Get early access
Community Edition · early access

winget install,
but with a receipt.

Attach a Hyper-V or Proxmox host and each winget installer your endpoints need is detonated in a real sandbox, gets an SBOM and an attestation, and is served from your own fenced feed. One no sandbox can run is not served, unless you accept it unverified on Community Edition. Your team installs as usual, and each endpoint’s label shows what is proven about the bytes that landed.

Get early access Read the wedge

Free Community Edition — self-host up to 200 endpoints, no Azure.

ARTIFACT SOURCES
attested
winget
inventory
choco scoop
roadmap
npm pip dotnet-tool ps-gallery msi msix
THE WEDGE

Most tools scan after install. Attestree attests before it.

Scanning is a confession. By the time a CVE shows up in your dashboard, the artifact is already running on your fleet. We move provenance to ingest.

Read the trust model
Provenance at ingest One tree, every artifact Ship signed evidence
HOW IT WORKS

From winget install to a signed deploy.

One closed loop. Your team installs as usual; you approve once; the fleet converges to your own attested feed and stays converged.

01 Request

A user runs winget install. On a fenced endpoint, winget asks your own feed, not the public source. A package you have not admitted is declined cleanly, and the demand is recorded for one-click ingest.

02 Ingest & detonate

With a Hyper-V or Proxmox/KVM host attached, each installer your endpoints need is installed for real in a sandbox VM, per architecture and install scope, so its true file and registry footprint is captured, not inferred from a manifest. Without a host, nothing is verified, so by default no winget version is served.

03 Attest

Syft builds a CycloneDX SBOM over the installed files, and the platform signs an in-toto statement about the installer’s SHA-256 with your deployment’s own key. Download it from the version’s page, with the SBOM where the run kept one, and verify it offline with one command.

04 Review & promote

A detonated package carries a safe-to-deploy verdict — its installer’s signer next to what it actually did in the sandbox. You review the evidence and bulk-promote approved artifacts into rings — canary → pilot → broad — in a few clicks.

05 Converge

Endpoints converge to the union of their groups' packages; the ring sets the version. On a fenced endpoint, winget resolves packages only from your source and accepts only the pinned SHA-256, so it installs only the exact bytes of an installer your feed offered: verified, or on Community Edition accepted. An endpoint whose fence is not applied still gets the version, but from the public winget source under the public manifest's hash; the console shows it unfenced, and nothing it installs reads verified. For a version detonated with the byte store on, your server serves those bytes itself; any other version still downloads from the vendor URL in its manifest, under the same pin.

06 Reconcile

The control plane reconciles desired state continuously and surfaces drift — attributed per machine and per user — and you can roll a ring back to its previous version when you need to.

blocked-demand capture real detonation safe-to-deploy verdict bulk-promote to rings feed-hosted attested bytes per-user installs
THE MODEL

Groups decide what.
Rings decide which version.

PC Groups carry version-free base sets — "Designers get Figma, VS Code, PowerToys." No versions, ever.

An endpoint converges to the union of every group it belongs to. Add a group, the packages follow.

The ring resolves each package to the exact attested version at deploy time — canary gets the new build, broad holds the proven one. Same group, two versions, zero duplicate config.

Rings with rollback, per-user apps and the reports around them: winget patch management.

resolve · LAPTOP-07 ring: broad
# groups
Designers ∪ All-Staff
# union of base sets (version-free)
Figma · VS Code · PowerToys · 7-Zip · Slack
# ring "broad" resolves versions — served from your fenced feed →
VS Code 1.89.2 ✓ attested
PowerToys 0.81.1 ✓ attested
Figma 124.6.3 ✓ attested
OPERATOR WORKFLOW

Approve a hundred packages in a few clicks.

Filter the queue, select the artifacts whose evidence you have reviewed, and bulk-promote them to a ring in one action. Every promotion is a signed event in the evidence store — and those events export as a portable, verifiable bundle on every edition, the free one included.

Bulk promote to a ring One-step rollback Every promotion signed
ingest queue · 3 selected promote → broad
  • Microsoft.PowerToys 0.81.1 detonated · 0 CVE
  • 7zip.7zip 24.07 detonated · 0 CVE
  • Git.Git 2.45.2 detonated · 0 CVE
  • OpenJS.NodeJS 22.3.0 signer changed: review
How we compare

Endpoint managers ship packages. We attest them first.

  • Block an artifact before it enters (ingest gate)

    Attestree: native — read its limits Intune: not addressed Chocolatey: partial JFrog: native Syft + Cosign: partial

  • Real sandbox detonation — installs the package in a VM (Hyper-V or Proxmox host)

    Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed

  • CycloneDX SBOM generated per detonated package

    Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: native Syft + Cosign: native

  • Signed in-toto attestation per verified installer, verifiable on its own

    Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: native Syft + Cosign: native

  • Deploys winget from your own attested source

    Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed

  • Deploys MSI / driver / Windows Update installs

    Attestree: not addressed Intune: native Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed

  • Also manages macOS / Linux endpoints

    Attestree: not addressed Intune: native Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed

  • Ring rollout + one-step rollback to the previous version

    Attestree: partial Intune: partial Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed

  • Fenced endpoint installs only the pinned SHA-256, from HMAC-checked desired state

    Attestree: native Intune: partial Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed

  • Continuous reconciliation + drift detection

    Attestree: native Intune: native Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed

  • Signed, exportable auditor evidence bundle

    Attestree: partial Intune: partial Chocolatey: partial JFrog: native Syft + Cosign: partial

  • Self-host + a genuine free tier

    Attestree: native Intune: not addressed Chocolatey: native JFrog: partial Syft + Cosign: native
native partial with caveats — not addressed · verified vs vendor docs, Jun 2026 · Attestree marks reflect the free Community Edition today (early access)
See the full winget-governance breakdown, head to head
ILLUSTRATIVE ATTESTATION

What a signed statement looks like.

Illustrative values, not product output, in the shape the platform signs. Since platform 0.240.0, each installer a detonation verifies gets a statement like this one, signed with your deployment's own key, so a version can have several: download them from the version's page and verify each offline with one command. Every field, and how to verify it, and the trust model behind it.

Microsoft.PowerToys_0.81.1.intoto.jsonl · payload 

          1
          {
        

          2
            "_type": "https://in-toto.io/Statement/v1",
        

          3
            "subject": [{
        

          4
              "name": "winget:[email protected]",
        

          5
              "digest": { "sha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0" }
        

          6
            }],
        

          7
            "predicateType": "https://attestree.com/attestation/detonation/v1",
        

          8
            "predicate": {
        

          9
              "package": { "manager": "winget", "id": "Microsoft.PowerToys", "version": "0.81.1" },
        

          10
              "installer": {
        

          11
                "sha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0",
        

          12
                "manifestSha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0",
        

          13
                "parentSha256": null,
        

          14
                "derivationStage": null
        

          15
              },
        

          16
              "run": {
        

          17
                "resultId": "3f2b8c1e-7a4d-4e9b-b6c5-0d1e2f3a4b5c",
        

          18
                "origin": "real-sandbox",
        

          19
                "engineVersion": null,
        

          20
                "goldenImageDigest": null,
        

          21
                "isolationStrength": "standard-user-interactive",
        

          22
                "networkPosture": "offline",
        

          23
                "mitmCaSki": null,
        

          24
                "detonatedAt": "2026-10-06T14:04:03Z"
        

          25
              },
        

          26
              "evidence": {
        

          27
                "fingerprintDigest": "sha256:5b1d0c9e8f7a6b5c4d3e2f1a0b9c8d7e6f5a4b3c2d1e0f9a8b7c6d5e4f3a2b1c",
        

          28
                "probeDigest": "sha256:0e1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0a1b2c3d4e5f6a7b8c9d0e1f",
        

          29
                "sbomProjectionDigest": "sha256:7c6b5a4f3e2d1c0b9a8f7e6d5c4b3a2f1e0d9c8b7a6f5e4d3c2b1a0f9e8d7c6b"
        

          30
              },
        

          31
              "sbom": {
        

          32
                "mediaType": "application/vnd.cyclonedx+json",
        

          33
                "specVersion": "1.6",
        

          34
                "digest": { "sha256": "e45a91d2c0b3a4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f70819203" },
        

          35
                "componentCount": 41,
        

          36
                "summary": {
        

          37
                  "digest": { "sha256": "a1b2c3d4e5f60718293a4b5c6d7e8f90a1b2c3d4e5f60718293a4b5c6d7e8f90" },
        

          38
                  "viewVersion": 1
        

          39
                },
        

          40
                "absent": null
        

          41
              },
        

          42
              "verdict": { "attestationTier": "attested-signed" },
        

          43
              "signing": { "mode": "at-ingest" },
        

          44
              "tenant": "contoso",
        

          45
              "attestedAt": "2026-10-06T14:04:09Z"
        

          46
            }
        

          47
          }
FOR YOUR FLEET

Same tree.
Start where you are.

Whether you run two laptops or five hundred, the attestation primitive is identical. Policy, deployment, and evidence shape themselves to your environment.

01 Hobbyists & enthusiasts

Homelab

You install whatever winget hands you. One typosquat ends the lab.

See solution
02 5–100 endpoints

Small business

Patching is ad-hoc. You have no SBOM, no inventory, no story for auditors.

See solution
03 100–500 endpoints

Mid-market

Your app-patching tool ships updates; nobody verifies what they contain.

See solution
WHERE WE'RE HEADED
Engineering-led security Horizon

SaaS engineering

You ship daily and pull npm, pip, and winget all day. EU CRA and EO 14028 now want an SBOM for every artifact.

Where we're headed
5,000+ endpoints Horizon

Enterprise

You scan after install. Mean-time-to-remediate is measured in weeks.

Where we're headed
Regulated environments Horizon

Financial services

NYDFS, GLBA, SOX: prove every install was approved before it ran.

Where we're headed

Pre-GA and onboarding design partners. These describe where Attestree is heading, not a shipping product today.

Be a design partner.

We're opening a small number of design-partner slots to harden the policy DSL and the evidence pipeline. If your fleet feels brittle, talk to us.

Real detonation — Hyper-V + Proxmox Apache-2.0 shim, open source Open formats: CycloneDX, in-toto Swiss-registered word mark Direct founder access

Apache-2.0 installer shim, its source published when Community Edition launches. We're onboarding our first design partners now; you'd be early by design.