Community Edition · early access

winget install,
but with a receipt.

Attach a Hyper-V or Proxmox host and every winget package is detonated in a real sandbox, gets an SBOM and an attestation, and is served from your own fenced feed. Your team installs as usual. You know exactly what landed.

Get early access Read the wedge

Free Community Edition — self-host up to 200 endpoints, no Azure.

ATTESTATION TREE · live depth 3 · 7 nodes

ARTIFACT SOURCES

attested

winget

managed

choco

inventory

scoop

roadmap

npm pip dotnet-tool ps-gallery msi msix

THE WEDGE

Most tools scan after install. Attestree attests before it.

Scanning is a confession. By the time a CVE shows up in your dashboard, the artifact is already running on your fleet. We move provenance to ingest.

Provenance at ingest One tree, every artifact Ship signed evidence

HOW IT WORKS

From winget install to a signed deploy.

One closed loop. Your team installs as usual; you approve once; the fleet converges to your own attested feed and stays converged.

01

Request

A user runs winget install. On a fenced endpoint, winget asks your own feed, not the public source. A package you have not admitted is declined cleanly, and the demand is recorded for one-click ingest.

02

Ingest & detonate

With a Hyper-V or Proxmox/KVM host attached, the package is installed for real in a sandbox VM, so its true file and registry footprint is captured, not inferred from a manifest. Without a host, nothing is detonated, and a version you promote is marked dev-grade.

03

Attest

Syft builds a CycloneDX SBOM over the installed files, and an attestation is recorded against the installer’s SHA-256. A signed statement you can download and verify per package is planned.

04

Review & promote

A detonated package carries a safe-to-deploy verdict — its installer’s signer next to what it actually did in the sandbox. You review the evidence and bulk-promote approved artifacts into rings — canary → pilot → broad — in a few clicks.

05

Converge

Endpoints converge to the union of their groups' packages; the ring sets the version. The agent installs only from your fenced source, which serves the attested bytes itself, so what installs is byte-for-byte what was detonated.

06

Reconcile

The control plane reconciles desired state continuously and surfaces drift — attributed per machine and per user — and you can roll a ring back to its previous version when you need to.

blocked-demand capture real detonation safe-to-deploy verdict bulk-promote to rings feed-hosted attested bytes per-user installs

THE MODEL

Groups decide what.
Rings decide which version.

PC Groups carry version-free base sets — "Designers get Figma, VS Code, PowerToys." No versions, ever.

An endpoint converges to the union of every group it belongs to. Add a group, the packages follow.

The ring resolves each package to the exact attested version at deploy time — canary gets the new build, broad holds the proven one. Same group, two versions, zero duplicate config.

resolve · LAPTOP-07 ring: broad

# groups
Designers ∪ All-Staff
# union of base sets (version-free)
Figma · VS Code · PowerToys · 7-Zip · Slack
# ring "broad" resolves versions — served from your fenced feed →
VS Code     1.89.2   ✓ attested
PowerToys   0.81.1   ✓ attested
Figma       124.6.3  ✓ attested

OPERATOR WORKFLOW

Approve a hundred packages in a few clicks.

Filter the queue, select the artifacts whose evidence you have reviewed, and bulk-promote them to a ring in one action. Every promotion is a signed event in the evidence store — and those events export as a portable, verifiable bundle on every edition, the free one included.

Bulk promote to a ring One-step rollback Every promotion signed

ingest queue · 3 selected promote → broad

[✓] Microsoft.PowerToys 0.81.1   detonated · 0 CVE
[✓] 7zip.7zip 24.07              detonated · 0 CVE
[✓] Git.Git 2.45.2               detonated · 0 CVE
[ ] OpenJS.NodeJS 22.3.0          signer changed: review

How we compare

Endpoint managers ship packages. We attest them first.

Capability	Attestree attest + detonate	Intune endpoint mgmt	Chocolatey Windows packages	JFrog artifact supply-chain	Syft + Cosign DIY / OSS
Block an artifact before it enters (ingest gate)	partial	—	partial		partial
Real sandbox detonation — installs the package in a VM (Hyper-V or Proxmox host)		—	—	—	—
CycloneDX SBOM generated per detonated package		—	—
Signed in-toto attestation per package, verifiable on its own	roadmap	—	—
Deploys winget from your own attested source		—	—	—	—
Deploys MSI / driver / Windows Update installs	—		partial	—	—
Also manages macOS / Linux endpoints	—		—	—	—
Ring rollout + one-step rollback to the previous version	partial	partial	partial	—	—
Endpoint installs only the pinned SHA-256, from signed desired state		partial	partial	—	—
Continuous reconciliation + drift detection			partial	—	—
Signed, exportable auditor evidence bundle	partial	partial	partial		partial
Self-host + a genuine free tier		—		partial

native partial with caveats roadmap on /products — not addressed · verified vs vendor docs, Jun 2026 · Attestree marks reflect the free Community Edition today (early access)

See the full winget-governance breakdown, head to head

ILLUSTRATIVE ATTESTATION

What a per-package attestation will look like.

Illustrative, not product output. Today each detonation records an attestation against the installer's SHA-256. A signed statement like this one, downloadable and verifiable with one command, is planned, not shipped.

Microsoft.PowerToys-0.81.1.attest.json

illustrative · not product output


        1
        {
      

        2
          "_type": "https://in-toto.io/Statement/v1",
      

        3
          "subject": [{
      

        4
            "name": "winget://Microsoft.PowerToys",
      

        5
            "digest": { "sha256": "9c4f7b1e4a2d8b7e9c1f0a3b5d6e7f8a1b2c3d4e5f60718293a4b5c6d7e8f9a0" }
      

        6
          }],
      

        7
          "predicateType": "https://slsa.dev/provenance/v1",
      

        8
          "predicate": {
      

        9
            "buildDefinition": {
      

        10
              "buildType": "https://attestree.com/builds/winget-detonate@v1",
      

        11
              "externalParameters": {
      

        12
                "source": "winget-pkgs/manifests/m/Microsoft/PowerToys/0.81.1",
      

        13
                "channel": "stable"
      

        14
              }
      

        15
            },
      

        16
            "runDetails": {
      

        17
              "builder": { "id": "https://attestree.com/runners/win-2025-amd64/r-7c33" },
      

        18
              "metadata": {
      

        19
                "invocationId": "att_01JK4M9F2X5W8H6P0Q1R2S3T4U",
      

        20
                "startedOn":   "2026-04-29T14:02:11Z",
      

        21
                "finishedOn":  "2026-04-29T14:04:03Z"
      

        22
              }
      

        23
            },
      

        24
            "sbom": {
      

        25
              "format": "CycloneDX-1.6",
      

        26
              "componentCount": 412,
      

        27
              "digest": "sha256:e45a91d2c0b3a4e5f6a7b8c9d0e1f2a3b4c5d6e7f8091a2b3c4d5e6f70819203"
      

        28
            },
      

        29
            "signature": {
      

        30
              "alg": "ecdsa-p256",
      

        31
              "keyId":  "att-root-2026-04",
      

        32
              "value":  "MEUCIQDx9k...cWZ0nQv5wA=="
      

        33
            }
      

        34
          }
      

        35
        }

FOR YOUR FLEET

Same tree.
Start where you are.

Whether you run two laptops or five hundred, the attestation primitive is identical. Policy, deployment, and evidence shape themselves to your environment.

01 Hobbyists & enthusiasts