Attestree vs winget.pro
winget.pro is a commercial private winget repository from Omaha Consulting GmbH in Vienna, offered as hosted SaaS with a self-hostable AGPL-3.0 edition. Its documented flow is create a repository, connect it with winget source add, and upload applications for distribution. Published pricing runs from EUR 49 per month for up to 100 devices to EUR 299 per month for up to 10,000; self-hosting the Enterprise edition is listed at EUR 0.10 per device per month against a EUR 299 monthly minimum on a one-year term, with an optional proof-of-concept engagement at EUR 3,000 credited against later invoices.
Verified against vendor documentation, September 2026
When winget.pro is the better answer.
If what you need is a private winget source and nothing more, winget.pro does that directly and is cheaper to reason about than a governance platform. The paid tiers add genuinely useful repository features — Entra ID integration, Azure Blob installer hosting, mirroring another repository, package dependencies — and if hosting is the whole problem, that is a reasonable place to stop.
Where the two part company.
The difference is not how the manifests get served — we both implement the same winget REST protocol. It is what has to be true before a version exists to serve. winget.pro distributes what you upload; the decision that a version is safe to admit stays with whoever uploads it. Attestree runs each installer in a real sandbox, records what it did, generates a CycloneDX SBOM, and signs a verdict — and refuses to serve what it could not verify.
Only what we could verify.
winget.pro publishes no documentation site, so our reading of what it does not do rests on its marketing pages and its open-source repository. Treat those as "not documented by the vendor" rather than as proof of absence. That repository last saw a push in March 2025; the hosted service may well be actively developed, and we are not going to characterise it from the outside.
Capabilities are taken from each vendor’s own documentation, and we say “not documented” rather than “not supported” where a vendor is simply silent. If something here is wrong or has changed, tell us and we will correct it — that is a cheaper outcome for everyone than an inaccurate comparison.
Check the claim yourself.
The detonation, the SBOM and the signed attestation all run in the free Community Edition, on your own hardware, for up to 50 endpoints.