Attestree vs winget-cli-restsource
winget-cli-restsource is Microsoft's own MIT-licensed reference implementation of a REST-based package source for the winget client. It self-describes as aiming to provide a reference implementation, and deploys as Azure Functions backed by Cosmos DB, managed through a PowerShell module.
Verified against vendor documentation, September 2026
When winget-cli-restsource is the better answer.
As a reference implementation it is exactly what it says: the canonical demonstration of how the protocol works, from the people who defined it. If you are building your own source and want to see the contract implemented correctly, this is the place to look. We built against the same protocol.
Where the two part company.
It is a reference implementation rather than a governed product, and the gap between those is the whole point. There is no ingest gate, no sandbox, no SBOM, no attestation, no ring policy — a manifest you put in is a manifest it serves. There is also a practical operational consideration: its last functional release was in July 2025 and targets the 1.10 manifest schema, while the winget client has since moved to 1.12. The repository is not archived and carries no deprecation notice, so we state the release dates rather than drawing a conclusion from them.
Only what we could verify.
Capabilities are taken from each vendor’s own documentation, and we say “not documented” rather than “not supported” where a vendor is simply silent. If something here is wrong or has changed, tell us and we will correct it — that is a cheaper outcome for everyone than an inaccurate comparison.
Check the claim yourself.
The detonation, the SBOM and the signed attestation all run in the free Community Edition, on your own hardware, for up to 50 endpoints.