Chocolatey and Scoop
Some of your fleet’s apps come from Chocolatey or Scoop, and you need to know exactly what Attestree does with them today, and what it does not do yet.
winget packages are detonated and attested before they reach your endpoints. Chocolatey and Scoop packages are not, yet, so Attestree does not deploy them. This page says what Attestree does with them today, and what is in progress.
Today
Inventory. The agent reports the Chocolatey and Scoop packages installed on each endpoint, beside winget’s and the plain uninstall entries. The fleet CVE index matches those rows by package id, using the rules built for winget ids, so its match quality for them is unproven. A version’s page carries a CVE line for winget packages only.
No deployment, on any edition. Attestree serves a Chocolatey or Scoop version only once it is attested, and no Chocolatey or Scoop package of yours is attested yet. So neither Community Edition nor a dedicated instance serves any Chocolatey or Scoop version, whatever ring it is promoted to.
Apps already installed stay. An app Attestree installed with Chocolatey or Scoop before this change stays installed. It is held as “not attested”, and the console says so. De-promoting or unsubscribing it no longer removes it, so removing one, for example because it turns out to be bad, is a manual job on the endpoint for now.
Proven on winget only. Testing, attestation, the unattended update pipeline, automatic rollback, per-user installs, the app-in-use deferral and group base installs are proven on winget only. Code for Chocolatey and Scoop is in place for several of them, but none of it has run on a package of yours yet.
In progress — not available yet
This work is under way. None of it ships today, and until it does, everything under Today holds. When it lands:
- Chocolatey and Scoop packages are tested in the same sandbox as winget packages, and each version gets a signed statement and an SBOM.
- Endpoints install them from your own server, not straight from the public repositories.
- Their versions move through the rings the way winget versions do.
- A group can name Chocolatey or Scoop apps beside winget ones.
- Attestree installs Chocolatey or Scoop on the endpoints that need it.
- An app is removed only when an endpoint leaves the group that named it.
This page changes when each of these ships.