible more) directors.
Yearly some documents have to be filed, and that is about it.
As of yet, nobody checked with a notary or lawyer if this works for our situation. The assumption is it would, given the collective experience with running companies in the UK. It might be worth checking with a notary/lawyer before proceeding with this solution.
michi_cc, see below in comments, gave some input on this. There was some more chat about it on IRC. Bottom-line: not a valid option.
nielsm, on IRC, gave some input on this. Bottom-line: not a valid option.
For a Stichting, the only yearly work is tax filing really, and you can get an exempt for that with a company this size. That means the only thing you have to do is to keep a book of what you get and spend a year, and store that somewhere for a few years. Very minor bookkeeping. That is one of the reasons I was looking into that form ;)
For the UK variant, orudge is already doing that for his own company, so I am sure he knows the work he would be getting into.
But yeah, from experience too, having a normal company that makes money, requires you to spend silly amounts of time a year to get everything in order .. ugh :P But luckily enough we can avoid most of that.