Ship at SaaS speed,
with an SBOM at ingest.
You ship daily, and your Windows dev fleet and CI runners install tooling from winget and Chocolatey all day. EU CRA and EO 14028 now expect an SBOM for what you run — without a security team slowing engineering down. With a detonation host attached, Attestree detonates each winget installer your machines need, builds its SBOM and records an attestation, so the evidence is a side effect of installing software, not a release-day scramble. Chocolatey is inventoried today; its detonation, and npm and pip provenance, are on the roadmap.
- ingest winget:[email protected] sbom · detonated sig:9c2a…
- ingest winget:[email protected] detonated · clean sig:1f7b…
- halt winget:Vendor.Tool · signer changed held HALT
- sbom cyclonedx · syft recorded sig:a4d0…
- cve KEV match · 3 endpoints flagged sig:77e1…
- export audit-bundle.tar.zst signed sig:0be4…
On our horizon. Attestree is pre-GA and onboarding design partners. winget ingest — detonation, SBOM and attestation — ships today; the npm and pip ingest an engineering org needs does not yet, so this page describes where we're heading. If that's you, come build it with us .
What engineering-led security teams ask us first.
SBOM by construction
A CycloneDX SBOM and a signed attestation for each detonated winget package at ingest, not a scanner bolted on before release. Download them from the version’s page, or export many versions at once in a signed evidence bundle. Chocolatey, npm and pip follow.
Hosted for you, in your own subscription
A dedicated Attestree instance in your own Azure subscription, deployed and upgraded by us — no box for your platform team to operate, and your evidence never leaves your tenancy. Same attestations and evidence as self-hosted, which stays available.
Evidence for SBOM requests
The SBOM is a third-party SBOM, Syft's scan of what each installer put on disk, and it supports EO 14028 SBOM requests about the tools you run. The signed statement of each installer verified since platform 0.240.0 verifies offline with one command or 35 lines of Python, in your fleet or your auditor's.
The platform, sized for an engineering org.
Start with attested ingest for the package managers your engineers actually use, then add inventory and policy as your supply-chain story matures.
Attestree for winget
Attested install gate for winget; Chocolatey inventoried, not deployed until it can be attested.
Read productInventory
One inventory across your package managers — winget, Chocolatey and Scoop, plus plain uninstall entries.
Read productTransforms
MSI/MST transforms generated from declarative policy.
Read productCommercial — request access.
Pre-GA pricing is design-partner friendly. Tell us about your stack — we'll come back within two business days.
"Design partner pipeline open. Be first to be quoted."