Your own winget source.Granted.
kvellman is a winget-compatible package repository that runs on your own servers. Mirror the public catalogue, publish your internal installers, and decide exactly what every Windows machine is allowed to install — with no SaaS in the path.
From a single Docker host to multi-site, air-gapped fleets. Designed and developed in Germany.
Add it as a source
$ winget source add --name kvellman --type Microsoft.Rest --arg "https://kvellman.example/api/<site-token>"
Why kvellman
Built for networks you own
01
Under your control
Mirror the public winget catalogue, adapt it, or publish installers that never existed upstream. The index, the binaries and the audit trail stay on your side of the firewall.
02
On-prem & air-gapped
Runs fully disconnected, including offline/air-gapped operation. No SaaS, no phone-home — 100% inside your own network.
03
Access on your terms
Every client reaches you through a site token you issue and revoke — put whatever perimeter you already run in front of it, from a flat LAN to a locked-down proxy.
04
Edge mirroring
Edge nodes cache installers on first request. The first machine on a site pulls over the WAN; every machine after it pulls over the LAN.
What it does
What ships in the box
winget-compatible REST API
Implements the winget Source contract exactly — information, manifestSearch and manifest delivery. The winget CLI cannot tell the difference.
$ winget search --source kvellman notepad
Name Id Version
---------- ---------------------- -------
Notepad++ Internal.Notepad-plus 8.7.1
Manifests & overlays
Versioned YAML manifests, upstream import, and per-package overlay templates for repeatable edits.
Local installer storage
Store installers on the origin, or point manifests at your own URLs; hashes are recomputed on every delivery.
Approval workflow
Nothing reaches a client until someone signs off. Every version change lands in the audit log with a name against it.
Telemetry & dashboards
Observe searches, manifest fetches and downloads per site and winget version.
Edge / mirror nodes
Headless caching nodes with central enrollment, scope control and bandwidth savings.
From the public catalogue to your clients
One path, entirely inside infrastructure you run.
Upstream
The public winget catalogue and vendor installers.
kvellman origin
Mirrors, reviews and re-publishes — under your policy.
Edge nodes
Per-site caches, enrolled with a one-time key.
Windows clients
Plain "winget install", unchanged.
Community and Enterprise
kvellman is open core: the platform is open source; advanced features are commercial plugins.
Community
Apache-2.0, free. Multi-user with roles, one installation.
- winget-compatible source API
- Manifests, overlays & upstream import
- Local installer storage
- Multi-user accounts with roles (viewer/reviewer/admin)
- Approval workflow & audit log
Enterprise
SSO, MFA and edge nodes at additional locations. Commercial subscription.
- SSO (OIDC) & MFA (TOTP)
- Edge / mirror nodes
- Everything in Community
Up and running in ten minutes.
One Docker host, one compose file, one token — that's the whole setup.