Winget governance, compared honestly.
Intune, Chocolatey, JFrog and a DIY Syft + Cosign stack all touch part of the problem. The question that sorts them isn't who ships winget packages — it's who proves an artifact before it installs: who gates it at ingest, who detonates it in a real sandbox, and who records the result.
Verified vs vendor docs, June 2026 · Attestree marks = free Community Edition today (early access)
Endpoint managers ship packages. We attest them first.
-
Block an artifact before it enters (ingest gate)
Attestree: native — read its limits Intune: not addressed Chocolatey: partial JFrog: native Syft + Cosign: partial -
Real sandbox detonation — installs the package in a VM (Hyper-V or Proxmox host)
Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed -
CycloneDX SBOM generated per detonated package
Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: native Syft + Cosign: native -
Signed in-toto attestation per verified installer, verifiable on its own
Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: native Syft + Cosign: native -
Deploys winget from your own attested source
Attestree: native Intune: not addressed Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed -
Deploys MSI / driver / Windows Update installs
Attestree: not addressed Intune: native Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed -
Also manages macOS / Linux endpoints
Attestree: not addressed Intune: native Chocolatey: not addressed JFrog: not addressed Syft + Cosign: not addressed -
Ring rollout + one-step rollback to the previous version
Attestree: partial Intune: partial Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed -
Fenced endpoint installs only the pinned SHA-256, from HMAC-checked desired state
Attestree: native Intune: partial Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed -
Continuous reconciliation + drift detection
Attestree: native Intune: native Chocolatey: partial JFrog: not addressed Syft + Cosign: not addressed -
Signed, exportable auditor evidence bundle
Attestree: partial Intune: partial Chocolatey: partial JFrog: native Syft + Cosign: partial -
Self-host + a genuine free tier
Attestree: native Intune: not addressed Chocolatey: native JFrog: partial Syft + Cosign: native
| Capability | Attestree attest + detonate | Intune endpoint mgmt | Chocolatey Windows packages | JFrog artifact supply-chain | Syft + Cosign DIY / OSS |
|---|---|---|---|---|---|
| Block an artifact before it enters (ingest gate) | note | — | partial | partial | |
| Real sandbox detonation — installs the package in a VM (Hyper-V or Proxmox host) | — | — | — | — | |
| CycloneDX SBOM generated per detonated package | — | — | |||
| Signed in-toto attestation per verified installer, verifiable on its own | — | — | |||
| Deploys winget from your own attested source | — | — | — | — | |
| Deploys MSI / driver / Windows Update installs | — | partial | — | — | |
| Also manages macOS / Linux endpoints | — | — | — | — | |
| Ring rollout + one-step rollback to the previous version | partial | partial | partial | — | — |
| Fenced endpoint installs only the pinned SHA-256, from HMAC-checked desired state | partial | partial | — | — | |
| Continuous reconciliation + drift detection | partial | — | — | ||
| Signed, exportable auditor evidence bundle | partial | partial | partial | partial | |
| Self-host + a genuine free tier | — | partial |
Read it honestly. JFrog gates and signs attestations — but for artifact repos, not Windows endpoints. Intune deploys MSI, drivers and Windows Updates (and manages macOS / Linux) but attests nothing and has no native winget. Chocolatey is a capable package operator with no attestation; Syft is the OSS SBOM generator Attestree runs inside the sandbox, and Cosign is what we sign our own release images with, not part of the product. Only Attestree fences the fleet to its own attested winget source — a feed that can serve the attested installer bytes itself. Real sandbox detonation is the row no one else fills. The rollback row is partial on purpose: rollback moves a ring back one version, not to any version you ever admitted. The signed-attestation row covers each installer verified since platform 0.240.0; one verified earlier gets its statement when it is re-tested. Drivers and Windows Update stay with your device manager.
On the auditor-evidence row, Intune and Chocolatey export audit reports but don't cryptographically sign them; JFrog's Evidence is signed. Attestree's export ships today — it pages the audit store, re-verifies every span, and seals a SHA-256 manifest. It is marked partial only because these marks reflect the free Community Edition, which signs with a local file-backed key: the bundle is real and verifies offline, and the manifest discloses that the key was local rather than vault-held. Custody, not the export, is what the commercial tiers add.
On the ingest-gate row: the gate fails closed. Without a detonation host nothing is verified, so by default no winget version is served. Its limits: on Community Edition an operator can accept an unverified installer, for one package and architecture or deployment-wide, off by default, and every endpoint that has it labels it unverified, accepted (a dedicated instance has no such acceptance). Arm installers cannot be verified yet, so none is attested. And the gate covers winget packages: no Chocolatey or Scoop package is tested yet, so none is served. Details in enforcement and policy.
Where each one stops, and where Attestree starts.
Attestree vs Intune
Intune is endpoint management: it deploys MSI, drivers and Windows Updates, and it manages macOS and Linux too. What it does not do is attest. Its winget support installs from the Microsoft Store source only — there's no native management of the public winget repository or a private winget feed — and it generates no SBOM and no signed attestation for what it ships. Attestree is not an Intune replacement; it sits beside it and takes over third-party app patching for apps winget or Chocolatey carry. A winget package is gated and detonated at ingest, with an attestation recorded (once a detonation host is attached), and Attestree's own agent installs the attested version — nothing is handed to Intune. Intune keeps Windows Update, drivers, device settings, compliance and enrollment.
Attestree vs Chocolatey
Chocolatey is a capable Windows package operator — install, upgrade, internal repositories, ring-ish rollout. But it produces no CycloneDX SBOM and no signed in-toto / SLSA attestation, and community packages are essentially never author-signed, so "is this the publisher I think it is" is usually unanswerable. Attestree adds exactly that missing layer for winget: an ingest gate, a real detonation, and an attestation per package. Attestree also inventories Chocolatey, but does not deploy its packages until it can test and attest them; detonation-backed attestation for Chocolatey is planned.
Attestree vs JFrog
JFrog gates artifacts and signs attestations — its Evidence and Xray are real supply-chain controls. But they operate on artifact repositories, not Windows endpoints. JFrog does not detonate a package in a real sandbox, deploy winget from an attested source to your fleet, or have fenced endpoints install only the pinned SHA-256 from HMAC-checked desired state. For an org that already runs Artifactory, Attestree governs the part JFrog doesn't: the winget-to-endpoint path.
Attestree vs Syft + Cosign (DIY)
Syft is the open-source SBOM generator Attestree runs inside the sandbox; Cosign is what we sign our own release images with, not part of the product. You can absolutely self-assemble SBOM-plus-signature. But that's the easy half. The ingest gate, the real sandbox detonation, ring rollout and rollback, endpoint enforcement, and a signed, exportable audit bundle are what you'd be building and operating yourself, indefinitely. Attestree is that whole pipeline, assembled — with a genuine free, self-hostable tier.
What about a private feed — ProGet, Azure Artifacts, a self-hosted source?
A private feed controls where packages come from. It does not answer whether a given version is safe to admit — nothing in hosting a feed inspects the artifact's behavior. Attestree does not sit in front of another feed: it replaces it. It is the gate and the source — it decides what is allowed in, serves it to your endpoints itself (the manifests always, and the installer bytes too for a version detonated with the byte store on), and keeps a record of why.
Straight answers.
Does Intune manage winget packages?
Intune's winget support installs apps from the Microsoft Store source only. It has no native management of the public winget repository or a private winget feed, and it doesn't generate an SBOM or a signed attestation for what it deploys. Attestree fences your fleet to its own attested winget source, detonates and attests each winget installer your endpoints need (once a detonation host is attached), and its own agent installs the installer your feed pinned. It sits beside Intune rather than replacing it: Intune keeps Windows Update, drivers, device settings, compliance and enrollment.
Can Chocolatey generate an SBOM or attest packages?
No. Chocolatey is a capable Windows package operator — install, upgrade, internal repositories — but it produces no CycloneDX SBOM and no signed in-toto / SLSA attestation, and community packages are essentially never author-signed. Attestree adds that attestation and detonation layer for winget packages today. It also inventories Chocolatey, but does not deploy its packages until it can test and attest them, which is planned.
How is Attestree different from JFrog?
JFrog gates artifacts and signs attestations (Evidence), but for artifact repositories — not Windows endpoints. It does not detonate packages in a real sandbox, deploy winget to your fleet from an attested source, or have endpoints install only the SHA-256 you approved. Attestree governs the winget-to-endpoint path specifically, and is complementary to an existing JFrog setup.
Why not just use Syft and Cosign myself?
You can. Syft is the SBOM generator Attestree runs inside the sandbox; Cosign is not part of the product. But SBOM plus signature is the easy half. The ingest gate, the real sandbox detonation, ring rollout and rollback, endpoint enforcement, and a signed audit bundle are what you would be building and operating yourself. Attestree is that, assembled, with a real free self-hostable tier.
What does Attestree do that none of these tools do?
Real sandbox detonation before install — it actually installs the package in a VM and records what it does, rather than inferring safety from a manifest — and it fences your fleet to its own attested winget source. That detonation row is the one no other tool here fills. It ships in the free Community Edition today (early access), once you attach a Hyper-V or Proxmox host.
Is this comparison up to date?
Competitor marks were verified against vendor documentation in June 2026; Attestree marks reflect what ships in the free Community Edition today, not roadmap. A capability that is committed but not yet shipped would be labeled "roadmap" in the table; since the per-version signed attestation shipped in platform 0.240.0, no Attestree row is.
See the row no one else fills.
Real sandbox detonation before install, in the free Community Edition. Run it on your own hardware today.