Attestree for winget.

The approach.

Attestree gates winget at the moment of ingest. With a Hyper-V or Proxmox detonation host attached, each winget version you ingest is queued for detonation in a sandboxed VM — installed for real so its actual filesystem and registry footprint is captured, not inferred from a manifest. Syft builds an SBOM of what the installer put on disk, and the platform signs an in-toto statement about the installer’s SHA-256, which you can download and verify offline, before you promote the version to a ring. Without a detonation host, nothing is verified, so by default no winget version is served. Endpoints are fenced to your own feed — on a fenced endpoint winget installs only the exact SHA-256 your feed pinned and rejects anything that does not match, so what runs is an installer a sandbox verified, or on Community Edition one you accepted unverified. An endpoint whose fence is not applied installs from the public winget source instead, and the console shows it unfenced. And when someone asks the fenced source for a package you have not admitted, the feed declines cleanly — no broken winget client — and records the demand, so what to admit next is measured user pull, not guesswork.