Attestree vs rewinged
rewinged is a free, MIT-licensed self-hosted winget package source written in Go by an independent maintainer. It serves unmodified winget manifests, lets you add your own for internal software, can automatically internalise installers so machines without internet can still install them, and supports restricting access with Entra ID authentication. It runs on Windows, Linux or Docker. The project describes itself as pre-1.0.
Verified against vendor documentation, September 2026
When rewinged is the better answer.
rewinged is genuinely good software and the most actively maintained of the open-source winget sources — its latest release added support for the 1.12.0 manifest schema in July 2026. For a homelab, a small team, or anyone who wants a single Go binary serving a private source with no platform attached, it is an excellent answer and it is free. We would rather point you at it than pretend otherwise.
Where the two part company.
rewinged solves distribution. It does not attempt governance, and does not claim to. There is no sandbox, no SBOM, no attestation, and no ring-based rollout, because that is not what it is for. If your question is "where do my machines get packages from", rewinged answers it. If your question is "what proof do I have that this version was safe to admit, and can I show an auditor", that is a different tool.
Only what we could verify.
A detail worth stating precisely, because it is easy to misrepresent in our favour. When rewinged internalises an installer it stores the file under the manifest’s existing hash and rewrites only the URL — it does not compute or compare a digest of what it downloaded. End-to-end integrity is not broken by this: the winget client still verifies the served bytes against the original manifest hash at install time. The accurate criticism is narrower — rewinged does not validate what it caches, so a corrupted or substituted download sits in the cache until a client rejects it, with no server-side signal.
Capabilities are taken from each vendor’s own documentation, and we say “not documented” rather than “not supported” where a vendor is simply silent. If something here is wrong or has changed, tell us and we will correct it — that is a cheaper outcome for everyone than an inaccurate comparison.
Check the claim yourself.
The detonation, the SBOM and the signed attestation all run in the free Community Edition, on your own hardware, for up to 50 endpoints.