Community Edition · early access

winget install,
but with a receipt.

Every winget package is detonated in a real sandbox, signed with SLSA provenance, and served from your own fenced feed. Your team installs as usual. You know exactly what landed.

Get early access Read the wedge

Free Community Edition — self-host up to 50 endpoints, no Azure.

ATTESTATION TREE · live depth 3 · 7 nodes

ATTESTED SOURCES

winget npm pip choco scoop dotnet-tool ps-gallery msi msix windows-update

THE WEDGE

Most tools scan after install. Attestree attests before it.

Scanning is a confession. By the time a CVE shows up in your dashboard, the artifact is already running on your fleet. We move provenance to ingest.

Provenance at ingest One tree, every artifact Ship signed evidence

HOW IT WORKS

From winget install to a signed deploy.

One closed loop. Your team installs as usual; you approve once; the fleet converges to your own attested feed and stays converged.

01

Request

A user runs winget install. The agent intercepts it and opens an attestation request instead of pulling from the public source. Unadmitted packages are declined cleanly, and the demand is recorded.

02

Ingest & detonate

The package is installed for real in a sandbox VM — Hyper-V or Proxmox/KVM — so its true file and registry footprint is captured, not inferred from a manifest.

03

Attest

A signed in-toto statement is generated: SLSA provenance, a CycloneDX SBOM (via Syft), and an ECDSA P-256 signature against your root of trust.

04

Review & promote

Every package carries a safe-to-deploy verdict — what its provenance claims next to what it actually did in the sandbox. You review the evidence and bulk-promote approved artifacts into rings — canary → pilot → broad — in a few clicks.

05

Converge

Endpoints converge to the union of their groups' packages; the ring sets the version. The agent installs only from your fenced source, which serves the attested bytes itself, so what installs is byte-for-byte what was detonated.

06

Reconcile

The control plane reconciles desired state continuously and surfaces drift — attributed per machine and per user — and you can roll back to any prior version when you need to.

winget install interception real detonation safe-to-deploy verdict bulk-promote to rings feed-hosted attested bytes per-user installs

THE MODEL

Groups decide what.
Rings decide which version.

PC Groups carry version-free base sets — "Designers get Figma, VS Code, PowerToys." No versions, ever.

An endpoint converges to the union of every group it belongs to. Add a group, the packages follow.

The ring resolves each package to the exact attested version at deploy time — canary gets the new build, broad holds the proven one. Same group, two versions, zero duplicate config.

resolve · LAPTOP-07 ring: broad

# groups
Designers ∪ All-Staff
# union of base sets (version-free)
Figma · VS Code · PowerToys · 7-Zip · Slack
# ring "broad" resolves versions — served from your fenced feed →
VS Code     1.89.2   ✓ attested
PowerToys   0.81.1   ✓ attested
Figma       124.6.3  ✓ attested

OPERATOR WORKFLOW

Approve a hundred packages in a few clicks.

Filter the queue, select the artifacts that passed policy, and bulk-promote them to a ring in one action. Every promotion is a signed event in the evidence store — and those events export as a portable, verifiable bundle on every edition, the free one included.

Bulk promote to a ring Rollback to any prior version Every promotion signed

ingest queue · 3 selected promote → broad

[✓] Microsoft.PowerToys 0.81.1   SLSA 2 · 0 CVE
[✓] 7zip.7zip 24.07              SLSA 2 · 0 CVE
[✓] Git.Git 2.45.2               SLSA 2 · 0 CVE
[ ] OpenJS.NodeJS 22.3.0          license: review

How we compare

Endpoint managers ship packages. We attest them first.

Capability	Attestree attest + detonate	Intune endpoint mgmt	Chocolatey Windows packages	JFrog artifact supply-chain	Syft + Cosign DIY / OSS
Block an artifact before it enters (ingest gate)		—	partial		partial
Real sandbox detonation — installs the package in a VM		—	—	—	—
CycloneDX SBOM generated per artifact		—	—
Signed in-toto / SLSA attestation		—	—
Deploys winget from your own attested source		—	—	—	—
Deploys MSI / driver / Windows Update installs	roadmap		partial	—	—
Also manages macOS / Linux endpoints	—		—	—	—
Ring rollout + rollback to any prior version		partial	partial	—	—
Endpoint re-verifies signature / hash / policy at install		partial	partial	—	—
Continuous reconciliation + drift detection			partial	—	—
Signed, exportable auditor evidence bundle	partial	partial	partial		partial
Self-host + a genuine free tier		—		partial

native partial with caveats roadmap on /products — not addressed · verified vs vendor docs, Jun 2026 · Attestree marks reflect the free Community Edition today (early access)

See the full winget-governance breakdown, head to head

SAMPLE ATTESTATION

An in-toto statement, signed at the moment of detonation.

SLSA v1 provenance, CycloneDX SBOM digest, ECDSA P-256 signature. Verifiable with one CLI call or a 30-line Python snippet.

Microsoft.PowerToys-0.81.1.attest.json

verified · att-root-2026-04


        1
        {
      

        2
          "_type": "https://in-toto.io/Statement/v1",
      

        3
          "subject": [{
      

        4
            "name": "winget://Microsoft.PowerToys",
      

        5
            "digest": { "sha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0" }
      

        6
          }],
      

        7
          "predicateType": "https://slsa.dev/provenance/v1",
      

        8
          "predicate": {
      

        9
            "buildDefinition": {
      

        10
              "buildType": "https://attestree.com/builds/winget-detonate@v1",
      

        11
              "externalParameters": {
      

        12
                "source": "winget-pkgs/manifests/m/Microsoft/PowerToys/0.81.1",
      

        13
                "channel": "stable"
      

        14
              }
      

        15
            },
      

        16
            "runDetails": {
      

        17
              "builder": { "id": "https://attestree.com/runners/win-2025-amd64/r-7c33" },
      

        18
              "metadata": {
      

        19
                "invocationId": "att_01JK4M9F2X5W8H6P0Q1R2S3T4U",
      

        20
                "startedOn":   "2026-04-29T14:02:11Z",
      

        21
                "finishedOn":  "2026-04-29T14:04:03Z"
      

        22
              }
      

        23
            },
      

        24
            "sbom": {
      

        25
              "format": "CycloneDX-1.6",
      

        26
              "componentCount": 412,
      

        27
              "digest": "sha256:e45a91d2c0b3a4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f70819203"
      

        28
            },
      

        29
            "signature": {
      

        30
              "alg": "ecdsa-p256",
      

        31
              "keyId":  "att-root-2026-04",
      

        32
              "value":  "MEUCIQDx9k...cWZ0nQv5wA=="
      

        33
            }
      

        34
          }
      

        35
        }

FOR YOUR FLEET

Same tree.
Start where you are.

Whether you run two laptops or two thousand, the attestation primitive is identical. Policy, deployment, and evidence shape themselves to your environment.

01 Engineering-led security

SaaS engineering

You ship daily and pull npm, pip, and winget all day. EU CRA and EO 14028 now want an SBOM for every artifact.

See solution

02 Hobbyists & enthusiasts

Homelab

You install whatever winget hands you. One typosquat ends the lab.

See solution

03 50–2,000 endpoints

Mid-market

Intune ships packages; nobody verifies what they contain.

See solution

04 5–50 endpoints

Small business

Patching is ad-hoc. You have no SBOM, no inventory, no story for auditors.

See solution

WHERE WE'RE HEADED

2,000+ endpoints Horizon

Enterprise

You scan after install. Mean-time-to-remediate is measured in weeks.

Where we're headed

Regulated environments Horizon

Financial services

NYDFS, GLBA, SOX: prove every install was approved before it ran.

Where we're headed

Pre-GA and onboarding design partners. These describe where Attestree is heading for fleets at this scale — not a shipping product today.

Be a design partner.

We're opening a small number of design-partner slots to harden the policy DSL and the evidence pipeline. If your fleet feels brittle, talk to us.

Real detonation — Hyper-V + Proxmox Apache-2.0 shim, open source Open formats: in-toto · SLSA · CycloneDX Swiss-registered word mark Direct founder access

Built in the open — Apache-2.0 installer shim on GitHub. We're onboarding our first design partners now; you'd be early by design.

winget install, but with a receipt.

Most tools scan after install. Attestree attests before it.

From winget install to a signed deploy.

Request

Ingest & detonate

Attest

Review & promote

Converge

Reconcile

Groups decide what. Rings decide which version.

Approve a hundred packages in a few clicks.

Endpoint managers ship packages. We attest them first.

An in-toto statement, signed at the moment of detonation.

Same tree.Start where you are.

SaaS engineering

Homelab

Mid-market

Small business

Enterprise

Financial services

Be a design partner.

winget install,
but with a receipt.

Groups decide what.
Rings decide which version.

Same tree.
Start where you are.