Winget Enterprise.
SBOM at ingest, not post-install scan.
Currently in development — early-access slots available.
What's broken without it.
Most Windows shops install winget packages straight from the public source and discover problems only after a scanner runs against an endpoint two days later. By then the artifact is on a thousand machines, and your IR rotation owns the cleanup. SBOMs are an afterthought, attestations are missing, and the supply-chain story is "we trust Microsoft’s CDN."
The approach.
Attestree gates winget at the moment of ingest. Every package fetched from the public source is detonated in a sandboxed VM — installed for real so its actual filesystem and registry footprint is captured, not inferred from a manifest — then verified against your policy (provenance, SBOM, SLSA level, license) before it ever reaches a fleet node. Rejected artifacts never make it to canary; admitted artifacts carry signed receipts your auditor can verify with a public key. Endpoints are fenced to your own feed — winget installs only the exact SHA-256 you admitted and rejects anything that does not match, so what runs is what you detonated. And when someone asks the fenced source for a package you have not admitted, the feed declines cleanly — no broken winget client — and records the demand, so what to admit next is measured user pull, not guesswork.
Roadmap, in three moves.
Sigstore-only roots
Drop static-trust-store mode for Sigstore-rooted verification with TUF metadata.
Per-ring CVE budgets
Different policy bundles for canary, pilot, and broad rings — applied automatically.
WDAC policy generation
Emit a Windows Defender Application Control policy from your admit set, signed.
Ready for winget enterprise on your fleet?
Early-access slots are open through GA. Tell us about your fleet.