Back to Projects

Attestree

Attested winget for Windows fleets — signed provenance at ingest

.NETwingetin-toto / SLSASBOM / CycloneDXSigstorePostgreSQLDockerAstro

Private Repository

Problem

Most Windows shops install packages straight from the public source and discover problems only after a scanner runs against an endpoint days later. By then the artifact is already running across the fleet, SBOMs are an afterthought, attestations are missing, and the supply-chain story is "we trust Microsoft's CDN." Tanium, Defender for Cloud, Snyk, and their peers scan deployed binaries after the fact. Nobody inspects the catalog and distribution layer before deploy.

Approach

Attestree inverts the order: winget install, but with a receipt. Every package is attested at ingest, not after install. The installer's signature and publisher continuity are checked, the package is detonated in a sandbox, a CycloneDX SBOM is generated from what the install actually did, and policy-as-code decides. Admitted artifacts carry a signed in-toto statement with SLSA v1 provenance that an auditor verifies with a public key. Endpoints are then fenced to the operator's own attested winget feed and receive packages through groups and rings, with the agent re-verifying the exact approved hash at install.

Package Sources winget · Chocolatey · (MSI/MST, drivers: roadmap) INGEST GATE — EVIDENCE + POLICY Installer signature · Publisher continuity Sandboxed detonation · Observed SBOM Rejected admit SIGNED ATTESTATION in-toto · SLSA v1 · CycloneDX · ECDSA P-256 FENCED WINGET FEED Private REST source · SHA-256 pinned GROUPS × RINGS Canary → Pilot → Broad → All · rollback WINDOWS FLEET ENDPOINTS Agent re-verifies at install · shim (Apache-2.0) FLEET INVENTORY & CVE INDEX Observed inventory winget · Chocolatey Self-hosted index cvelistV5 · CISA KEV Update pipeline with halt queue Signed evidence bundle, offline-verifiable CONTROL PLANE .NET · PostgreSQL Community Edition (Docker) Marketing site (Astro · CF Pages)

Architecture

The system has two surfaces. A control plane with an endpoint agent runs the ingest gate, attestation, and deployment. The public front door is the marketing site plus an open-core community edition.

Ingest Gate

Each package passes through fetch, installer-signature and publisher-certificate checks, sandboxed detonation, an observed CycloneDX 1.6 SBOM, and a policy-as-code decision. The result is signed as an in-toto statement (ECDSA P-256). winget is live, and Chocolatey is managed under the same control plane. MSI/MST transforms, driver rings, and further package managers are on the roadmap.

Fenced Feed, Groups × Rings

Endpoints install from the operator's own spec-compliant winget REST source, pinned to the approved SHA-256; a normal winget install never reaches the public repository. PC Groups decide what a device runs; rings (canary → pilot → broad → all) decide which version. Rollback goes to any prior version. A failing rollout produces a rollback proposal for the operator to confirm rather than acting on its own.

Unattended Updates with a Halt Queue

An opt-in pipeline ingests, detonates, and promotes new winget versions ring by ring. It halts for review when a publisher's signing certificate changes or an installer arrives unsigned, which is exactly the signal a hijacked release produces.

Control Plane Stack

  • .NET: Native AOT installer shim and a self-updating endpoint agent rolled out through the same rings
  • Docker + PostgreSQL: server image with a Postgres sidecar; per-tenant scope as a first-class invariant
  • Open formats: in-toto, SLSA v1, CycloneDX 1.6 (Syft), with Sigstore supported but not required
  • Fleet CVE index: self-hosted, matching observed inventory against cvelistV5 and CISA KEV, with an offline bundle for air-gapped hosts

Key Technical Decisions

Attest at ingest, not scan after install

The structural wedge: Attestree owns the catalog/distribution layer and verifies before deploy. Without pre-deploy attestation, "we inventory it" is just a fancier winget list.

An observed SBOM, not a declared one

The SBOM is generated from what the installer actually did in the sandbox, not taken from the publisher's manifest. An ingest-time SBOM is an observation, and that is what makes it worth signing.

Three enforcement points

For a Windows fleet the endpoint is the load-bearing enforcement point, so policy is not a single pipeline check. The ingest gate blocks before the catalog, reconciliation catches drift against declared state, and the agent re-verifies signature, hash, and policy at install.

Humans confirm the destructive step

Automation proposes and people approve. Rollback proposals are confirm-gated and off by default, and the update pipeline halts into a review queue instead of guessing when a publisher's signing identity changes.

Open-core with an enforced license boundary

The installer shim and its IPC contract are Apache-2.0; the platform is closed-source. The license boundary is enforced mechanically in the build, so closed-source code cannot be relicensed by accident. The free community edition runs self-hosted on Docker Compose with no cloud dependency, ships as Sigstore-cosign signed images, and includes roles, TOTP two-factor, and operational runbooks.

Public Site

The marketing site at attestree.com is a separate, fully public surface: a static Astro build with Tailwind + MDX, deployed to Cloudflare Pages with a preview deploy per PR. The waitlist runs as a same-origin Cloudflare Pages Function backed by D1 in an EU jurisdiction with hardened Turnstile verification. Site copy is re-synced against every platform release, with an explicit shipped-vs-roadmap split, and unbacked claims are removed rather than hedged. The build-security baseline covers SHA-pinned actions, least-privilege tokens, a committed lockfile, Dependabot, an npm audit CI gate, and security.txt.