Systems and methods for generating code-specific code-signing certificates containing extended metadata

A system for generating code-specific code-signing certificates containing extended metadata, the system comprising:

• an intake module programmed to receive a code-signing request from a software publisher to sign code, the code-signing request comprising:
• information that uniquely identifies the code;
• metadata that identifies at least one characteristic of the code;
• a signing module programmed to sign the code by generating a unique, code-specific digital certificate for the code, wherein the code-specific digital certificate is valid only for the code in question and includes at least a portion of the metadata contained within the code-signing request;
• a delivery module programmed to provide the code-specific digital certificate to the software publisher to enable the software publisher to attest that the code originated from the software publisher and has not been altered since leaving the software publisher's possession;
• a revocation module programmed to revoke the code-specific digital certificate to prevent relying parties from trusting the code associated with the code-specific digital certificate;
• at least one processor configured to execute the intake module, the signing module, and the delivery module.

A non-transitory computer-readable-storage medium comprising one or more computer-executable instructions that, when executed by at least one processor of a computing device, cause the computing device to:

• receive a code-signing request from a software publisher to sign code, the code-signing request comprising:
• information that uniquely identifies the code;
• metadata that identifies at least one characteristic of the code;
• in response to the code-signing request, sign the code by generating a unique, code-specific digital certificate for the code, wherein the code-specific digital certificate is valid only for the code in question and includes at least a portion of the metadata contained within the code-signing request;
• provide the code-specific digital certificate to the software publisher to enable the software publisher to attest that the code originated from the software publisher and has not been altered since leaving the software publisher's possession;
• revoke the code-specific digital certificate to prevent relying parties from trusting the code associated with the code-specific digital certificate.