Where winget actually breaks.
One page per failure mode Windows operators actually hit: what the symptom looks like, what is genuinely causing it, and what Attestree does about it. Each page ends by saying where our answer stops — including the two where it is honestly “not much”. The reference pages below them hold the detail behind each promise on the trust page, with the same honest ending.
When winget breaks on a real fleet
Per-user apps install as SYSTEM and vanish
The install reports success. The user does not have the application. Nothing in your reporting says anything is wrong.
ReadInstaller hash mismatch on Chrome and friends
winget aborts with a hash mismatch on a package that installed fine last week.
Readwinget upgrade shows an Unknown version
winget list reports the installed version as Unknown, and upgrade logic either does nothing useful or tries to reinstall the application every run.
ReadVendor CDN blocked by the firewall
The manifest resolves, then the install dies downloading the installer — because egress rules do not allow the vendor download host.
Readwinget install fails behind a proxy
Everything works on an unrestricted network and fails the moment traffic has to go through the corporate proxy.
ReadAn Intune detection rule for a winget app
Intune needs to be told whether an app is installed, and the detection rule is a registry guess that goes stale every release.
ReadRollout operations on real endpoints
An upgrade is blocked by a running app, a browser updates itself out from under the catalog, winget is broken on a machine, or you need the platform to stop at two in the morning.
ReadThe detail behind the trust page
What Attestree signs for each installer, and how to check it
You need to show what was tested before it reached your fleet, and to check that evidence yourself without taking our console’s word for it.
ReadThe signed audit trail: exports, retention and erasure
An auditor wants evidence, your data-protection officer wants a retention answer, and someone has asked to be erased from a log that is meant to be append-only.
ReadWhere Attestree enforces: at ingest, at check-in and on the endpoint
You want to know which installs Attestree actually stops, which it only reports, and what still depends on Intune, your identity provider or your SIEM.
ReadThe fleet CVE index, and versions withdrawn upstream
A named CVE breaks or an insurer asks about a KEV entry, and you need to know which endpoints run the affected version; or a publisher has pulled a version you already approved.
ReadAdopting a fleet that already has software
Your endpoints already run hundreds of apps nobody deployed through Attestree, and day one cannot be an uninstall-and-reinstall.
ReadChocolatey and Scoop
Some of your fleet’s apps come from Chocolatey or Scoop, and you need to know exactly what Attestree does with them today, and what it does not do yet.
Read