{"record":{"id":"5ec7a21b1e8bd359","repo":"cli/cli","slug":"expected-the-leaf-certificate-issuer-to-only-have","errorCode":null,"errorMessage":"expected the leaf certificate issuer to only have one organization","messagePattern":"expected the leaf certificate issuer to only have one organization","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"pkg/cmd/attestation/verification/sigstore.go","lineNumber":201,"sourceCode":"\t\tline, readError = reader.ReadBytes('\\n')\n\t}\n\treturn verifiers, nil\n}\n\nfunc getBundleIssuer(b *bundle.Bundle) (string, error) {\n\tif !b.MinVersion(\"0.2\") {\n\t\treturn \"\", fmt.Errorf(\"unsupported bundle version: %s\", b.MediaType)\n\t}\n\tverifyContent, err := b.VerificationContent()\n\tif err != nil {\n\t\treturn \"\", fmt.Errorf(\"failed to get bundle verification content: %v\", err)\n\t}\n\tleafCert := verifyContent.Certificate()\n\tif leafCert == nil {\n\t\treturn \"\", fmt.Errorf(\"leaf cert not found\")\n\t}\n\tif len(leafCert.Issuer.Organization) != 1 {\n\t\treturn \"\", fmt.Errorf(\"expected the leaf certificate issuer to only have one organization\")\n\t}\n\treturn leafCert.Issuer.Organization[0], nil\n}\n\nfunc (v *LiveSigstoreVerifier) chooseVerifier(issuer string) (*verify.Verifier, error) {\n\t// if no custom trusted root is set, return either the Public Good or GitHub verifier\n\t// If the chosen verifier has not yet been created, create it as a LiveSigstoreVerifier field for use in future calls\n\tif v.Custom != nil {\n\t\tcustom, ok := v.Custom[issuer]\n\t\tif !ok {\n\t\t\treturn nil, fmt.Errorf(\"no custom verifier found for issuer \\\"%s\\\"\", issuer)\n\t\t}\n\t\treturn custom, nil\n\t}\n\tswitch issuer {\n\tcase PublicGoodIssuerOrg:\n\t\tif v.NoPublicGood {\n\t\t\treturn nil, fmt.Errorf(\"detected public good instance but requested verification without public good instance\")","sourceCodeStart":183,"sourceCodeEnd":219,"githubUrl":"https://github.com/cli/cli/blob/0eeec0b92edbe70199f9768522f831d3534f41ad/pkg/cmd/attestation/verification/sigstore.go#L183-L219","documentation":"Error \"expected the leaf certificate issuer to only have one organization\" thrown in cli/cli.","triggerScenarios":"Thrown at pkg/cmd/attestation/verification/sigstore.go:201 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["The attestation certificate is malformed; re-download the bundle or regenerate the attestation, then verify again."],"exampleFix":null,"handlingStrategy":null,"validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"0eeec0b92edbe70199f9768522f831d3534f41ad","analyzedAt":"2026-08-15T12:31:05.478Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}