Why i need to purchase a certificate to upload my project open source?

[Atticus64]

Hello, I am currently engaged in the development of a project in Rust, wherein I aim to create a Command Line Interface (CLI) program designed to showcase developer news. As I progress with my work, I encountered an issue while attempting to upload my CLI program to winget. Specifically, Windows Defender identified the binary as malware or a virus. However, I must emphasize that this detection is a false positive, as my binary is not signed.

In an attempt to address this concern, I explored the option of utilizing Visual Studio to sign the binary. Nevertheless, I discovered that acquiring a certificate is a prerequisite for signing the binary. Consequently, I am seeking clarification on whether this approach is the appropriate course of action. Alternatively, I am curious to know if there are simpler or more straightforward methods available to sign my binary without incurring any costs.

It is essential to note that my intention is solely to create an open-source project.

I sincerely appreciate your time and consideration in reviewing this matter.

Thank you for your attention.