Community Edition · early access

winget install,
but with a receipt.

Attestree sits between your endpoints and the public winget source. Every package isdetonated in a real sandbox, signed with SLSA provenance, and served from your own fenced feed. Your team installs as usual — you know exactly what landed. winget end-to-end today, Chocolatey managed alongside it; MSI, drivers and Windows Update landing.

Run it free Read the wedge

Free Community Edition (early access) — self-host up to 50 endpoints, no Azure.

ATTESTATION TREE · livedepth 3 · 7 nodes

ATTESTED SOURCES

wingetnpmpipchocoscoopdotnet-toolps-gallerymsimsixwindows-update

THE WEDGE

Most tools scan after install. Attestree attests before it.

Scanning is a confession. By the time a CVE shows up in your dashboard, the artifact is already running on your fleet. We move provenance to ingest.

Provenance at ingestOne tree, every artifactShip signed evidence

HOW IT WORKS

From winget install to a signed deploy.

One closed loop. Your team installs as usual; you approve once; the fleet converges to your own attested feed and stays converged.

Request

A user runs winget install. The agent intercepts and opens an attestation request instead of pulling from the public source. A request for a package you haven't admitted doesn't break the client — the fenced feed declines cleanly and records the demand, so your review queue is real user pull.

Ingest & detonate

The package is installed for real in a sandbox VM — Hyper-V or Proxmox/KVM — so its true file and registry footprint is captured, not inferred from a manifest.

Attest

A signed in-toto statement is generated: SLSA provenance, a CycloneDX SBOM (via Syft), and an ECDSA P-256 signature against your root of trust.

Review & promote

Every package carries a safe-to-deploy verdict — what its provenance claims next to what it actually did in the sandbox. You review the evidence and bulk-promote approved artifacts into rings — canary → pilot → broad — in a few clicks.

Converge

Endpoints converge to the union of their groups' packages; the ring sets the exact version. The agent installs only from your fenced source, pinned to the SHA-256 you admitted — and the feed serves the attested installer bytes itself, so what installs is byte-for-byte what was detonated, even if the vendor's CDN has drifted since. Per-user apps (Chrome- or Zoom-class) install impersonated in the actual user's profile — never into SYSTEM — and hold an honest pending logon state until that user next signs in.

Reconcile

The control plane reconciles desired state continuously and surfaces drift — attributed per machine and per user — and you can roll back to any prior version when you need to.

winget install interceptionreal detonationsafe-to-deploy verdictbulk-promote to ringsfeed-hosted attested bytesper-user installs

THE MODEL

Groups decide what.
Rings decide which version.

PC Groups carry version-free base sets — "Designers get Figma, VS Code, PowerToys." No versions, ever.

An endpoint converges to the union of every group it belongs to. Add a group, the packages follow.

The ring resolves each package to the exact attested version at deploy time — canary gets the new build, broad holds the proven one. Same group, two versions, zero duplicate config.

resolve · LAPTOP-07ring: broad

# groups
Designers ∪ All-Staff
# union of base sets (version-free)
Figma · VS Code · PowerToys · 7-Zip · Slack
# ring "broad" resolves versions — served from your fenced feed →
VS Code     1.89.2   ✓ attested
PowerToys   0.81.1   ✓ attested
Figma       124.6.3  ✓ attested

OPERATOR WORKFLOW

Approve a hundred packages in a few clicks.

Filter the queue, select the artifacts that passed policy, and bulk-promote them to a ring in one action. Every promotion is a signed event in the evidence store — and those events export as a portable, auditor-ready bundleon any deployment with a production signing key.

Bulk promote to a ringRollback to any prior versionEvery promotion signed

ingest queue · 3 selectedpromote → broad

[✓] Microsoft.PowerToys 0.81.1   SLSA 2 · 0 CVE
[✓] 7zip.7zip 24.07              SLSA 2 · 0 CVE
[✓] Git.Git 2.45.2               SLSA 2 · 0 CVE
[ ] OpenJS.NodeJS 22.3.0          license: review

How we compare

Endpoint managers ship packages. We attest them first.

Capability	Attestreeattest + detonate	Intuneendpoint mgmt	ChocolateyWindows packages	JFrogartifact supply-chain	Syft + CosignDIY / OSS
Block an artifact before it enters (ingest gate)		—	partial		partial
Real sandbox detonation — installs the package in a VM		—	—	—	—
CycloneDX SBOM generated per artifact		—	—
Signed in-toto / SLSA attestation		—	—
Deploys winget from your own attested source		—	—	—	—
Deploys MSI / driver / Windows Update installs	roadmap		partial	—	—
Also manages macOS / Linux endpoints	—		—	—	—
Ring rollout + rollback to any prior version		partial	partial	—	—
Endpoint re-verifies signature / hash / policy at install		partial	partial	—	—
Continuous reconciliation + drift detection			partial	—	—
Signed, exportable auditor evidence bundle	partial	partial	partial		partial
Self-host + a genuine free tier		—		partial

Read it honestly. JFrog gates and signs attestations — but for artifact repos, not Windows endpoints. Intune deploys MSI, drivers and Windows Updates (and manages macOS / Linux) but attests nothing and has no native winget. Chocolatey is a capable package operator with no attestation; Syft and Cosign are the OSS building blocks Attestree uses under the hood. Only Attestree fences the fleet to its own attested winget source — a feed that can serve the attested installer bytes itself — and manages Chocolatey under the same control plane. Real sandbox detonation is the row no one else fills.

nativepartial with caveatsroadmap on /products— not addressed· verified vs vendor docs, Jun 2026 · Attestree marks reflect the free Community Edition today (early access)

On the auditor-evidence row, Intune and Chocolatey export audit reports but don't cryptographically sign them; JFrog's Evidence is signed. Attestree's export ships today — it pages the audit store, re-verifies every span, and seals a SHA-256 manifest with the same production key. It is marked partial only because these marks reflect the free Community Edition, which signs with a local dev-grade key: the builder refuses to emit a bundle from dev-signed spans rather than hand you one that would not survive a regulator's check. Give it a production signing key and the export is whole.

See the full winget-governance breakdown, head to head

SAMPLE ATTESTATION

An in-toto statement, signed at the moment of detonation.

SLSA v1 provenance, CycloneDX SBOM digest, ECDSA P-256 signature. Verifiable with one CLI call or a 30-line Python snippet.

Microsoft.PowerToys-0.81.1.attest.json

verified · att-root-2026-04


        1
        {
      

        2
          "_type": "https://in-toto.io/Statement/v1",
      

        3
          "subject": [{
      

        4
            "name": "winget://Microsoft.PowerToys",
      

        5
            "digest": { "sha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0" }
      

        6
          }],
      

        7
          "predicateType": "https://slsa.dev/provenance/v1",
      

        8
          "predicate": {
      

        9
            "buildDefinition": {
      

        10
              "buildType": "https://attestree.com/builds/winget-detonate@v1",
      

        11
              "externalParameters": {
      

        12
                "source": "winget-pkgs/manifests/m/Microsoft/PowerToys/0.81.1",
      

        13
                "channel": "stable"
      

        14
              }
      

        15
            },
      

        16
            "runDetails": {
      

        17
              "builder": { "id": "https://attestree.com/runners/win-2025-amd64/r-7c33" },
      

        18
              "metadata": {
      

        19
                "invocationId": "att_01JK4M9F2X5W8H6P0Q1R2S3T4U",
      

        20
                "startedOn":   "2026-04-29T14:02:11Z",
      

        21
                "finishedOn":  "2026-04-29T14:04:03Z"
      

        22
              }
      

        23
            },
      

        24
            "sbom": {
      

        25
              "format": "CycloneDX-1.6",
      

        26
              "componentCount": 412,
      

        27
              "digest": "sha256:e45a91d2c0b3a4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f70819203"
      

        28
            },
      

        29
            "signature": {
      

        30
              "alg": "ecdsa-p256",
      

        31
              "keyId":  "att-root-2026-04",
      

        32
              "value":  "MEUCIQDx9k...cWZ0nQv5wA=="
      

        33
            }
      

        34
          }
      

        35
        }

FOR YOUR FLEET

Same tree.
Start where you are.

Whether you run two laptops or two thousand, the attestation primitive is identical. Policy, deployment, and evidence shape themselves to your environment.

01Engineering-led security

SaaS engineering

You ship daily and pull npm, pip, and winget all day. EU CRA and EO 14028 now want an SBOM for every artifact.

See solution

02Hobbyists & enthusiasts

Homelab

You install whatever winget hands you. One typosquat ends the lab.

See solution

0350–2,000 endpoints

Mid-market

Intune ships packages; nobody verifies what they contain.

See solution

045–50 endpoints

Small business

Patching is ad-hoc. You have no SBOM, no inventory, no story for auditors.

See solution

WHERE WE'RE HEADED

2,000+ endpointsHorizon

Enterprise

You scan after install. Mean-time-to-remediate is measured in weeks.

Where we're headed

Regulated environmentsHorizon

Financial services

NYDFS, GLBA, SOX: prove every install was approved before it ran.

Where we're headed

Pre-GA and onboarding design partners. These describe where Attestree is heading for fleets at this scale — not a shipping product today.

Be a design partner.

We're opening a small number of design-partner slots to harden the policy DSL and the evidence pipeline. If your fleet feels brittle, talk to us.

Real detonation — Hyper-V + ProxmoxApache-2.0 shim, open sourceOpen formats: in-toto · SLSA · CycloneDXSwiss-registered word markDirect founder access

Built in the open — Apache-2.0 installer shim on GitHub. We're onboarding our first design partners now; you'd be early by design.

winget install,but with a receipt.

Most tools scan after install. Attestree attests before it.

From winget install to a signed deploy.

Request

Ingest & detonate

Attest

Review & promote

Converge

Reconcile

Groups decide what.Rings decide which version.

Approve a hundred packages in a few clicks.

Endpoint managers ship packages. We attest them first.

An in-toto statement, signed at the moment of detonation.

Same tree.Start where you are.

SaaS engineering

Homelab

Mid-market

Small business

Enterprise

Financial services

Be a design partner.

winget install,
but with a receipt.

Groups decide what.
Rings decide which version.

Same tree.
Start where you are.