Winget Enterprise.
SBOM at ingest, not post-install scan.
Currently in development — early-access slots available.
What's broken without it.
Most Windows shops install winget packages straight from the public source and discover problems only after a scanner runs against an endpoint two days later. By then the artifact is on a thousand machines, and your IR rotation owns the cleanup. SBOMs are an afterthought, attestations are missing, and the supply-chain story is "we trust Microsoft’s CDN."
The approach.
Attestree gates winget at the moment of ingest. With a Hyper-V or Proxmox detonation host attached, every package fetched from the public source is detonated in a sandboxed VM — installed for real so its actual filesystem and registry footprint is captured, not inferred from a manifest. Syft builds an SBOM over the installed files, and an attestation is recorded against the installer’s SHA-256 before you promote the version to a ring. Without a detonation host, a version you promote is served unverified and marked dev-grade. Endpoints are fenced to your own feed — winget installs only the exact SHA-256 you admitted and rejects anything that does not match, so what runs is what you detonated. And when someone asks the fenced source for a package you have not admitted, the feed declines cleanly — no broken winget client — and records the demand, so what to admit next is measured user pull, not guesswork.
Roadmap, in three moves.
Per-package signed attestation
A signed in-toto statement for each version, kept with it, that you can download and verify with one command.
Chocolatey attestation
Detonation-backed attestation for Chocolatey packages, which are managed today but not attested.
Per-ring CVE budgets
Different policy bundles for canary, pilot, and broad rings — applied automatically.
Ready for winget enterprise on your fleet?
Early-access slots are open through GA. Tell us about your fleet.